Portability tooling: checked cpp_int stand-in runs the selected replay's only native step (bit589 step 4) without Boost, matching the committed Boost receipts (no new kappa)

[thakrarsagar]

Change and mathematical scope

Portability tooling. No new κ, and no change to any construction,
certificate, selected record, pinned file or upstream/. One new registered
package, research/bit589-checked-cpp-int-seed92/.

Problem. The selected make frontier1094-verify reaches bit589's
tune/verify.sh. Its non-pip dependency is Boost, which pip cannot install. It
is used only by step 4, which compiles the three official cohort checkers
(legality_h, columns_h, columns_k). Those checkers are the only native
code in the selected chain, and their only Boost use is
boost::multiprecision::cpp_int.

Without Boost headers, step 4 stops at
'boost/multiprecision/cpp_int.hpp' file not found, so the selected reproduce
command cannot complete. verify.sh already reads BOOST_INCLUDE, and the
1094 → 1042 → 799 → 741 drivers pass the environment through.

Stand-in. include/boost/multiprecision/cpp_int.hpp is about 100 lines:

• Implementation: standard C++17 plus GCC/Clang __int128.
• API: exactly the subset the checkers use. Anything else fails to compile.
• Exact or refuse: every operation is overflow-checked. Shift counts are
  checked before any narrowing, and non-decimal stream formatting is refused. A
  value outside [−2¹²⁷, 2¹²⁷) aborts with a message. Nothing ever wraps, so a
  completed run computed exactly Boost's integers.
• Headroom: passing checker runs assert payloads below 2¹⁰⁴, well inside the
  range.
• Opt in:
  BOOST_INCLUDE=$PWD/research/bit589-checked-cpp-int-seed92/include make frontier1094-verify.
  Real Boost stays the default and the reference.

Scope. The pip dependencies (numpy, sympy, scipy) remain. MSVC is not
supported. Other repository cpp_int users that need division or gcd fail to
compile against the stand-in rather than run with different semantics. This
certifies equal finite checker results, not the multiplication theorem.

Task and overlap

• Base and track: base bce54fb3; none of the 25 inputs changed on main up
  to ef5f3940. Seed 92 → verification engineering, card portable-replay,
  scope refined: the repair is an environment dependency, not a payload
  comparison.
• How it was chosen: five explorers and impact/rigor/novelty judges ranked
  it the strongest portability blocker on the selected chain not covered by
  open work.
• Overlap: searches for Boost, cpp_int, int128 and BOOST_INCLUDE, plus
  find_overlap.py, found only PRs that use Boost. Nothing replaces it. Tooling: overlap bit589 and complex741 in the #741 ancestry replay, 17% (50% with --complex-jobs 3) less wall time (no new kappa) #1101
  only schedules bit589 alongside complex741. The precedent is the skeleton's
  own portable-include/bits/stdc++.h.

Validation

python3 scripts/research_package.py --package research/bit589-checked-cpp-int-seed92 --check-only
python3.12 scripts/research_package.py --package research/bit589-checked-cpp-int-seed92
python3 research/bit589-checked-cpp-int-seed92/mutants.py          # opt-in, about 2 minutes
python3 research/bit589-checked-cpp-int-seed92/mutants.py --ubsan  # opt-in

What verify.py checks (about 7 s, standard library plus bash and a C++17
compiler):

1. Pins and include order. All 25 declared inputs match their pins,
   including adapt.py's nine anchored parent files, relax.py and
   prime_witnesses.py. A probe compiled with verify.sh's own -I order
   confirms the stand-in is the compiled header.
2. Step 4, verbatim. The pinned verify.sh preamble, its step-3
   adapt.py command and its whole step-4 block run under bash. The composed
   text is hash-pinned. So every original assertion runs:
   • six binaries are built;
   • legality, the five-, nine- and eleven-stage formal columns, the
     omitted-bridge controls and the KPAIRS = 2 regression pass;
   • both mutation suites and the Gram witnesses pass.
3. Equality with the committed Boost-built receipts.
   • The 10 step-4 output lines equal the step-4 section of
     research/community-frontier741-audit/bit589.log.
   • columns_k4.json equals the committed Boost receipt except seconds and
     a path. That includes the payload bound
     9528119495320518471870892800.
4. Negative controls. All 6/6 and 3/3 are rejected by the checkers, never
   by the stand-in.
5. Over-range control. With all 24,305 ADD coefficients set to ±2³⁰, the
   stand-in refuses instead of wrapping.
6. Differential test against Python integers.
   • 100,000 seeded operations plus fixed boundary rows. The fixed rows cover
     ±2¹²⁷, shifts ending at 2¹²⁷, zero shifted far, 2⁶⁴ multiples and shared
     high words.
   • 62,870 in-range results must be equal.
   • 558 refusals must hold, including all 244 within a factor of 2 of the
     bound. The coverage counts are pinned.

