From dea94c56662a82f4f97648e56652b8c5931b5f0f Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Mon, 1 Jun 2026 13:22:57 +0100 Subject: [PATCH 01/16] Felt review: fix stale Lake manifest (H4) + add assurance-gap review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - lake-manifest.json: re-resolved (lake update) to the lakefile pin project-llzk/veir @ 09d5f00f0. The committed manifest had pointed at a stale personal-fork rev (alexanderlhicks/veir @ bf086362), 3 commits behind and predating the FeltConstAttr parser fix — so a plain `lake build` built the wrong proof basis. - docs/REVIEW.md: independent review of the llzk-lean bridge (Strategy A/E): the three-joint assurance-gap analysis with #print axioms evidence, the C/H/M/L findings catalog, the salvage verdict, and the structural-close result (2 of 15 Felt patterns now verified sorry-free + axiom-clean upstream in veir). Co-Authored-By: Claude Opus 4.8 --- docs/REVIEW.md | 210 +++++++++++++++++++++++++++++++++++++++++++++ lake-manifest.json | 30 +++---- 2 files changed, 225 insertions(+), 15 deletions(-) create mode 100644 docs/REVIEW.md diff --git a/docs/REVIEW.md b/docs/REVIEW.md new file mode 100644 index 0000000..2f744c1 --- /dev/null +++ b/docs/REVIEW.md @@ -0,0 +1,210 @@ +# llzk-lean — Independent Review: Status & Findings + +> **Status:** in progress. Last updated 2026-06-01. +> **Reviewer note:** This is an independent, adversarial review conducted at +> the maintainer's request, aimed at making the work's guarantees, tradeoffs, +> and caveats legible — especially to readers who are *not* Lean experts. +> It is deliberately critical. It does **not** conclude the work is bad; it +> concludes the work is an honest prototype whose framing currently +> outruns what is mechanically proven, and it pins down exactly where. + +--- + +## 1. Scope & method + +Reviewed: the `llzk-lean` bridge in full (cert layer, emitter, C++ checker, +differential harness, CI, strategy/future docs), plus the VEIR-side Felt +*proof core* it depends on, plus LLZK's C++ Felt dialect for the +faithfulness comparison. + +Method — grounded in reproduced fact, not reading alone: +- Full from-scratch `lake build` of `llzk-lean` (1244 jobs; Mathlib via + `lake exe cache get`). +- `#print axioms` / `lean_verify` axiom audits. +- C++ checker built (`cmake` + `g++`, no MLIR) and `ctest` run. +- A structural-proof spike using the `lean-lsp` MCP server. + +**Not yet reviewed** (tracked separately): the VEIR Felt-dialect *port itself* +— parser/printer, type system, op coverage, pass wiring, tests, differential +normalizer. See §8. + +--- + +## 2. Phase 0 baseline (reproduced facts) + +| Item | Finding | How confirmed | +|---|---|---| +| Build | `llzk-lean` builds clean (1244 jobs) under Lean v4.30.0 | full `lake build` | +| Toolchain split | `veir` pins `v4.30.0-rc2`, `llzk-lean` pins `v4.30.0`; did **not** break this build | observed | +| **Stale manifest (H4)** | `lake-manifest.json` pinned `alexanderlhicks/veir @ bf086362` (personal fork, **3 commits old, predates the parser fix `ab77c1c57`**) while `lakefile.toml` pins `project-llzk/veir @ 09d5f00f0`. A plain local `lake build` builds the wrong/older proof basis. | git ancestry; **remediated** by `lake update` (uncommitted) | +| 15 theorems | axiom-clean: `[propext, Quot.sound]` only — no `sorryAx` | axiom audit | +| 15 patterns + the `Combine` pass | carry `sorryAx`: `[propext, sorryAx, Classical.choice, Quot.sound]` | axiom audit | +| `Combine.lean` admissions | **140 `sorry` tokens** across the 15 patterns (`set_option warn.sorry false`) | count | +| Interpreter link | absent — `Veir.Data.Felt` is imported only by `Proofs.lean` + its own `Basic.lean` | grep | +| Catalog | 2 of 15 patterns; `#assertCatalogCoverage` lists the 13 uncovered | build output | +| C++ matcher | fail-closed stub ("MLIR not found"); the "26 tests" are internal `EXPECT`s across 2 ctest exes driven by a **mock** matcher — no real-IR matching is built or tested | cmake log + ctest | +| Strategy A | one positive corpus file, parse-print only (no canonicalization) | inspection | + +--- + +## 3. Central finding — the assurance chain has three unproven joints + +The headline is "15 verified Felt rewrites." What is actually established, +mechanically: + +``` +Veir.Data.Felt. (all 15) → [propext, Quot.sound] ← AXIOM-CLEAN +Veir.FeltPass. (all 15) → [propext, sorryAx, Classical.choice, Quot.sound] +Veir.FeltPass.Combine (the pass)→ [propext, sorryAx, Classical.choice, Quot.sound] ← carries sorryAx +``` + +The detached algebraic lemmas are fully proven; the **executable rewriter +that `veir-opt -p felt-combine` actually runs — and that the certificates +point at — transitively depends on `sorryAx`.** What is verified and what +runs are different objects. The three joints between "a true lemma" and "LLZK +does the right thing" are: + +1. **Theorem ↔ pattern**: by naming convention only. `CertValidate.lean` + checks the theorem *name resolves*; it does **not** check the theorem says + anything about what the pattern does. (`#certThmExists "X"` would pass for + `theorem X : True`.) +2. **Pattern preconditions**: every rewriter well-formedness obligation is + `sorry`'d (140 of them). +3. **Algebra ↔ IR semantics**: the abstract `Veir.Data.Felt.add` (a thin + `ZMod p` wrapper) is never connected to the IR op `OpCode.felt Felt.add`'s + interpreter meaning. No such bridge exists anywhere in VEIR. + +Two framing caveats worth stating to non-Lean readers: +- **The verified subset is the *easy* subset.** All 15 are commutative-ring + identities holding for *any* `ZMod p` (incl. `p = 0, 1` — so "field" is a + misnomer; primality is unused). The operations where field/prime semantics + are load-bearing — `div`, `inv`, `pow`, the bit ops, int-div/mod — have + **no pattern and no proof**. +- **Implementation folds over unbounded `Int`; proofs are over `ZMod p`.