ABI Layer 5: end-to-end soundness capstone certificate#34
Merged
Conversation
Add Oblibeniser.ABI.Semantics, a machine-checked proof of oblibeniser's
headline domain property: operations are reversible.
Models a faithful family of structurally-invertible operations (FlipAll,
XorMask, Rev, Nop, Seq) over a bit-register state (List Bool), and proves
the round-trip law as a real propositional equality:
reversible : (op : Op) -> (s : State) -> unapply op (apply op s) = s
Also proved: the dual direction (apply . unapply = id, so each op is a
genuine bijection), closure under sequencing, and an unforgeable
IsReversible certificate tied to the ABI Result code. Positive controls
exhibit inhabited witnesses; negative controls machine-refute the bad
case (a wrong inverse). No believe_me / postulate / assert — Integer was
deliberately avoided since its primitive ops do not reduce symbolically;
the bit-register model gives honest, reduction-friendly involutions.
Adversarial check: a deliberately false round-trip (= [True] instead of
[False]) is rejected by idris2, confirming non-vacuity.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx
Add Oblibeniser.ABI.Invariants, a second, deeper machine-checked theorem over the SAME Layer-2 model (Op/State/apply/invert/unapply). Where Layer 2 proves the per-element round-trip laws, Layer 3 proves the whole collection is a GROUP under Seq, quotiented by denotational equivalence Equiv: - Equiv is an equivalence relation and a congruence for Seq; - Seq is associative; Nop is a two-sided unit; - every op has a two-sided inverse (reusing reversible / reversibleDual); - inverses are UNIQUE (cancellation theorem); - invert is an involution and anti-homomorphism up to Equiv. Includes a sound+complete decision procedure decAgreeOn for agreement on a finite probe set, an unforgeable IsGroupInverse certificate tied to the ABI Result codes with a soundness lemma, positive controls (concrete witnesses + inhabited certificate), and negative/non-vacuity controls (Not-equivalences machine-checked, decision returns No). No believe_me/postulate/assert_total; %default total; builds with zero warnings; adversarial false proof rejected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx
Add Oblibeniser.ABI.FfiSeam proving the resultToInt encoding is sound: faithful round-trip (intToResult . resultToInt = Just) and injectivity derived from it, plus positive controls and a machine-checked non-vacuity control (Ok and Error differ on the wire). Genuine total proofs only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx
Assemble the prior proof layers into one inhabited certificate value: - ABISound record bundles the Layer-2 flagship reversibility witness (Semantics.certify), the Layer-3 group two-sided-inverse invariant (Invariants.groupInverse), and the Layer-4 FFI-seam injectivity (FfiSeam.resultToIntInjective). - abiContractDischarged : ABISound is constructed solely from those exported theorems, so it only typechecks if every layer is sound. - okErrorWireDistinct re-derives non-vacuity through the certificate's own injectivity field. Genuine composition only: no believe_me/postulate/assert/admit. Build is clean with zero warnings; adversarial false certificate (Ok = Error via the injectivity field) is rejected by the checker. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Layer 5 (the capstone, completing the 5-layer proof track): a new
*.ABI.Capstonemodule importing every prior layer and assembling a single inhabitedABISoundcertificate (abiContractDischarged) from the real exported witnesses of the flagship property (L2 reversibility), the deeper invariant (L3 group structure), and the FFI-seam injectivity (L4). One end-to-end soundness statement.Genuine composition only — reuses real exported names.
Testing
Idris2 0.7.0
--build→ exit 0, zero warnings. Adversarial: a bogus-field certificate was rejected.build/removed. Nobelieve_me/postulate/sorry.🤖 Generated with Claude Code
https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx
Generated by Claude Code