[Lean] Verify one literal PR442 invocation against the multi-host contract

.github/workflows/verify.yml

@@ -64,7 +64,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        package: [historical, gaussian, matrix]
+        package: [historical, gaussian, matrix, pr442]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -81,5 +81,22 @@ jobs:
         if: matrix.package == 'historical'
         working-directory: formal/lean
         run: lake exe cache get
+      - name: Install pinned PR442 extraction dependencies
+        if: matrix.package == 'pr442'
+        run: python3 -m pip install -r research/lean-external-review/requirements.txt
+      - name: Fetch pinned PR442 Mathlib build cache
+        if: matrix.package == 'pr442'
+        working-directory: research/lean-multi-host-source
+        run: >-
+          lake exe cache get Mathlib.Data.Matrix.Mul
+          Mathlib.Algebra.BigOperators.Fin Mathlib.Tactic.FieldSimp
+          Mathlib.Tactic.Ring Mathlib.Tactic.NormNum
       - name: Check formal package and theorem axiom dependencies
         run: make formal-${{ matrix.package }}-verify
+      - name: Preserve PR442 build receipt
+        if: always() && matrix.package == 'pr442'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: pr442-lean421-receipt
+          path: /tmp/pr442-lean421-fresh.json
+          if-no-files-found: warn

Makefile

@@ -553,3 +553,14 @@ recycled-bit-full-verify:
 
 verify-recycled-bit: recycled-bit-full-verify
 	python3 -m unittest discover -s tests -p 'test_recycled_bit_integration.py' -v
+
+# Literal PR442 invocation: ordinary pinned Lake build, source checks and audits.
+.PHONY: formal-pr442-verify
+LAKE ?= lake
+formal-pr442-verify:
+	python3 research/lean-multi-host-source/check_sources.py
+	python3 research/lean-multi-host-source/test_flat_data.py
+	python3 research/lean-multi-host-source/test_verifier_stack.py
+	python3 research/lean-multi-host-source/verify.py --lake "$(LAKE)" --receipt /tmp/pr442-lean421-fresh.json
+	python3 research/lean-external-review/verify_package.py --build-receipt /tmp/pr442-lean421-fresh.json
+	git diff --exit-code

certificates/mixed-point-audit.json

@@ -487,7 +487,7 @@
   "source_sha256": {
     "docs/research/mixed-point-audit.md": "c80527f9e98c27bd7f5858a06c7273f84c40e0c41505eb4d16029b61f80fb968",
     "scripts/experiments/mixed_point_circuit.py": "f509362b5031976a22af351fd158ae0b4520fa4f286a5176ec37023d672a7ddc",
-    "scripts/rational_span_frames.py": "ac3b9ab462b790d195628f0e5aa4f95143596a51ce7df1a99360b98594c29932"
+    "scripts/rational_span_frames.py": "766d342dd73ca5efd784c5733282a93d379a58beea763e703238dfbb4eacce82"
   },
   "status": "BOUNDED MIXED-POINT RESEARCH; NO NEW KAPPA",
   "target": "1/1073741824",

research/lean-contribution-archive/README.md

@@ -0,0 +1,31 @@
+# Contribution checkpoints
+
+The current delivery uses one cumulative `review.patch` from public base
+`db0e57bc7f36b5ac0fc844ad7ce1396165ee6647`, generated by
+[`../lean-external-review/export_review.py`](../lean-external-review/export_review.py).
+See the [review guide](../lean-external-review/README.md) for delivery,
+build instructions and the supported patch application order.
+
+Five superseded per-task patch copies were retired during the privacy/reference
+cleanup. Some embedded outdated commit citations; editing those copies would
+also change their historical manifest and receipt bindings. They are no longer
+part of the supported delivery. All corresponding Lean source directories,
+required dependencies, source snapshots, proof receipts, notices and reviews
+remain included.
+
+The neutral-author development checkpoints are:
+
+| Checkpoint | Commit |
+| --- | --- |
+| Obstruction and whole-residual hosting | `58d2b198f62d5b51d6b84ba511f2c630095e94b0` |
+| Source invocation diagnostic | `a7f9ceebc83cb1aed29ab07202ae82bdf39100a2` |
+| Task A: multiple-host framework | `13611a8958fc71046a83d8431d2bd6335e6a3e2f` |
+| Task B: concrete source invocation | `f7330c5f5b1c5e85f91a98c95e8efc0e27c03490` |
+
+These identify historical source snapshots. Current reproduction uses the
+complete review checkout and its own manifest. Earlier snapshots may retain
+outdated documentation references; this table does not assert that previously
+published Git objects have been removed by GitHub.
+
+Prepared with substantial OpenAI Codex assistance. Source-specific attribution
+and the bounded mathematical claims remain unchanged.

