Repository navigation
proof(flags): canonical --cubical-compatible in force; grades as PROOF-POLICY §8 PWG - #32
Conversation
…des as PROOF-POLICY §8 PWG PROOF-POLICY §2.1 names `agda --safe --without-K --cubical-compatible` as the canonical invocation; waiver W-1 kept the flag off, on the belief that only a relational big-step semantics could remove the last 13 warnings (`just`-injectivity in Noninterference.Generic). That belief was wrong: - Prelude: `just-inj` defined by `cong` through the computing projection `from-just`, which needs no unification rule. - Noninterference.Generic: the six clauses that matched `refl` against `exec … ≡ just t` now carry agreement along `just-inj` (`just-≈`, `just-≈₂`). No statement, semantics or fixture changed. - scripts/proof-flags.sh: `--cubical-compatible` added. Gate, laws certificate and receipt all run under it. - tests/flag-control/IndexedMatch.agda + scripts/check.sh: a correct proof that only the flag refuses; the gate fails if it is ever accepted. Removing the flag was tested to fail the gate. The relational route would not have sufficed on its own: a probe proving determinism of `c , s ⇓ t` raised 22 UnsupportedIndexedMatch warnings (inverting two derivations of one command needs Cmd injectivity). Grades: "mathesis Grade 3" was the unratified brief's wording. PROOF-POLICY §8 (2026-11-04) supersedes it and makes PWG-3 depend on the §2.1 invocation, so the theorems were `ungraded` while W-1 was open; they are PWG-3 now. The receipt carries the §8.5 fields (pwg, foundation-diverse, per-leg route, token and §2.2 state), derives the grade from leg states (tested: one RECONCILED leg -> 2i, two -> 2ii, BRIDGE-PENDING does not count), pins the PROOF-POLICY commit (§7), and moves from agda-grade3_praxis.deed to agda_praxis.deed because a grade is derived and can change. EXPLAINME listed --cubical-compatible as a checker flag while it was waived; that line is now true. README's Lintel pin corrected (ee01db4 -> d1d843b). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017yYi5JxzXZs6nz1ZSForfP
|
Caution Review failedThe pull request is closed. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
Two checks fail on The proof gate is green in CI. "Core proofs, countermodels, expected rejections, minimal-laws certificate" passed under Canon lockstep The job compares
This PR does not touch the deed. The same pin is on No fix exists yet. The fix is to bump the deed's estate-rules
I'm not widening this PR for either failure. Generated by Claude Code |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🟠 indeterminate · commit Advisory: 11 row(s), worst 🔴 high (0 critical, 9 high) — reported, never grading the change.
Hypatia scan: error — the scanner produced no findings array
panic-attack assail: 14 finding(s)
pons asinorum: 9 finding(s)
finishingbot (release readiness): 173 finding(s)
glambot (presentation quality): 93 finding(s)
rhodibot (RSR compliance): 13 finding(s)
accessibilitybot: not_applicable — template default: enrol once the repository serves HTML
cipherbot: not_applicable — template default: enrol once the repository implements cryptography
echidnabot: not_applicable — template default: enrol once the repository carries proofs and an ECHIDNA engine is configured
panicbot: not_applicable — panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree
seambot: not_applicable — template default: enrol once a seam register exists at spec/seams/seam-register.json
sustainabot: not_applicable — reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
…patible proof #30 landed the same --cubical-compatible change on main with its own helper names. The owner chose this PR's version, so the 7 files that only #30 touched on main (Prelude, Generic, proof-flags.sh, grade-receipt.sh, the receipt, PROOF-STATUS and proof-debt) keep this branch's side. CHANGELOG keeps both new entries; the template sync (#28) and the other main changes merge cleanly. Checked with Agda 2.6.4.3 (Debian 13 agda-bin 2.6.4.3-1+b2): check.sh (core proofs, 4 expected rejections, flag control), minimal-laws.sh (3 laws, each needed), and grade-receipt.sh --check (15 modules, all sha256 verified). Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
|