** The + reconciliation ("unreduced `Int` coerced into `ZMod p` equals the reduced + value") is true but asserted in prose, not proved. + +--- + +## 4. Findings catalog + +**Critical** (assurance-defining; must be made explicit, not necessarily "fixed"): +- **C1** The three unproven joints (§3). "Verified" overclaims relative to the + `sorry`'d preconditions and the missing interpreter link. +- **C2** Cert structural fields (`lhs`/`rhs`/`conditions`/`parity`/`scope`) are + hand-authored and unvalidated against either VEIR or LLZK — yet Strategy E's + entire value rests on their accuracy. +- **C3** The C++ checker (the designated trusted base) has no working matcher + and is untested against any real IR. + +**High:** +- **H1** Live cert↔pattern drift: `right_identity_zero_add`'s cert sets + `commutative: true`, but the VEIR pattern matches only `add x (const 0)` + (one-sided). Harmless today (it's `veir-only`) but a real instance of the + C2 risk that nothing catches. +- **H2** `#certThmExists` is a weak invariant (name-resolution only). +- **H3** Strategy A demonstrates little yet: 1 file, parse-print only; LLZK has + zero Felt canonicalizers and its folds no-op on unnamed fields, so + fold-agreement is currently unreachable (named-field path parser-blocked). +- **H4** Stale `lake-manifest.json` (see §2) — **remediated** (uncommitted). + +**Medium:** M1 no CI axiom-gate / `warn.sorry false` hides admits; M2 +`#assertCatalogCoverage` uses fragile base-name heuristics; M3 three namespaces +for one unit (`Veir.FeltPass` / `Veir.Data.Felt` / path `Passes/Felt`); M4 +`constant_fold_add` "aligned-with-caveats" understates that VEIR folds +unconditionally while LLZK requires a registered field name. + +**Low:** L1 `JsonParser` `LLONG_MAX_REL_LIMIT` misnamed + most-negative-int64 +edge; L2 README "26 tests / 15 verified" reads as more coverage than the stubs +deliver; L3 VEIR README still references the dropped `llzkfelt_test1` branch. + +--- + +## 5. Verdict — salvage and re-sequence, do not restart + +Nothing found is *incorrect*. The proven core is real and axiom-clean; the +VEIR substrate already ships a sorry-free `WfRewriter` layer that +`PatternRewriter` wraps (its `replaceValue`/`eraseOp`/… take `:= by grind` +default-arg preconditions — the Felt patterns simply passed `sorry` instead of +discharging them). So: + +- **Keep:** the 15 theorems, the VEIR Felt IR, the cert schema + versioning + discipline, the JSON parser/loader, the polarity orchestrator, the + differential harness, the docs. +- **Add (incremental):** discharge the preconditions via `WfRewriter`; derive + cert structural fields from the patterns (kills C2/H1/H2 by construction); + a working C++ matcher; reframed claims. +- **Add (research):** the one load-bearing bridge — `eval(IR op) = + Veir.Data.Felt.op` — which is net-new under *any* plan. + +The legitimate worry is **sequencing**, not quality: the project built +horizontal scaffolding around a vertical hole (no single rewrite has a closed +IR→semantics→algebra chain). Fix by going **depth-first**: close one rewrite +end-to-end, then widen. + +**Strategic caveat (not about this repo):** the ceiling on "fully verified +rewrites" is set by VEIR. Its README marks the peephole rewriter "Complete" +but *not* "Verified"; no VEIR pass has a closed rewrite→interpreter theorem; +felt isn't in the interpreter; the interpreter's value domain is fixed-width +`LLVM.Int`/`BitVec`, not `ZMod p`; and `!felt.type` pins no prime, so there is +no canonical runtime meaning to bridge to. How deep a guarantee is reachable +is a VEIR-maturity question, identical whether this code is kept or rewritten. + +--- + +## 6. Spike — structural close: DONE (both shapes, landed in veir) + +The salvage thesis was tested, not asserted, and the result is now landed in +the veir repo: **2 of 15 Felt patterns are fully sorry-free and axiom-clean** +(`[propext, Classical.choice, Quot.sound]` — no `sorryAx`, no `WfIRContext.Dom` +axiom), one per structural shape: +- `right_identity_zero_add` — projection shape (`replaceValue` + `eraseOp`). +- `constant_fold_add` — synthesis shape (`createOp` + `replaceOp`). + +Both live in `veir/Veir/Passes/Felt/RewriteLemmas.lean` with a reusable lemma +library (matchOp specs; `replaceValue`/`createOp` postcondition wrappers); +`Combine.lean` imports them. Verified by a full `lake build` under veir's +`v4.30.0-rc2` toolchain + `#print axioms`. + +**Refined finding (corrects the earlier "just assembly" framing).** Discharging +the IR-mutation preconditions needs three facts `WfIRContext` does **not** carry: +the matched op's region count, SSA acyclicity (result ≠ operand), and the op +having a parent block. VEIR supplies SSA acyclicity only via the +**`axiom WfIRContext.Dom`**. We avoid that axiom with sound **defensive runtime +guards** (each only skips the rewrite in states impossible in well-formed IR). +So the structural close is achievable and axiom-clean — but it is *not* free +assembly; it surfaces that VEIR's well-formedness model omits per-opcode shape +constraints and SSA dominance (a substrate limitation, not a Felt defect — it's +why every VEIR pass `sorry`s these). The remaining 13 patterns are mechanical +follow-up on the same library + recipe. See `veir/REVIEW.md` §0 and +`veir/FOLLOWUP.md`. + +--- + +## 7. Working-tree state / housekeeping + +- `lake-manifest.json` — **modified** (the H4 fix; `lake update` repointed it + to `project-llzk/veir @ 09d5f00f0`). +- The structural-close lemmas + the 2 verified patterns now live in the veir + repo (`Veir/Passes/Felt/RewriteLemmas.lean`); the `Spike*.lean` scratch files + used to develop them have been removed. +- `.mcp.json` (at the `/home/alh/LLZK` session root, not in this repo) — adds + the `lean-lsp` MCP server pinned to this project. + +### veir repo changes (companion) +- `Veir/Passes/Felt/RewriteLemmas.lean` — **new**; verified patterns + lemma library. +- `Veir/Passes/Felt/Combine.lean` — VC1 