feat: make KoalaBear Rabin irreducibility certificates re-checkable by kernel replay - #306
Conversation
🤖 PR SummaryThe PR introduces wrapper lemmas that accept an explicit field cardinality parameter Key Changes:
Objective: The change is purely about making the proof terms amenable to kernel replay for verification without requiring the kernel to compute Statistics
Lean Declarations ✏️ Added: 2 declaration(s)
📋 **Additional Analysis**Minor style violation detected; otherwise compliant with guidelines. 📄 **Per-File Summaries**
Last updated: 2026-08-17 01:09 UTC. |
…y kernel replay The KoalaBear degree-5 and degree-6 extension irreducibility proofs (`quinticPoly_irreducible`, `sexticPoly_irreducible`) type-check fine at compile time but are effectively unbounded to *re-check* from an empty environment (Lean's `Environment.replay`, as used by `lean4checker` and by external proof-auditing tools): the check grows past 58 GiB without finishing. Cause: the Rabin lemmas are stated in terms of `Fintype.card F`, and the callers bridge the concrete field size in with `rw [hcard]`. On a cold re-check the kernel is forced to reduce `Fintype.card (ZMod p)` -- an enumeration of ~p (~2.1e9 for KoalaBear) elements -- to reconcile it with the numeral. Compilation avoids this because the elaborator handles the equation propositionally; replay re-faces the raw defeq. (The huge `X^(card^k)` power is *not* the cause -- it stays syntactically matched and is never reduced; the `X^4-C` degree-4 extension, which has no such enumeration, re-checks fine at the same closure size.) Fix: add explicit-cardinality wrappers `irreducible_of_rabin_prime_degree_of_card` and `irreducible_of_rabin_degree_six_of_card` that take the field size as a numeral `q` with `Fintype.card F = q`, proved by `subst hq` from the existing lemmas -- so they are definitionally the same statement, no axiom, nothing weakened. The two callers pass `q := fieldSize` and drop the `rw [hcard]` casts, so the certificates are stated with `q` concrete and the kernel never enumerates `Fintype.card`. Measured on the degree-6 case: re-checking the full 19,908-constant closure goes from unbounded (>58 GiB, killed) to ~9 s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
5e84edb to
1d0ce31
Compare
|
Thanks! |
…307) The `_of_card` wrappers added in #306 are correct, but their docstrings justified the numeral form by claiming the `Fintype.card F` form makes a from-empty kernel replay reduce `Fintype.card F` (for a `ZMod p` field, an enumeration of ~`p` elements). It does not: `rw [hcard]` elaborates to `Eq.mpr (id (congrArg motive hcard)) cert`, whose kernel check only beta-reduces the motive, so `Fintype.card F` never reaches whnf position. Measured kernel type-checking of both proofs is single-digit milliseconds either way, with run-to-run variance exceeding the difference between the forms; and since Lean kernel-checks each theorem at `addDecl` during an ordinary build, a from-empty replay runs that same check. Replace the rationale with the one that does hold, and that `irreducible_X_pow_four_sub_C_of_card` already documents on the binomial side: the generated certificates are already stated in terms of `fieldSize`, so each Rabin condition applies directly instead of needing a `rw [hcard]` cast. Also drop the claim that the two forms are "definitionally equal" — the plain form is the `q := Fintype.card F` instance of the numeral one. Make `q` implicit and rename `hq` to `hcard`, matching the binomial `_of_card` form: `q` is uniquely determined by `hcard`, which precedes `h_trace`/`h_cop`, so inference never needs higher-order matching. Update `docs/wiki/field-extensions.md`, whose "Adding a new non-binomial extension" recipe still routed new extensions to the non-`_of_card` wrappers that the two canonical callers had moved away from, per the maintenance contract in `docs/wiki/README.md`. Pin the round trip in `CompPolyTests.RabinCertificate`: instantiating each `_of_card` form at `q := Fintype.card F` with `rfl` must recover the plain statement verbatim, so "nothing is weakened" is checked rather than asserted. The opposite direction is the wrapper's own proof body. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add explicit-cardinality Rabin wrappers so
quinticPoly_irreducible/sexticPoly_irreduciblestate their certificates with the field size as a numeral, letting a from-empty kernel replay avoid reducingFintype.card (ZMod p)(~p elements); definitionally equal, nothing weakened.