The owner chose #32 as the base for the cubical-compatible change, so this branch now builds on it instead of #26. - Proof code, proof-flags.sh: #32's version (Prelude.just-inj, tests/flag-control/IndexedMatch.agda). The legs do not depend on the Agda helper names. - Receipt: verification/receipts/agda_praxis.deed (#32's name), written by grade-receipt.sh --write. #32 derives each PWG from the legs' §2.2 states, so N-1..3 and N-7..9 now carry route re-proved and state RECONCILED for both legs, and their grade derives as 2ii. A RECONCILED leg's token is proven. This branch's (legs) block, leg input hashes and the correspondence-record check are carried over. - proofs.yml: #32's receipt step plus this branch's legs job. - PROOF-STATUS, README, EXPLAINME, proof-debt: #32's wording, with this branch's leg facts and the new receipt path. Checked locally with Agda 2.6.4.3, Coq 8.18.0 and Lean 4.24.0: check.sh (core proofs, 4 rejections, flag control), minimal-laws.sh, check-legs.sh (both legs), grade-receipt.sh --check (15 modules), check-escape-hatches.sh and the invisible-character scan. Negative control: removing the N-9 row from verification/legs/README.adoc makes grade-receipt.sh --check fail with "only in grade-receipt.sh: N-9". check-adoc-renders.sh was not run here (no asciidoctor in this session). Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
My earlier merge (ba2484f) took #32's head before #32 was updated (3bf7f8e), because the local ref was stale. So this branch lacked main's later changes (the template sync #28, canon 2.1.5 #27, https-only edges #25) and kept some #26-only text. This merge corrects that. Each conflicted file is a 3-way merge on 3bf7f8e (the #32 commit the earlier merge used), so only this PR's legs changes are carried onto main. Files the legs work does not own take main's version: tests/workflows/governance_policy_test.sh, and docs/proof-debt.adoc except its legs bullet (this restores #32's dated W-1 record). The receipt is regenerated. The diff against main is now the legs work: the Rocq and Lean sources, check-legs.sh, the legs CI job, the receipt's (legs) block and RECONCILED leg states (PWG-2ii derived), and the matching doc lines. Checked with Agda 2.6.4.3, Coq 8.18.0 and Lean 4.24.0: check.sh, minimal-laws.sh, check-legs.sh, grade-receipt.sh --check (15 modules), check-escape-hatches.sh, the invisible-character scan and tests/workflows/governance_policy_test.sh. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
## Summary This PR replaces #29, on the same branch. #29 was stacked on #26, and GitHub refuses to move a stacked PR's base. #26 is superseded by #30 and #32, which are both on `main`, so this PR targets `main` directly. It adds the two recheck legs that `PROOF-POLICY` §2 asks for, Rocq and Lean, for every proved theory claim: N-1, N-2, N-3, N-7, N-8 and N-9. They are hand re-proofs, because transport is not available: Agda2Dedukti is an Agda backend pinned to a fork of Agda and cannot run on the pinned 2.6.4.3, and no Dedukti or Lambdapi exporter to Lean 4 has been released. Both legs check with no library and no axioms, and the statements are compared in a §2.2 record. `main` (#32) derives each grade from the legs' §2.2 states, and only `RECONCILED` counts. With both legs `RECONCILED`, the 6 claims derive `PWG-2ii`. **For the owner to review (doctrine 4):** the statement comparison in `verification/legs/README.adoc` was written by Claude Code and is labelled provisional until you review it. No tool checks it. The `PWG-2ii` grade rests on it. ## Changes - `verification/legs/rocq/SecretTypes.v`: Coq 8.18.0, prelude only, with no `Require`. 11 theorems. `Print Assumptions` reports "Closed under the global context" for each. - `verification/legs/lean/`: Lean 4.24.0, core only (the lakefile has no `require`, so no Mathlib). 11 theorems. `#print axioms` reports "does not depend on any axioms" for each. `exec` is defined structurally through `run`, so no well-founded recursion brings in `propext`. - `scripts/check-legs.sh`: pins both checker versions, refuses any library and any `sorry`, `admit`, `Admitted`, `Axiom` or `Parameter`, and fails unless all 22 axiom lines are clean. - `.github/workflows/proofs.yml`: new `legs` job. Coq is pinned by its Ubuntu package version, Lean by the sha256 of its release tarball. It uses only the already-locked `actions/checkout` pin. - `verification/legs/README.adoc`: the §2.2 correspondence record (route and reason, versions and invocations, residual assumptions (none), universe discipline, a point-by-point statement comparison, and a claim-by-claim map from each Agda name to its Lean and Rocq names). State: `RECONCILED`. - `scripts/grade-receipt.sh` and `verification/receipts/agda_praxis.deed`: - the 6 claims carry route `re-proved` and state `RECONCILED` for both legs, so their grade derives as `2ii`; a `RECONCILED` leg's token is `proven`; - the receipt gains a `(legs)` block: pins, invocations, axioms, and the sha256 of every leg input; - the script refuses a `RECONCILED` leg without a row in the correspondence