docstring, VC3 guards, imports + uses the + verified patterns (old sorry-laden defs removed). +- `Veir/Passes/Felt/Proofs.lean` — VM1 citation fix. +- `REVIEW.md`, `FOLLOWUP.md` — **new** (veir findings + backlog). + +--- + +## 8. Not yet covered — the VEIR Felt-dialect port + +The *proof core* of the VEIR port is well-understood and validated above. The +*dialect plumbing* is essentially un-reviewed: the FeltConstAttr / FeltType +parser & printer, op coverage (18 opcodes declared vs. ~5 wired through), +pass registration, the FileCheck tests, and the differential normalizer. A +dedicated, adversarial review of the VEIR Felt port is the next workstream +(see the accompanying veir review plan). diff --git a/lake-manifest.json b/lake-manifest.json index 4108582..c2390f9 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -1,21 +1,21 @@ {"version": "1.2.0", "packagesDir": ".lake/packages", "packages": - [{"url": "https://github.com/alexanderlhicks/veir.git", + [{"url": "https://github.com/project-llzk/veir.git", "type": "git", "subDir": null, "scope": "", - "rev": "bf086362552510e077ba2fa9af00093e6abbf266", + "rev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "bf086362552510e077ba2fa9af00093e6abbf266", + "inputRev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "41bee78e2cb1daff530b6838ca8c8f64a6dd898a", + "rev": "1fb6b28816d41e7b81bc0109124888c77ece34f9", "name": "mathlib", "manifestFile": "lake-manifest.json", "inputRev": "master", @@ -25,7 +25,7 @@ "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "a456461b368b71d2accd95234832cd9c174b5437", + "rev": "293af9b2a383eed4d04d66b898d608d0a44b750f", "name": "plausible", "manifestFile": "lake-manifest.json", "inputRev": "main", @@ -45,7 +45,7 @@ "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "515cf9d0c00ece5e661f6de4326a53dedc1e8ea1", + "rev": "fd70b40073aeca8fa60fe0fb492f189d3b12c0ef", "name": "importGraph", "manifestFile": "lake-manifest.json", "inputRev": "main", @@ -55,37 +55,37 @@ "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "a84b3e2475d5c5ab979567b1ad8aea21b764bcf8", + "rev": "2db6054a44326f8c0230ee0570e2ddb894816511", "name": "proofwidgets", "manifestFile": "lake-manifest.json", - "inputRev": "v0.0.99", + "inputRev": "v0.0.98", "inherited": true, "configFile": "lakefile.lean"}, {"url": "https://github.com/leanprover-community/aesop", "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "558915ae105bfd8074e22d597613d1961822adc2", + "rev": "f0c6e183ea26531e82773feb4b73ab6595ca17a5", "name": "aesop", "manifestFile": "lake-manifest.json", - "inputRev": "v4.30.0", + "inputRev": "v4.30.0-rc2", "inherited": true, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/quote4", "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "a6e6c34c4ef182f83b219a3a5a385f51f44bdc4c", + "rev": "1cc7e819b9b9bc1e87c9edcccb62e0269e00a809", "name": "Qq", "manifestFile": "lake-manifest.json", - "inputRev": "v4.30.0", + "inputRev": "v4.30.0-rc2", "inherited": true, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/batteries", "type": "git", "subDir": null, "scope": "leanprover-community", - "rev": "32dc18cde3684679f3c003de608743b57498c56f", + "rev": "4ee56e687ce2b9b51b097bfa65947a499da0c453", "name": "batteries", "manifestFile": "lake-manifest.json", "inputRev": "main", @@ -95,10 +95,10 @@ "type": "git", "subDir": null, "scope": "leanprover", - "rev": "6b907cf12b2e445ccb7c24bc208ef04a1f39e84c", + "rev": "13567aed1ac4f12aea9484178e07e51f8c9f7658", "name": "Cli", "manifestFile": "lake-manifest.json", - "inputRev": "v4.30.0", + "inputRev": "v4.30.0-rc2", "inherited": true, "configFile": "lakefile.toml"}], "name": "LlzkLean", From ea2363f87bccf7a8cca590ef54bfa2365b4bcc57 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Tue, 2 Jun 2026 01:17:13 +0100 Subject: [PATCH 02/16] =?UTF-8?q?docs/REVIEW.md:=20joint=202=20closed=20(F?= =?UTF-8?q?1)=20=E2=80=94=20patterns=20now=20axiom-clean?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 15 Felt rewrite patterns + the felt-combine pass no longer carry sorryAx: all rewriter preconditions discharged in veir's RewriteLemmas.lean (F1, commit 3fb22d4fc / 410ceae7c). Updated the §2 baseline table, the §3 central-finding axiom diagram + joint 2, C1, and M1. Joints 1 (theorem↔pattern by naming) and 3 (no algebra↔interpreter bridge) remain open: "verified" now means arithmetic identity + IR well-formedness, still not semantic preservation. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/REVIEW.md | 45 +++++++++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 16 deletions(-) diff --git a/docs/REVIEW.md b/docs/REVIEW.md index 2f744c1..522ac26 100644 --- a/docs/REVIEW.md +++ b/docs/REVIEW.md @@ -1,6 +1,6 @@ # llzk-lean — Independent Review: Status & Findings -> **Status:** in progress. Last updated 2026-06-01. +> **Status:** in progress. Last updated 2026-06-02 (F1: joint 2 closed — see §3). > **Reviewer note:** This is an independent, adversarial review conducted at > the maintainer's request, aimed at making the work's guarantees, tradeoffs, > and caveats legible — especially to readers who are *not* Lean experts. @@ -38,8 +38,8 @@ normalizer. See §8. | Toolchain split | `veir` pins `v4.30.0-rc2`, `llzk-lean` pins `v4.30.0`; did **not** break this build | observed | | **Stale manifest (H4)** | `lake-manifest.json` pinned `alexanderlhicks/veir @ bf086362` (personal fork, **3 commits old, predates the parser fix `ab77c1c57`**) while `lakefile.toml` pins `project-llzk/veir @ 09d5f00f0`. A plain local `lake build` builds the wrong/older proof basis. | git ancestry; **remediated** by `lake update` (uncommitted) | | 15 theorems | axiom-clean: `[propext, Quot.sound]` only — no `sorryAx` | axiom audit | -| 15 patterns + the `Combine` pass | carry `sorryAx`: `[propext, sorryAx, Classical.choice, Quot.sound]` | axiom audit | -| `Combine.lean` admissions | **140 `sorry` tokens** across the 15 patterns (`set_option warn.sorry false`) | count | +| 15 