research/lean-external-review/BUILD.md

@@ -0,0 +1,77 @@
+# Lean 4.21 reproduction
+
+**Fresh full port validation passed.** These are the normal reproduction
+commands; recorded receipts and the conditional CI estimate are in [VALIDATION.md](VALIDATION.md).
+
+Start from a clean checkout of the port commit being reviewed. Record
+`git rev-parse HEAD`. Install Git, Python 3.13 and elan using upstream's normal
+setup. Each project selects its compiler through `lean-toolchain`; no external
+resource settings, special compiler flags or environment overrides are used.
+The verifier inherits the host's OS stack limits unchanged and records them
+before and after the run. An 8 MiB limit is not assumed: host defaults differ.
+The receipt cannot determine whether a caller changed limits before launch;
+the reproduction commands and workflow must use their ordinary environment.
+
+From the repository root:
+
+```sh
+python3 -m pip install -r research/lean-external-review/requirements.txt
+cd research/lean-multi-host-source
+lake exe cache get Mathlib.Data.Matrix.Mul \
+  Mathlib.Algebra.BigOperators.Fin Mathlib.Tactic.FieldSimp \
+  Mathlib.Tactic.Ring Mathlib.Tactic.NormNum
+cd ../..
+make formal-pr442-verify
+```
+
+The Make target defaults to `LAKE=lake`. A local installation can select its
+Lake executable with `make formal-pr442-verify LAKE=/path/to/lake`; this is
+executable selection only, not a compiler flag or environment override.
+
+These are the commands used by the added `pr442` entry in upstream's existing
+formal CI matrix. That job retains its 45-minute limit. The fresh CI-repair
+Make run took 16 minutes 58 seconds. Its conservative projection is 34 minutes
+9 seconds, qualifying under the revised 35-minute target with the explicit
+cache/setup assumptions in [VALIDATION.md](VALIDATION.md). This is a timing
+estimate, not an observed GitHub Actions run.
+
+The cache request selects the five imported Mathlib modules and their full
+dependency closure; it does not download unrelated Mathlib modules. These are
+cache selections, not compiler flags. The ordinary build remains `lake build`.
+The official Mathlib cache contains only pinned external dependency artifacts.
+It must not supply local contribution artifacts. If the cache is unavailable,
+ordinary Lake can compile the dependencies from source; the additional time
+must be reported separately and included in any cache-free CI projection.
+The current managed environment blocks the official cache endpoint, so local
+validation may reuse fingerprinted external dependencies built from source.
+That does not establish cold-cache CI runtime.
+
+For a complete local receipt set in a new directory outside the checkout:
+
+```sh
+python3 research/lean-external-review/reproduce.py \
+  --receipt-dir /tmp/pr442-review-receipts
+```
+
+This requires `research/lean-multi-host-source/.lake/build` to be absent or
+empty. Use a new clean checkout if local project artifacts already exist.
+Pinned external artifacts in `.lake/packages` may be reused and are
+fingerprinted. `--lake` optionally selects the Lake executable; it does not
+change compilation or resource settings. No resume mode is offered.
+
+The reproduction runs inventory validation, all literal source checks, the
+flat-data parser mutation checks, a fresh Lake build and the five separate
+axiom inventories. The Task B inventory has 931 declarations and Task A has
+21. The nine historical third-party source snapshots are excluded from
+compilation and axiom auditing, while their unchanged bytes remain hashed.
+The differential test is delegated separately and is not reported here.
+
+The canonical completed-build receipt is `validation/lean421-ci-fix-fresh.json`.
+The strict verifier requires its PASS and exact current source bindings. During preparation only,
+`verify_package.py --allow-pending-port` checks an unfinished inventory and
+reports `PENDING_PORT` when the fresh receipt is absent. With a matching fresh
+receipt it performs the normal PASS checks. A reviewer may validate a new local run
+using `verify_package.py --build-receipt /tmp/pr442-review-receipts/lean421-fresh.json`.
+
+Historical `replay.py` scripts and Lean 4.33 receipts explain earlier work;
+they are not the supported current reproduction route.

