Repository navigation
Publish the bodies behind the pinned digests: the bit twin's gate now decides A2 and A3 on real exports (no new κ) - #241
Closed
maxime-fleury wants to merge 12 commits into
Closed
maxime-fleury wants to merge 12 commits into
maxime-fleury wants to merge 12 commits into
Conversation
…and the complex ledger's top Rung 2 binds on the complex supplier and lands on its ceiling, so the ladder can only continue there. Exactly three families of that ledger fill whole width-66 banks: rank 11 (rung 2), rank 16 and rank 20. Pricing the other two with the pinned engine through the unchanged 47-constraint assembly gives rung 3 at 7.10572698755137e-4 and rung 4 at 7.11175695867958e-4 -- +0.4072% over rung 2 and +4.0963% over the CrocSwap#207 frontier -- after which no remaining family has a whole-bank volume, so the accounting ladder terminates. The next wall is the bit word: the rung-1 leaf caps kappa at 7.277251e-4. A priced target, not a witness: C1-C7 and T1 are open, plus CrocSwap#219's inherited R1-R4. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
The three absorptions occupy 783 width-66 banks (531 + 192 + 60); the table gave them separately but the total was only in the certificate. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
…their negative result
A uniform bank pattern absorbing a set of families forces one common bank count, so the
scan is over the gcd of the item counts rather than over partitions of 66 -- exhaustive
and therefore a decision. It shows rank 11 tiles alone four ways (rung 2's 531 is the
tightest), that ranks 16 and 20 tile alone only above the bank counts their own volume
criterion prices (198 and 66 against 192 and 60, six three-copy banks short each), and
that no mixture tiles at all: {16,20} comes closest at 84 registers into a 66-wide bank.
The two top rungs are therefore priced on bank counts no admissible tiling realises, a
stronger caveat than "not constructed", so it is recorded in the certificate, the
obligations file and both documents rather than left implied.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
…ladder onto it The T1 enumeration left exactly one repair: pad the bank. A bank the family cannot fill alone can be filled by the family plus a fixed pattern of retained blocks, so rank 16 fits 198 banks of (4 blocks + 2 registers) and rank 20 fits 66 banks of (3 blocks + 6), every bank exactly full, every item in a block with no slot unused, and the padding drawn as a partial removal from a retained bin (396 rank-1 children of 262,602). Because the mass that leaves is banks * 66 by construction, the row identity and stock-drop-equals-bank-count rule both survive, every padding option can be enumerated and priced, and the padded schedule prices above the volume-criterion rows it replaces: the top of the ladder is now the padded rung 4 at kappa = 711599961413937/10^18, +4.1584% over the frontier. T1 is therefore settled at the schedule level rather than merely owed, and the certificate, the obligations file and both documents say what is still open: C1-C7, the normalizer, frames, charts and prime witnesses, since the padding blocks are ordinary retained children and no new frame family is introduced. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
… dial Two questions the last commit left open, both answered by measurement rather than by argument. The bank width is the word's own modulus -- the pinned bit-side schedule fixes M = 72, banks = volume/72 and stock drop = bank count -- so a width scan is a word scan: the pinned ledger's rank mass over stock is 65.8905, which makes every modulus of 65 or under unposeable (66 is the smallest it admits), and every wider modulus leaves a row whose density has moved (95.5% at 69, 91.5% at 72), i.e. a different word, so only the pinned width is priced -- where the scan reproduces this package's top exactly, as its own calibration. The scan also shows the criterion is not the cap: at modulus 54 nine families would tile 1,549,098 registers (65% of the rank mass) whole, against 52,470 here, so the dial to turn is the supplier's density, not the bank layout. Then the schedule is instanced: all 4,176 items of the three families get a bank, a block and an offset under item i -> bank i//k, block i%k, with per-family table digests, every bank exactly filled, the padding named, and the ledger re-derived with the stock falling by exactly the bank count. That instantiates C1's combinatorial half and the C5-C7 inventories; what stays owed is stated from the pins rather than in prose -- the complex supplier's certificate has no bank key and its own status line says the operation program is not exported, so the residual projectors the normalizer must move are simply not there. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