patterns + the `Combine` pass | ~~carry `sorryAx`~~ **RESOLVED (F1, 2026-06-02):** all 15 patterns now axiom-clean `[propext, Classical.choice, Quot.sound]` — no `sorryAx`, no `WfIRContext.Dom`. See §3 joint 2. | axiom audit (veir `lake build` + `#print axioms`) | +| `Combine.lean` admissions | ~~140 `sorry` tokens~~ **0 (F1):** every rewriter precondition discharged in `RewriteLemmas.lean` (no `set_option warn.sorry false`) | count | | Interpreter link | absent — `Veir.Data.Felt` is imported only by `Proofs.lean` + its own `Basic.lean` | grep | | Catalog | 2 of 15 patterns; `#assertCatalogCoverage` lists the 13 uncovered | build output | | C++ matcher | fail-closed stub ("MLIR not found"); the "26 tests" are internal `EXPECT`s across 2 ctest exes driven by a **mock** matcher — no real-IR matching is built or tested | cmake log + ctest | @@ -53,23 +53,33 @@ The headline is "15 verified Felt rewrites." What is actually established, mechanically: ``` -Veir.Data.Felt. (all 15) → [propext, Quot.sound] ← AXIOM-CLEAN -Veir.FeltPass. (all 15) → [propext, sorryAx, Classical.choice, Quot.sound] -Veir.FeltPass.Combine (the pass)→ [propext, sorryAx, Classical.choice, Quot.sound] ← carries sorryAx +Veir.Data.Felt. (all 15) → [propext, Quot.sound] ← AXIOM-CLEAN +Veir.FeltPass. (all 15) → [propext, Classical.choice, Quot.sound] ← AXIOM-CLEAN (F1, 2026-06-02) +Veir.FeltPass.Combine (the pass)→ [propext, Classical.choice, Quot.sound] ← AXIOM-CLEAN (F1) ``` -The detached algebraic lemmas are fully proven; the **executable rewriter -that `veir-opt -p felt-combine` actually runs — and that the certificates -point at — transitively depends on `sorryAx`.** What is verified and what -runs are different objects. The three joints between "a true lemma" and "LLZK -does the right thing" are: +**Update (F1, 2026-06-02):** joint 2 below is now CLOSED. The executable +rewriter that `veir-opt -p felt-combine` actually runs no longer depends on +`sorryAx` — all 15 patterns and the pass are axiom-clean (no `sorryAx`, no +`WfIRContext.Dom`), verified by a full `lake build` of the veir source + +`#print axioms` on each. Joints **1 and 3 remain open** (the theorem↔pattern +link is still by naming convention, and there is still no algebra↔interpreter +bridge). So "verified" now means *arithmetic identity + IR well-formedness +preservation* — still **not** semantic preservation. The three joints between +"a true lemma" and "LLZK does the right thing" are: 1. **Theorem ↔ pattern**: by naming convention only. `CertValidate.lean` checks the theorem *name resolves*; it does **not** check the theorem says anything about what the pattern does. (`#certThmExists "X"` would pass for `theorem X : True`.) -2. **Pattern preconditions**: every rewriter well-formedness obligation is - `sorry`'d (140 of them). +2. **Pattern preconditions**: ~~every rewriter well-formedness obligation is + `sorry`'d (140 of them).~~ **CLOSED (F1, 2026-06-02):** all 140 discharged + in `RewriteLemmas.lean` via three reusable precondition-discharging tails + (`projectToOperand`, `replaceWithNewOp`, `replaceWithBinOpOfConst`) + a + per-matcher in-bounds lemma library; the three facts `WfIRContext` does not + carry (region count, result≠operand, op-has-parent) are supplied by sound + defensive runtime guards (no `WfIRContext.Dom`). This establishes IR + *well-formedness* preservation, not semantic preservation (joint 3). 3. **Algebra ↔ IR semantics**: the abstract `Veir.Data.Felt.add` (a thin `ZMod p` wrapper) is never connected to the IR op `OpCode.felt Felt.add`'s interpreter meaning. No such bridge exists anywhere in VEIR. @@ -89,8 +99,10 @@ Two framing caveats worth stating to non-Lean readers: ## 4. Findings catalog **Critical** (assurance-defining; must be made explicit, not necessarily "fixed"): -- **C1** The three unproven joints (§3). "Verified" overclaims relative to the - `sorry`'d preconditions and the missing interpreter link. +- **C1** The unproven joints (§3). **Joint 2 (sorry'd preconditions) is now + CLOSED (F1, 2026-06-02).** Joints 1 (theorem↔pattern by naming) and 3 + (missing interpreter link) remain — "verified" still means arithmetic + identity + IR well-formedness, not semantic preservation. - **C2** Cert structural fields (`lhs`/`rhs`/`conditions`/`parity`/`scope`) are hand-authored and unvalidated against either VEIR or LLZK — yet Strategy E's entire value rests on their accuracy. @@ -108,7 +120,8 @@ Two framing caveats worth stating to non-Lean readers: fold-agreement is currently unreachable (named-field path parser-blocked). - **H4** Stale `lake-manifest.json` (see §2) — **remediated** (uncommitted). -**Medium:** M1 no CI axiom-gate / `warn.sorry false` hides admits; M2 +**Medium:** M1 no CI axiom-gate (the `warn.sorry false` admits are gone as of +F1, but a CI `#print axioms` gate to *prevent regressions* is still absent); M2 `#assertCatalogCoverage` uses fragile base-name heuristics; M3 three namespaces for one unit (`Veir.FeltPass` / `Veir.Data.Felt` / path `Passes/Felt`); M4 `constant_fold_add` "aligned-with-caveats" understates that VEIR folds From 34cbe65907bf54b52e8bd5984d2f2409cfc7566e Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Fri, 5 Jun 2026 20:44:24 +0100 Subject: [PATCH 03/16] Add Phase 0 harness reset --- AGENTS.md | 20 ++ differential/run-differential.sh | 4 +- docs/harness/CURRENT.md | 60 ++++++ docs/harness/GATES.md | 26 +++ docs/harness/REVIEWS.md | 36 ++++ docs/harness/SOURCES.md | 47 +++++ docs/phases/PHASE-00-harness-reset.md | 109 ++++++++++ docs/phases/PHASE_TEMPLATE.md | 36 ++++ reviews/PHASE-00/adversarial-review.md | 42 ++++ reviews/PHASE-00/disposition.md | 18 ++ .../PHASE-00/evidence/adversarial-review.txt | 71 +++++++ reviews/PHASE-00/evidence/cert-smoke.txt | 9 + .../PHASE-00/evidence/check-doc-freshness.txt | 30 +++ reviews/PHASE-00/evidence/dependency-ref.txt | 4 + .../PHASE-00/evidence/dependency-status.txt | 6 + reviews/PHASE-00/evidence/diff-smoke.txt | 4 + .../PHASE-00/evidence/doctor-exploratory.txt | 34 +++ reviews/PHASE-00/evidence/doctor-strict.txt | 34 +++ reviews/PHASE-00/evidence/local-ref.txt | 4 + .../PHASE-00/evidence/stale-references.txt | 60 ++++++ reviews/PHASE-00/evidence/validate-skills.txt | 25 +++ reviews/PHASE-00/findings.md | 54 +++++ reviews/PHASE-00/request.md | 17 ++ scripts/harness/cert-smoke.sh | 121 +++++++++++ scripts/harness/check-doc-freshness.sh | 91 ++++++++ scripts/harness/diff-smoke.sh | 74 +++++++ scripts/harness/doctor.sh | 199 ++++++++++++++++++ scripts/harness/validate-skills.sh | 56 +++++ skills/cert-checker-review/SKILL.md | 17 ++ skills/lean-axiom-audit/SKILL.md | 18 ++ skills/llzk-lean-dependency-audit/SKILL.md | 19 ++ skills/mlir-differential/SKILL.md | 16 ++ skills/phase-bootstrap/SKILL.md | 19 ++ 33 files changed, 1378 insertions(+), 2 deletions(-) create mode 100644 AGENTS.md create mode 100644 docs/harness/CURRENT.md create mode 100644 docs/harness/GATES.md create mode 100644 docs/harness/REVIEWS.md create mode 100644 docs/harness/SOURCES.md create mode 100644 docs/phases/PHASE-00-harness-reset.md create mode 100644 docs/phases/PHASE_TEMPLATE.md create mode 100644 reviews/PHASE-00/adversarial-review.md create mode 100644 reviews/PHASE-00/disposition.md create mode 100644 reviews/PHASE-00/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-00/evidence/cert-smoke.txt create mode 100644 reviews/PHASE-00/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-00/evidence/dependency-ref.txt create mode 100644 reviews/PHASE-00/evidence/dependency-status.txt create mode 100644 reviews/PHASE-00/evidence/diff-smoke.txt create mode 100644 reviews/PHASE-00/evidence/doctor-exploratory.txt create mode 100644 reviews/PHASE-00/evidence/doctor-strict.txt create mode 100644 reviews/PHASE-00/evidence/local-ref.txt create mode 100644 reviews/PHASE-00/evidence/stale-references.txt create mode 100644 reviews/PHASE-00/evidence/validate-skills.txt create mode 100644 reviews/PHASE-00/findings.md create mode 100644 reviews/PHASE-00/request.md create mode 100755 scripts/harness/cert-smoke.sh create mode 100755 scripts/harness/check-doc-freshness.sh create mode 100755 scripts/harness/diff-smoke.sh create mode 100755 scripts/harness/doctor.sh create mode 100755 scripts/harness/validate-skills.sh create mode 100644 skills/cert-checker-review/SKILL.md create mode 100644 skills/lean-axiom-audit/SKILL.md create mode 100644 skills/llzk-lean-dependency-audit/SKILL.md create mode 100644 skills/mlir-differential/SKILL.md create mode 100644 skills/phase-bootstrap/SKILL.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..c7ef77e --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,20 @@ +# llzk-lean Agent Entry + +Treat `docs/harness/CURRENT.md` as the active source of truth before doing +dependency, differential, or certificate work in this repository. + +Required first checks: + +- Read `docs/harness/CURRENT.md`, `docs/harness/GATES.md`, and + `docs/harness/SOURCES.md`. +- Run `scripts/harness/doctor.sh` from the repository root. +- If the known dirty `.lake/packages/VeIR` checkout is being used for local + investigation, rerun with `--mode exploratory` and report that mode. + +Policy: + +- Do not rely on `.lake/packages/VeIR` as hidden proof state. +- Do not treat a missing `llzk-opt`, missing MLIR headers, or CI skip as + Strategy A or Strategy E coverage. +- Keep phase evidence under `reviews/PHASE-00/evidence/` when changing + canonical harness docs or gates. diff --git a/differential/run-differential.sh b/differential/run-differential.sh index bbeb7d7..a8d6f9d 100755 --- a/differential/run-differential.sh +++ b/differential/run-differential.sh @@ -21,8 +21,8 @@ # inputs are normalized to generic-MLIR before comparison. # Required for any input in LLZK's native textual form. # -# See differential/README.md for the protocol and harness/differential.md -# in VEIR for the diff script's normalization rules. +# See differential/README.md for the protocol and docs/harness/GATES.md for the +# current Phase 0 smoke boundary. set -uo pipefail diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md new file mode 100644 index 0000000..e7ceb5e --- /dev/null +++ b/docs/harness/CURRENT.md @@ -0,0 +1,60 @@ +# Current Harness State + +Last reviewed: 2026-06-05 + +## Active Phase + +- Active phase: Phase 0, harness reset. +- Phase bootstrap file: `docs/phases/PHASE-00-harness-reset.md`. +- Companion repository: `../veir`. +- Companion phase file: `../veir/docs/phases/PHASE-00-harness-reset.md`. + +## Refs + +- llzk-lean bootstrap HEAD: `ea2363f87bcc`. +- Workspace VeIR bootstrap HEAD: `4b0978bddec0`. +- Lake `VeIR` dependency pin: `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. +- Lake `VeIR` dependency checkout observed at: `09d5f00f0d2b`. + +These refs are Phase 0 acceptance inputs. If any ref changes, update this file, +`docs/harness/SOURCES.md`, and review evidence before treating the harness as +current. + +## Dependency Mode + +The Lake dependency checkout `.lake/packages/VeIR` is dirty at bootstrap: + +- `Veir/Passes/Felt/Combine.lean` +- `Veir/Passes/Felt/Proofs.lean` +- `Veir/Passes/Felt/RewriteLemmas.lean` + +Strict harness runs fail on this state. Exploratory runs may continue with +`--mode exploratory`, but exploratory output is not release or acceptance +evidence. + +## Known Hazards + +- `differential/run-differential.sh` depends on `.lake/packages/VeIR` and + `llzk-opt`. Missing `llzk-opt` is a tool skip, not a differential pass. +- The certificate checker smoke gate validates schema, theorem metadata, + loader behavior, and dispatch tests from source when CMake/CTest or `g++` is + available. Existing `checker/build` binaries are not used unless + `CERT_SMOKE_ALLOW_PREBUILT=1` is set. Real MLIR-backed matching remains + absent while `DefaultMatcher` is TODO/fail-closed. +- Strategy docs under `docs/` predate Phase 0. They are design