research/lean-external-review/DRAFT-PR.md

@@ -0,0 +1,85 @@
+Title: Check one literal PR442 invocation with multi-host Lean certificates
+
+[Plain-language explainer with diagrams](https://github.com/cheesegrader/integer-mult-bounds/blob/lean/pr442-explainer/research/lean-external-review/EXPLAINER.md).
+
+Upstream has incorporated #442 and the #509/#516 abstract stream-model
+results. This contribution checks concrete obligations for one literal PR442
+R747 invocation (stage 2, replica 0, pair 0 at
+`4e16d001d505d4f21dd2bcfc44591f9be4c279bd`).
+
+Task A generalizes the hosting contract to multiple hosts and recovers the
+single-host theorems. Task B connects its 19,002-instruction word to that
+contract, with Lean certificates for scalar endpoints, concrete ownership,
+coordinate identities and COPY/ERASE guards, for arbitrary dirty Boolean
+helpers and one explicitly clean, restored private temporary.
+
+Merged #516 already proves abstract realization for arbitrary global state
+under hypotheses. The contribution here is checking selected concrete
+invocation obligations in Lean; it is not the first arbitrary-state theorem.
+The [overlap review](https://github.com/cheesegrader/integer-mult-bounds/blob/lean/pr442-invocation-review/research/lean-external-review/MERGED-OVERLAP.md) covers
+incorporated #509/#516 and draft #528.
+
+Main declarations include `MultiHosting.multi_hosting`,
+`MultiHosting.SingleHost.whole_hosting_recovered`,
+`MultiHosting.SingleHost.physical_whole_hosting_recovered`,
+`SourceInvocation.actualContract`, `selected_call_completion`,
+`selected_native_completion`, `selected_native_realization`, and
+`selected_temporary_restoration` (the latter names are in `SourceInvocation`).
+
+Ported to Lean 4.21.0 and the project's exact Mathlib pin
+`308445d7985027f538e281e18df29ca16ede2ba3`. Fresh Task A and Task B replay
+passed in one clean Lake build: 153 local modules, no local artifact reuse,
+and all five axiom inventories. The complete normal Make target took
+16m58s here after the CI compatibility repair; the conservative four-core
+CI projection is 34m09s
+including a 1.5× compute slowdown, a three-minute setup/cache allowance and
+20% margin. Setup/cache preparation is an explicit estimate; see VALIDATION.md.
+
+Reproduce after the pinned dependency setup with:
+
+```sh
+make formal-pr442-verify
+```
+
+The ordinary Lake build uses no external resource overrides, extra compiler
+flags or environment settings. It records the inherited OS stack limits and
+checks that they stay unchanged, without assuming an 8 MiB host default.
+GitHub Actions preserves its own receipt as an artifact; the local timing
+projection does not establish a GitHub pass. The permanent audits retain 931 Task B
+declarations, including `SourceInvocation.actualContract`, and 21 Task A
+declarations. The port covers 66 original contribution files; nine unchanged
+archived third-party snapshots are excluded from this build and its audits.
+Certificate partitioning adds independent modules without changing theorem
+statements. The 34m09s projection qualifies under the revised
+35-minute target, conditional on the documented cache/setup assumptions.
+The differential test is delegated separately and is not a reported check here.
+
+The exact upstream base is `db0e57bc7f36b5ac0fc844ad7ce1396165ee6647`.
+
+Scope limits:
+
+- One complete invocation; cross-invocation disjointness is not exercised.
+- Pending ranges 15..21 and 1..28 are hand-supplied. Lean checks target-mask
+  containment; nothing binds them to the source schedule.
+- Explicit input embeddings, an invertible chart and `2 ≠ 0`; extraction is
+  externally checked Python. Original-bank outputs remain auxiliary state.
+- No full sweep, later scheduling, global-allocation equivalence, costs,
+  all-size compilation, analytic transfer or κ result. PR448's gain remains
+  unestablished. PR493 → PR472 → PR442 is provenance only.
+
+Original construction and predecessor credits remain in the source notices.
+Prepared with substantial OpenAI Codex assistance. The human participant
+initiated and coordinated the effort and does not claim independent derivation
+or personal checking of the mathematics. Agent reviews are not human audits.
+
+No attribution requested; please don't add this account to CONTRIBUTORS.
+
+Questions for maintainers:
+
+1. Do the literal source binding, slot isometries, native operations and private
+   initialization faithfully represent this invocation?
+2. Is retaining all host/data/exterior outputs with explicit auxiliary bank
+   outputs the right boundary for later scheduling proofs?
+3. Where should these concrete certificates integrate with #509/#516 and #528?
+4. Ported to 4.21 with the exact upstream Mathlib pin. Does the Lake package
+   and formal CI target fit the project layout?