record, and the reverse. - `PROOF-STATUS.adoc`, `README.adoc`, `docs/EXPLAINME.adoc`, `docs/proof-debt.adoc`: the new grade and legs. Not `PWG-1`: no per-commit receipt captures each checker's observed result yet. Not foundation-diverse: Agda, Rocq and Lean are all dependent type theories. ## RSR Quality Checklist ### Required - [x] Tests pass. Run locally with Agda 2.6.4.3, Coq 8.18.0 and Lean 4.24.0: `check.sh` (core proofs, 4 expected rejections, flag control), `minimal-laws.sh`, `check-legs.sh`, `grade-receipt.sh --check` (15 modules), `check-escape-hatches.sh`, the invisible-character scan, `tests/workflows/governance_policy_test.sh`, and `tests/e2e/use_template_mint_test.sh` (self-skips: this is a minted tree). - [x] No banned language patterns. The new code is Lean, Coq and bash. `lake-manifest.json` is git-ignored. - [x] No banned functions: `check-legs.sh` refuses `sorry`, `admit`, `Admitted`, `Axiom` and `Parameter`. - [x] SPDX headers on every new file except `lean-toolchain`, which Lean reads whole as the toolchain name. - [x] No secrets. ### As Applicable - [x] Documentation updated: PROOF-STATUS, README, EXPLAINME, proof-debt. ## Testing Negative controls: - Removing the N-9 row from `verification/legs/README.adoc` makes `grade-receipt.sh --check` fail with `only in grade-receipt.sh: N-9`. - Touching a leg source makes the receipt check fail on that file's sha256. Not run locally: `scripts/check-adoc-renders.sh` (no asciidoctor in the authoring session). CI runs it. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6)_ --------- Signed-off-by: Claude <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>



Summary
PROOF-POLICY §2.1 makes
agda --safe --without-K --cubical-compatiblethe canonical invocation. Waiver W-1 kept the flag off. It assumed that only a relational big-step semantics could remove the last 13 warnings, alljust-injectivity inNoninterference.Generic. That assumption was wrong. This PR puts the flag in force without changing any statement, the semantics, or any fixture.PROOF-POLICY §8 (owner ruling 2026-11-04) replaces "mathesis Grade 3" with Proof Witness Grades, and makes
PWG-3depend on the §2.1 invocation. So while W-1 was open the theorems wereungraded, and the docs overclaimed. With this PR they arePWG-3, and the receipt records them in the §8.5 shape.First of the follow-ups agreed with the owner. In order:
⇓as a second semantics with an adequacy theorem;Changes
Prelude.just-injis defined bycongthrough the computing projectionfrom-just. It matches nothing, so it needs no unification rule.Noninterference.Generic. Six clauses matchedreflagainstexec … ≡ just t. They now carry agreement throughjust-≈andjust-≈₂. The diff is about 25 lines.scripts/proof-flags.shadds--cubical-compatible. The gate, the laws certificate and the receipt all run under it.tests/flag-control/IndexedMatch.agdais a correct proof that only the flag refuses.scripts/check.shfails if it is ever accepted.verification/receipts/agda_praxis.deed, renamed fromagda-grade3_praxis.deedbecause a grade is derived and can change):pwg,foundation-diverse, and each leg's route, token and §2.2 state.RECONCILEDcounts.PROOF-POLICYis pinned by full commit (hyperpolymath/standards9bdf864cc7f2c8e24b4df84bf00d04158eee3ad5, §7).DESIGNEDandREFUTEDare gone; N-9 is a proved refutation).--cubical-compatibleas a checker flag while it was waived; that line is now true.ee01db4→d1d843b.Why not the relational semantics for this
A probe proving determinism of
c , s ⇓ traised 22UnsupportedIndexedMatchwarnings. Inverting two derivations of the same command needs injectivity ofCmd's constructors. So⇓alone does not satisfy the flag. It is still planned, as a second semantics with an adequacy theorem (execfinishes ⇔⇓), in a later PR.RSR Quality Checklist
Required
scripts/check.shis green: core proofs, 4 expected rejections, flag control.scripts/minimal-laws.shpasses:3 laws, each needed.scripts/grade-receipt.sh --checkpasses.-W error, the invisible-character scan and the escape-hatch scan.As Applicable
scripts/check-adoc-renders.shpasses on all 174 files (asciidoctor 2.0.26).(status): not touched.Testing
reflmatch makes the gate fail (exit 42,UnsupportedIndexedMatch).--cubical-compatiblefromproof-flags.shmakescheck.shfail at the flag control (flag control accepted).3;RECONCILEDleg →2i;2ii;opentoken →ungraded;BRIDGE-PENDINGdoes not count.Writes. That goes in a separate Lintel PR once this one merges.CI evidence for the new state comes from this PR's
Agda proofsrun. The old run links in PROOF-STATUS were for the waived flag set, so I removed them rather than carry them forward.Generated by Claude Code