context, not + acceptance evidence unless `docs/harness/SOURCES.md` revalidates a claim. +- CI warnings about skipped external tooling do not count as Strategy A or + Strategy E coverage. + +## Acceptance Rule + +Phase 0 is current only when: + +- `scripts/harness/doctor.sh` fails in strict mode on the known dirty + dependency and prints exact files. +- `scripts/harness/doctor.sh --mode exploratory` passes while reporting the + same dirty dependency. +- `scripts/harness/check-doc-freshness.sh` passes. +- `scripts/harness/validate-skills.sh` passes. +- `scripts/harness/diff-smoke.sh` and `scripts/harness/cert-smoke.sh` report + precise status without claiming skipped or absent tooling as coverage. diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md new file mode 100644 index 0000000..bb18102 --- /dev/null +++ b/docs/harness/GATES.md @@ -0,0 +1,26 @@ +# Harness Gates + +Last reviewed: 2026-06-05 + +## Gate Inventory + +| Gate | Command | Expected Phase 0 behavior | What it proves | +|---|---|---|---| +| Strict doctor | `scripts/harness/doctor.sh` | Fails while `.lake/packages/VeIR` is dirty | Dirty dependency state is not hidden | +| Exploratory doctor | `scripts/harness/doctor.sh --mode exploratory` | Passes with dirty-file warnings | Local investigation can continue with explicit dependency state | +| Workspace doctor | `scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir` | Passes if workspace VeIR is at the bootstrap ref | Companion repo state is explicit | +| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when canonical docs and review disposition exist | Phase metadata and review state are present | +| Differential smoke | `scripts/harness/diff-smoke.sh` | Exits 0 on real pass, 77 on missing `llzk-opt`, 1 on divergence, 2 on tool/parse/pass failure | Strategy A smoke status is classified | +| Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds checker smoke binaries from source via CMake/CTest or direct `g++`, passes loader/schema smoke, and reports MLIR matcher active or absent | Strategy E smoke status is classified without pretending MLIR matching exists | +| Prebuilt certificate smoke | `CERT_SMOKE_ALLOW_PREBUILT=1 scripts/harness/cert-smoke.sh` | Uses existing `checker/build` binaries only when source-build tools are unavailable | Prebuilt evidence is explicit and not confused with source-build evidence | +| Skill validation | `scripts/harness/validate-skills.sh` | Passes when every repo-local skill has required sections | Repo-local skills are concise and auditable | + +## Non-Claims + +Phase 0 does not prove: + +- Felt semantic parity. +- Complete differential corpus coverage. +- Runtime LLZK rewrite verification. +- Full Lean proof audit. +- CI coverage when external tooling is missing. diff --git a/docs/harness/REVIEWS.md b/docs/harness/REVIEWS.md new file mode 100644 index 0000000..3814d7b --- /dev/null +++ b/docs/harness/REVIEWS.md @@ -0,0 +1,36 @@ +# Review Protocol + +Last reviewed: 2026-06-05 + +## Scope + +Every phase must have a review workspace under `reviews//` containing: + +- `request.md` +- `findings.md` +- `disposition.md` +- `adversarial-review.md` +- `evidence/` + +Each claim in canonical harness docs must cite either a local source in +`docs/harness/SOURCES.md`, command output under `evidence/`, or an explicitly +trusted external source added to the source ledger. + +## Severity + +- Critical: harness can report acceptance while hiding dirty dependency state. +- High: a gate reports success while skipping a required Strategy A or Strategy + E check. +- Medium: canonical docs are ambiguous, stale, or not reproducible. +- Low: wording, formatting, or convenience issues that do not affect evidence. + +## Disposition + +Findings must be marked as one of: + +- `fixed` +- `accepted-risk` +- `deferred` +- `invalid` + +A phase cannot close with undispositioned Critical or High findings. diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md new file mode 100644 index 0000000..7b2bfb6 --- /dev/null +++ b/docs/harness/SOURCES.md @@ -0,0 +1,47 @@ +# Source Ledger + +Last reviewed: 2026-06-05 + +## Trusted Local Sources + +| Source | Ref or retrieval | Use | +|---|---:|---| +| `docs/phases/PHASE-00-harness-reset.md` | local file, 2026-06-05 | Phase 0 objective, artifacts, gates, done criteria | +| llzk-lean repository HEAD | `ea2363f87bcc` | Bootstrap llzk-lean source state | +| Workspace VeIR repository HEAD | `4b0978bddec0` | Companion source state | +| `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | +| `lake-manifest.json` | local file, 2026-06-05 | Resolved `VeIR` dependency pin | +| `.lake/packages/VeIR` | `09d5f00f0d2b`, dirty | Actual dependency checkout state | +| `differential/run-differential.sh` | local file, 2026-06-05 | Strategy A wrapper behavior | +| `checker/CMakeLists.txt` | local file, 2026-06-05 | Strategy E CMake build/test surface | +| `checker/src/CertChecker.cpp` | local file, 2026-06-05 | MLIR matcher status | +| `checker/tests/test_loader.cpp` | local file, 2026-06-05 | Certificate loader and dispatch smoke tests | +| `checker/bin/llzk_lean_check.cpp` | local file, 2026-06-05 | Certificate summary driver smoke test | +| `certs/felt-combine.cert.json` | local file, 2026-06-05 | Certificate schema and theorem metadata smoke input | + +Evidence for the bootstrap state is captured under +`reviews/PHASE-00/evidence/`. + +## External Sources + +No external web source is trusted as canonical for Phase 0. Future phases may +add upstream LLZK, MLIR, Lean, or GitHub Actions references, but each must list +an exact URL or commit and retrieval date here. + +## Stale Historical Material + +These files are design context, not Phase 0 acceptance evidence unless a claim +is revalidated against current refs: + +- `README.md` +- `docs/README.md` +- `docs/strategy-a-oracle.md` +- `docs/strategy-e-certificates.md` +- `docs/future-*.md` +- `docs/REVIEW.md` +- `.github/workflows/differential.yml` +- `.github/workflows/certify.yml` +- Historical