Results.

• PASS_BIT589_STEP4_CHECKED_CPP_INT_STANDIN on Apple clang 21 / Python
  3.12.15 and on GCC 16.2 / Python 3.14.8.
• The registered research_package.py replay passes from a fresh worktree.
• Under UBSan, with every binary sanitized and a positive control, there are no
  reports.
• mutants.py rejects 16 of 17 header mutants. The accepted one is equivalent:
  the negative-value shift guard is redundant after the count check.

Not run.

• --boost-include, which reruns step 4 against real Boost: this host has no
  Boost.
• The complete make frontier1094-verify with the stand-in: this host lacks
  sympy and scipy. That is open question 1.

Pinned verify.sh and path spaces. The pinned verify.sh expands paths
unquoted, so checkout paths must not contain spaces. verify.py checks this
explicitly.

Registration note. The package compiles C++ in the generic package hook,
although the guide routes native builds to a dedicated workflow. That is
deliberate:

• the native build is the subject of the check;
• it uses only the runner's preinstalled g++ and bash;
• it installs nothing, and needs no Boost;
• it runs in about 7 s.

If maintainers prefer the rule, the command can move to its own workflow (like
e8-bit-p111-tuned.yml) with VERIFY.json kept for metadata.

Pre-PR review. Three lenses reviewed the package: exactness, verifier
soundness, and claims/CI. Their fixes are included:

• Shifts: a zero value shifted by 128 or more was undefined behaviour; it
  now returns zero. 64-bit counts were narrowed before checking; they are now
  checked first.
• Stream flags: non-decimal formatting is now refused.
• Differential coverage: boundary and 2⁶⁴-multiple rows were added; three
  previously surviving mutants are now killed.
• Declared inputs: 11 transitive files were added.
• Reproducibility: mutants.py was added.

Credit

• The checkers: Dylan Crow's κ = 8.75481145306751e-4: first E8 bit word (complex-bound; +9.29% over #352) #370 official checkers, generalised; DaysSky's
  κ = 9.95656966441037e-4: #370's E8 bit word in the nine-stage bridged word with #377's nine-stage complex E8 (above 2^-10; +2.94 % over #380) #381 columns_k.
• The carrier skeleton and its portable-include precedent: eumemic, who
  also wrote the Bit c = 0.001733052823: #545's punctured unit on the R420 skeleton (111 live ports, +4.79% over #543) #555 supplier.
• The Bit c = 0.001733427039589844: two A-section transports on #555's punctured R439 word (+0.0216%, κ unchanged) #589 transport and tuned word: DreamingOfClouds.
• The Conditional κ = 0.001661202643272239: eight B-frame coalescences after SW4 #741 audit's committed Boost receipts: Douglas Colkitt.
• The broader lineage: credited in the selected review.

AI disclosure: prepared by Sagar Thakrar with substantial Anthropic Claude
assistance, including explorer, judge and skeptic subagents. New work is
Apache-2.0.

Open next questions

1. Does the complete make frontier1094-verify pass with the stand-in on a
   host that has the pip dependencies but no Boost?
   • First step: a fresh Ubuntu job without libboost-dev, comparing its
     receipts with a Boost run.
   • Blocker: that needs a dedicated long-running job.
2. Should tune/verify.sh quote its path expansions?
   • Why it matters: it fails from checkout paths that contain spaces.
   • Blocker: the file is in a selected root, so edits need a maintainer
     rehash.

Workflow feedback (optional)

The package generator and --check-only worked well. Friction points:

• Transitive inputs: they had to be traced by hand. adapt.py's anchored
  parents and an importlib-loaded helper were easy to miss.
• Native-build rule: the guide's dedicated-workflow rule for native builds
  has no lightweight path for a seconds-long compile using only the runner's
  preinstalled toolchain.

[Mister-Meeseeks]

Batch review at 362d2f91f30b96bc2596ff431c9baf7a78503683.

Merged to main, preserving the original contributor commits and package attribution.

Reviewed scope: Opt-in checked signed-128 native adapter rejects overflow and unsupported operations, with exact differential controls and unchanged selected-bit step-four fixture output. Production Boost default stays intact; this is a bounded verifier acceleration, not arbitrary-precision replacement.

The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions.

Batch review, attribution and evidence. Thank you for the contribution.