…gets onto both branches The width scan left one question open and it decided the next step: the bank criterion is not what caps the ladder, the ledger's density is. So this asks it over the tree instead of guessing. Every ledger-bearing certificate in the repository is scored on the same four numbers (modulus, density, the smallest modulus the row admits, the mass share tiling there), keeping only rows that satisfy m*W - mass = D with every child inside the width: 20 distinct poseable ledgers are found and none is less dense than the complex word, which is itself the least dense one in the repository. A narrower modulus cannot be reused, it has to be built. So the same module prices the word that would take it: holding the pinned shape and occupancy and varying only the modulus, the cheapest stock that poses the row. The width-66 point is its calibration -- there the required stock is exactly the pinned stock, 12,052, and it reproduces this package's top kappa. At widths 48 and 60 the complex branch stops binding and the kappa rises to the budget the pinned bit leaf allows (+2.2655%, the whole of the complex headroom left); at 72 nothing tiles and every wider word is strictly worse. Finally the targets invert onto both branches. kappa is read off min(bit leaf, (1-beta)C - weak), so a target needs both branches above its budget, and the cap must clear the budget after the beta and weak haircuts, which costs one 10^-18 grid step. Per target: 7.5e-4 needs a bit leaf +3.064% and a complex coarse saving +5.400% over the top rung; 8e-4 needs +9.940% and +12.433%; 1e-3 needs +37.453% and +40.569%; only 7.2e-4 is short on the complex branch alone, and the complex ceiling the density curve finds above is still below all of them. This also fixes the target list itself, which read 8/10^3 where the package documents 8e-4. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
…s closed by the pins Asked whether C1-C7 and R1-R4 can be discharged and whether the kappa can then be made unconditional. The first is yes and the second is no, and both are readings of pinned bytes rather than positions, so the answer is now recorded with its evidence and checked back by verify.py. The eleven items are one missing artifact seen from eleven rungs: the literal operation program, then the columns, charts, witnesses and envelope re-run on the word it banks. The supplier this whole ladder is priced on certifies its flow and all-column fresh identity and states in the same breath that a literal globally renumbered operation program is not exported, with its receipts calling the literal program a downstream integration task. So C1's normalizer has to move projectors that exist only there, C2 re-runs a word that program defines, C3 charts the frames it creates, and C5-C7 need each child's frame/chain identity where the pins export a count per bin and not an identity. C4 is the one item closable from the pins alone once C1's completion children are named; R1 is the exception on the other side, with a pinned precedent to extend. Unconditional is closed three times over: the supplier is published as a PASS conditional finite witness, the vendored CrocSwap#219 package states that discharging R1-R4 buys a completed finite witness and that the result is not an unconditional multiplication theorem in any case, and this package's own scope says the same of the finite bridge and all-size interfaces it inherits. Discharging the eleven raises the kappa from a scheduled target to the house-standard conditional finite witness, which is the whole of what the work buys. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
… against the pins C1-C7 and R1-R4 reduce to one missing artifact: the literal operation program, then the columns, charts, witnesses and envelope re-run on the word it banks. This turns that into an interface the importer can accept or refuse, instead of a hoped-for construction. The contract names six required exports -- the operation program, the frame bodies behind the three published cache digests, the exact lift and witness pair, the chronology tables, the per-child occurrence inventory, and the envelope plus integrity manifest -- each with the digest it must reproduce, so it asks for bodies behind hashes the supplier already publishes rather than for new trust. Seven acceptance tests carry the bounds and a reject control each, and every export maps to the obligations it unblocks (all eleven are covered). Two readings shape it. The exports address the lift/witness pair and not the flow block, because the supplier's own flow.status says "Not an exact supplier certificate". And the per-child export is asked in the exact shape of the bit word's absorbed-occurrences.json, since our side of that bijection already exists in occurrences66.json: 4,176 items over 795 banks. verify.py -> check_export_contract resolves every citation against the pinned bytes -- the digests, the column and read counts, the status strings and the precedent values of the banked word and the occurrence inventory -- and asserts the state the contract declares: 0 of 6 bodies exported today, so the import fails closed and the kappa keeps its conditional flag. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
check_export_contract now derives the bodies the contract waits for from the contract itself (the lift certificate, the three cache bodies) and asserts none of them is in the pin manifest, nor any path under the supplier's own workspace. So "no body export exists in the pins" is read back from the pinned file list rather than restated in prose, which is the one claim in the contract that a reader should not have to take on trust. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
…ntil the bodies arrive The contract named the six exports; this runs them. importer66.py consumes the exports, applies the seven acceptance tests with their bounds, and today -- when no body exists -- refuses cleanly with exit code 2 after naming all ten bodies it waits for, so no obligation moves on an empty import. The module keeps apart two things that are easy to confuse. The gate is decidable from what the bodies declare: hashes anchored to the digests the supplier already published, cardinalities, the published bounds, the two bijections (the frame id map, and the occurrence families against this package's own occurrences66.json) and the counts that must come out of the exported tables rather than out of the certificate. The replay is the physics, and it is the supplier's own checker: the contract pins its digest, so the harness requires that file by digest and stops at "gate green, replay not run" until it arrives, rather than reimplementing or claiming the columns. It is proven to work while the data is absent. --self-test builds synthetic bodies, patches the anchored digests to their synthetic hashes and then breaks each check in turn: a tampered body, a wrong cardinality, a denominator above the bound, counts that do not come from the tables, a foreign family and bin, an accepted colouring conflict, a repeated prime witness, an absent body, a checker the contract does not pin, and the pinned checker passing. All twelve cases pass, and verify.py now runs them, so the refusals the harness will perform on the real drop are demonstrated rather than promised. Writing the harness found two real bugs in the contract's gate model, both fixed here: an export's declared checks were being applied to every body it owns instead of its primary body (so the colouring and witness bounds were demanded of graph.json and record.json), and the integrity manifest was required to declare its own digest, which no file can contain. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
Adding importer66.py to the package changes the manifest the certificate embeds as source_pins, so the certificate is regenerated rather than left describing a pin set that no longer exists. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
The twin contract's gate was proved only on synthetic bodies, because the bodies behind the digests the pinned certificates publish did not exist as files. This ships them. `exports-bit/` holds ten of the bit contract's fifteen required bodies, eight of them anchored: the five word bodies and the witness body are the supplier's own bytes, each hashing to the digest its certificate already published, and the two canonical streams are reproduced rather than obtained -- PR205's packer, unmodified on the drop's word bodies, re-derives the chart and incidence streams byte for byte and its rebuilt physical block differs from PR205's published block in none of its 26 fields (`exports-bit/physical.rebuilt.json`). The declarations the bodies do not carry themselves come from two index bodies that `bitindex.py` derives from the bodies and the pinned certificates instead of typing in; neither is anchored, since an index is a declaration and the bodies it describes are what carry the digests. Running the gate on real bytes found three defects of the harness, all fixed here. An absent body that an export names was recorded as a failed check rather than as a missing datum, so a partial drop looked like a rejecting one; absence and failure are now distinct answers and only a present-but-wrong body fails. The anchored-digest loop and the manifest loop raised FileNotFoundError on an absent body instead of reporting it. And the JSON report is written as bytes: a redirected report is pinned by the manifest, and the default text stream would translate its newlines so that the digest would not survive the round trip. The gate now decides two of the seven acceptance tests on published bytes -- A2 on the index's counts, its frame-record bijection and its foreign-replay bound, A3 on the chart and witness bounds -- and reports the rest rather than guessing: A1 passes its eight digest anchors and nine index checks with no failure and waits for B6's manifest, A6 and A7 pass seventeen checks each and wait for B5's controls, A4 and A5 hold no check while B4 and B2 are absent. The thirteenth self-test case runs that report on the real drop, and verify.py reads the drop back: the ten bodies and their anchors, the rebuilt block, the two passing tests, the refusal code and the stored report, which it re-runs and compares. Verifying the drop from a clean clone exposed one more defect, this one already in the record: the certificate stored the corpus scan's root as the checkout's absolute path, so `verify.py` could not rebuild the certificate anywhere but the directory it was authored in, and the commit carried a local directory name. The scan now reports its root relative to this package, which is what makes the record reproducible rather than machine-specific. Nothing about the claim moves. A partial run is reportable and never admissible (exit 4 is never an import), the default import still refuses the five absent bodies, the replay stays NOT RUN because the checker the contract pins is not supplied, and R1-R4 stay OPEN. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
Contributor
Author
|
Reviewing this one: the branch adds a single commit on top of #232's head ( git fetch fork research/export-import-harness
git show 33d23ec --stat # 24 files: the drop, the two contracts, the harness, the pinsIf #232 lands first, this PR's diff collapses to that commit on its own. Everything in it was verified from a clean clone of |
maxime-fleury
changed the title
B2 bank-count contract and A5 occurrence validation: scoped fix + reproducible testsI found two finite contract defects at
Download the validated patch, reproduction evidence and test logs ZIP SHA256: The package includes the legacy empty-assignment reproducer and 29 regression tests. Seven importer-level tests require malformed assignments to fail A5 itself while A1 has no failed checks. Contract, manifest and embedded certificate pins are regenerated; historical sources, exported word bodies and mathematical certificate fields are unchanged. Validation (Linux, Python 3.12.14):
Apply the included Limits: The full 16-group Credit for the importer, accounting, inventory and pre-existing tiling calculation remains with Maxime Fleury and the #219/#232/#241 lineage. The PR200 bit word/checkers are Chafik Boukhalfa's; the PR205/197 bank construction and the upstream contributors retain their existing notices. Prepared with substantial OpenAI Codex assistance, under Apache-2.0. |
Contributor
|
Thank you @maxime-fleury. This contribution is now retained on main in the scoped 100-PR review and contributor credits. Contribution: Partial implementation bodies and importer for a proposed bank ladder. Review and limits: Fresh pricing and importer self-tests passed. The partial import must keep replay NOT RUN and missing R1-R4 obligations open; this is diagnostic research, not a new witness. The complete original source, notices and relevant execution evidence are retained through the pinned source archive. The review distinguishes fresh local runs, source-bound historical Linux CI and prior exact-head review; it does not claim 100 fresh full mathematical audits. Closing this historical PR as reconciled. This preserves parallel and cumulative credit without replacing the selected frontier or promoting priced research targets to completed constructions. Reviewed head: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No new κ. Nothing here moves the number or the status: R1–R4 stay OPEN, the replay stays NOT RUN, and a partial run is never admissible. What changes is that the bit twin contract's gate stops being proved only on synthetic bodies: the bodies behind the digests the pinned certificates already publish now exist as files, and the gate decides two of the seven acceptance tests on them.
Stacked on #232. The branch is one commit (
33d23ec) sitting on #232's head, so the diff againstmaincarries #232's commits too: review the top commit alone, or land #232 first and this becomes a one-commit PR. The base ismainbecause a fork branch cannot be a base branch here.What the drop holds
research/complex-bank-run3/exports-bit/— 10 of the twin's 15 required bodies, 8 of them anchored:word.json.gz1cb7e8ed…,frames.json.gzad8e2705…,graph.json31a09a55…,kchron.json0fab548e…,profile.jsonc44ef864…, plus the derivedindex.json.gzcharts.json22662b85…,incidence.json76bff256…,prime-witnesses.json.gz612f0b91…, plus the derivedcharts.index.json.gzassignment.jsoncolumns.jsoncontrols.jsonenvelope.json,integrity.jsonThe five word bodies and the witness body are the supplier's own bytes, each hashing to the digest its certificate already published. The two canonical streams do not exist upstream as files — PR205 published digests of streams — so they are reproduced rather than obtained: PR205's own packer, unmodified, run on this drop's word bodies re-derives both byte for byte, and the packer's recomputed
physicalblock differs from PR205's published block in none of its 26 fields (exports-bit/physical.rebuilt.json). The declarations the bodies do not carry themselves come from two index bodies thatbitindex.pyderives from the bodies and the pinned certificates instead of typing in; neither is anchored, since an index is a declaration and the bodies it describes are what carry the digests.What the gate decides on it
python3 -B importer66.py --contract export-contract-bit.json --exports exports-bit --partial→ exit 4:The default import still refuses the drop (exit 2), the replay is NOT RUN because the checker the contract pins (
4d7c86cd…) is not supplied, and the run is kept asbit-drop-report.json.Four defects the real bytes exposed
Three in the harness, all fixed here:
FileNotFoundErroron an absent body instead of reporting it;And one already in the record, which the clean-clone check found: the certificate stored the corpus scan's root as the checkout's absolute path, so
verify.pycould not rebuild the certificate anywhere but the directory it was authored in, and the commit carried a local directory name. The scan now reports its root relative to the package.Verify
verify.pynow pins 47 files by sha256 (20 of this package's own, 16 vendored rung-1, and the drop's 11, reproduction evidence included), reads the drop back body for body and anchor for anchor, re-runs the stored partial report and compares it, and asserts the seventh self-test case on the real drop. All of it was run from a clean clone of this branch, where the certificate rebuilds identically.