references to `llzkfelt_test1` and dates before 2026-06-05 + +When using any of these, cite the exact local file and explain whether the claim +was revalidated. diff --git a/docs/phases/PHASE-00-harness-reset.md b/docs/phases/PHASE-00-harness-reset.md new file mode 100644 index 0000000..be26a57 --- /dev/null +++ b/docs/phases/PHASE-00-harness-reset.md @@ -0,0 +1,109 @@ +# Phase 0: Harness Reset + +Status: bootstrap +Last reviewed: 2026-06-05 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-00-harness-reset.md + +## Objective + +Replace the current ad hoc agent documentation and review setup with a small, +repo-local harness that makes llzk-lean's dependency on VeIR explicit, +auditable, and reproducible. + +Phase 0 is a prerequisite for accepting further integration work. The main +failure mode to eliminate is proving or reviewing against hidden local state in +`.lake/packages/VeIR`. + +## Starting State + +- llzk-lean HEAD at bootstrap time: `ea2363f87bcc`. +- workspace veir HEAD at bootstrap time: `4b0978bddec0`. +- Lake dependency `VeIR` at bootstrap time: `09d5f00f0d2b`. +- Lake dependency `VeIR` is dirty at bootstrap time: + - modified `Veir/Passes/Felt/Combine.lean` + - modified `Veir/Passes/Felt/Proofs.lean` + - untracked `Veir/Passes/Felt/RewriteLemmas.lean` +- llzk-lean has no repo-local `AGENTS.md`, no skill directory, and no + `docs/harness` source of truth. +- `differential/run-differential.sh` uses `.lake/packages/VeIR` and currently + cannot be treated as a high-assurance oracle without exit-code and tool-state + hardening. + +## Non-Goals + +- Do not change Felt semantics or proofs in this phase. +- Do not add new differential cases except smoke cases needed to validate the + harness itself. +- Do not accept a dirty Lake dependency as normal release or review state. +- Do not let CI skips count as evidence that Strategy A or Strategy E works. + +## Artifacts To Create + +- `AGENTS.md`: concise entrypoint for agents working in this repository. +- `docs/harness/CURRENT.md`: active phase, refs, dependency mode, known hazards, + and allowed exploratory states. +- `docs/harness/SOURCES.md`: trusted source ledger for LLZK, VeIR, MLIR, Lean, + and local Strategy A/E documents. +- `docs/harness/GATES.md`: executable gate inventory and what each gate proves. +- `docs/harness/REVIEWS.md`: independent review protocol, severity definitions, + and finding disposition rules. +- `docs/phases/PHASE_TEMPLATE.md`: template for future phase bootstrap files. +- `reviews/PHASE-00/{request.md,findings.md,disposition.md,evidence/}`: + adversarial review workspace for this phase. +- `scripts/harness/doctor.sh`: validate dependency pin, dirty state, local tool + availability, CI assumptions, and expected repo layout. +- `scripts/harness/check-doc-freshness.sh`: reject stale phase metadata and + unreviewed canonical-doc changes. +- `scripts/harness/diff-smoke.sh`: run a minimal differential check and classify + tool failure separately from semantic divergence. +- `scripts/harness/cert-smoke.sh`: run a minimal Strategy E checker smoke test + and report whether MLIR-backed matching is active or absent. +- `scripts/harness/validate-skills.sh`: validate any repo-local skills. + +## Skill Infrastructure + +Create repo-local skills only when they encode repeatable project behavior. +Initial candidates: + +- `skills/llzk-lean-dependency-audit/SKILL.md` +- `skills/lean-axiom-audit/SKILL.md` +- `skills/mlir-differential/SKILL.md` +- `skills/cert-checker-review/SKILL.md` +- `skills/phase-bootstrap/SKILL.md` + +Each skill must be concise, include when to use it, point to exact scripts or +references, and have a validation path in `scripts/harness/validate-skills.sh`. + +## Gates To Implement + +- `scripts/harness/doctor.sh` passes from the llzk-lean root only when the VeIR + dependency state is explicit and acceptable for the selected mode. +- Dirty `.lake/packages/VeIR` state is detected and reported with exact files. +- Differential smoke checks distinguish missing tools, parse failures, pass + failures, semantic divergence, and expected divergence. +- Certificate smoke checks distinguish schema validation, theorem metadata + coverage, and real MLIR matcher coverage. +- CI workflows do not silently treat skipped external tooling as proof of + Strategy A or Strategy E coverage. + +## Review Requirements + +- Every Phase 0 claim must cite either a local file, a command output captured + under `reviews/PHASE-00/evidence/`, or an explicitly trusted external source. +- The reviewer must run the harness gates from a clean shell and record the + commands used. +- Findings must be dispositioned as fixed, accepted-risk, deferred, or invalid. +- Phase 0 cannot close while dependency state is ambiguous or hidden. + +## Done Criteria + +- `AGENTS.md` exists and points to canonical harness docs. +- `docs/harness/CURRENT.md` is the single source of truth for active phase, + refs, dependency mode, and dirty-state policy. +- Harness gates fail on the known dirty dependency state unless explicitly run + in an exploratory mode. +- Strategy A and Strategy E smoke gates report precise status instead of + producing misleading success. +- Phase 0 review artifacts exist and contain an independent findings pass. +- Future phase bootstrap files can be generated from `PHASE_TEMPLATE.md`. diff --git a/docs/phases/PHASE_TEMPLATE.md b/docs/phases/PHASE_TEMPLATE.md new file mode 100644 index 0000000..d657f88 --- /dev/null +++ b/docs/phases/PHASE_TEMPLATE.md @@ -0,0 +1,36 @@ +# Phase N: Title + +Status: draft +Last reviewed: YYYY-MM-DD +Repository: llzk-lean +Companion phase file: path-or-none + +## Objective + +State the specific outcome this phase must achieve. + +## Starting State + +- List exact repository refs. +- List dependency pins and dirty files. +- List existing gates or docs that are trusted or stale. + +## Non-Goals + +- List work that must not be smuggled into this phase. + +## Artifacts To Create Or Update + +- List files, scripts, review workspaces, and evidence. + +## Gates To Implement + +- List executable commands and required pass/fail behavior. + +## Review Requirements + +- List evidence, reviewer, and disposition requirements. + +## Done Criteria + +- List objective acceptance criteria. diff --git a/reviews/PHASE-00/adversarial-review.md b/reviews/PHASE-00/adversarial-review.md new file mode 100644 index 0000000..04a1629 --- /dev/null +++ b/reviews/PHASE-00/adversarial-review.md @@ -0,0 +1,42 @@ +# Adversarial Review Refresh + +Reviewed: 2026-06-05 +Repository: llzk-lean + +## Scope + +This refresh reviewed every Phase 0 artifact added or changed in this session: + +- `AGENTS.md` +- `docs/harness/*.md` +- `docs/phases/*.md` +- `scripts/harness/*.sh` +- `differential/run-differential.sh` +- `skills/*/SKILL.md` +- `reviews/PHASE-00/*` + +## Review Questions + +- Can dirty `.lake/packages/VeIR` state be hidden by any strict gate? +- Do differential smoke failures distinguish missing tools from semantic + divergence? +- Does certificate smoke build or identify its checker binary source clearly? +- Do canonical docs distinguish schema/loader evidence from MLIR matcher + evidence? +- Are stale historical strategy docs marked as context rather than acceptance + evidence? + +## New Findings From Refresh + +- L-P0-004 was added: the first certificate smoke fallback could rely on + existing `checker/build` binaries when CMake/CTest were unavailable. +- `scripts/harness/cert-smoke.sh` now builds from source via CMake/CTest or + direct `g++`. Prebuilt binaries require `CERT_SMOKE_ALLOW_PREBUILT=1`. +- `scripts/harness/check-doc-freshness.sh` now checks all canonical harness + review dates and required evidence files. + +## Residual Risk + +`llzk-opt` is not available in this environment, so Strategy A differential +smoke records missing-tool status with exit 77. MLIR-backed certificate matching +is still absent and explicitly reported by the smoke gate. diff --git a/reviews/PHASE-00/disposition.md b/reviews/PHASE-00/disposition.md new file mode 100644 index 0000000..e3c18f6 --- /dev/null +++ b/reviews/PHASE-00/disposition.md @@ -0,0 +1,18 @@ +# Phase 0 Disposition + +Reviewed: 2026-06-05 +Repository: llzk-lean + +## Disposition + +- L-P0-001: fixed. `scripts/harness/doctor.sh` fails in strict mode on dirty + `.lake/packages/VeIR` state and reports exact files. Exploratory mode is + explicit. +- L-P0-002: fixed. `scripts/harness/diff-smoke.sh` preflights `llzk-opt` and + exits 77 for missing-tool status. +- L-P0-003: fixed. `scripts/harness/cert-smoke.sh` reports schema/loader + status separately from MLIR matcher status. +- L-P0-004: fixed. `scripts/harness/cert-smoke.sh` now source-builds through + CMake/CTest when available or direct `g++` otherwise. Prebuilt + `checker/build` binaries require `CERT_SMOKE_ALLOW_PREBUILT=1` and are + reported explicitly. diff --git a/reviews/PHASE-00/evidence/adversarial-review.txt b/reviews/PHASE-00/evidence/adversarial-review.txt new file mode 100644 index 0000000..2d22fdd --- /dev/null +++ b/reviews/PHASE-00/evidence/adversarial-review.txt @@ -0,0 +1,71 @@ +Script started on 2026-06-05 20:24:54+01:00 [COMMAND="rg -n 'L-P0-004|CERT_SMOKE_ALLOW_PREBUILT|g\+\+|source|prebuilt|MLIR matcher|adversarial' docs/harness reviews/PHASE-00/*.md scripts/harness" ] +reviews/PHASE-00/request.md +17:Strategy E MLIR matcher coverage accurately. + +reviews/PHASE-00/findings.md +36:contains W4B TODOs. Phase 0 must report MLIR matcher absence rather than +43:### L-P0-004: Certificate smoke must not silently trust stale build artifacts +49:unavailable. Those binaries may be stale relative to the edited source, so they + +reviews/PHASE-00/adversarial-review.md +23:- Does certificate smoke build or identify its checker binary source clearly? +24:- Do canonical docs distinguish schema/loader evidence from MLIR matcher +31:- L-P0-004 was added: the first certificate smoke fallback could rely on +33:- `scripts/harness/cert-smoke.sh` now builds from source via CMake/CTest or +34: direct `g++`. Prebuilt binaries require `CERT_SMOKE_ALLOW_PREBUILT=1`. + +reviews/PHASE-00/disposition.md +14: status separately from MLIR matcher status. +15:- L-P0-004: fixed. `scripts/harness/cert-smoke.sh` now source-builds through +16: CMake/CTest when available or direct `g++` otherwise. Prebuilt +17: `checker/build` binaries require `CERT_SMOKE_ALLOW_PREBUILT=1` and are + +scripts/harness/check-doc-freshness.sh +35:require_file reviews/PHASE-00/adversarial-review.md +79: reviews/PHASE-00/evidence/adversarial-review.txt; do + +docs/harness/REVIEWS.md +12:- `adversarial-review.md` +15:Each claim in canonical harness docs must cite either a local source in +17:trusted external source added to the source ledger. + +scripts/harness/cert-smoke.sh +44:elif command -v g++ >/dev/null 2>&1; then +45: src_build="${TMPDIR_LOCAL}/source-build" +47: common_sources=( +52: if ! g++ -std=c++17 -I"${ROOT}/checker/src" \ +53: "${common_sources[@]}" "${ROOT}/checker/tests/test_loader.cpp" \ +56: echo "CERT-SMOKE: g++ loader build failed" >&2 +59: if ! g++ -std=c++17 -I"${ROOT}/checker/src" \ +60: "${common_sources[@]}" "${ROOT}/checker/bin/llzk_lean_check.cpp" \ +63: echo "CERT-SMOKE: g++ driver build failed" >&2 +68: echo "CERT-SMOKE: cmake/ctest unavailable; built checker from source with g++" +71: echo "CERT-SMOKE: g++ loader tests failed" >&2 +74: echo "CERT-SMOKE: g++ schema/loader tests passed" +75: build_mode="g++" +76:elif [[ "${CERT_SMOKE_ALLOW_PREBUILT:-0}" == "1" && -x "$loader" && -x "$driver" ]]; then +77: echo "CERT-SMOKE: using prebuilt checker binaries because CERT_SMOKE_ALLOW_PREBUILT=1" +80: echo "CERT-SMOKE: prebuilt loader tests failed" >&2 +83: echo "CERT-SMOKE: prebuilt schema/loader tests passed" +84: build_mode="prebuilt" +86: echo "TOOL-MISSING: cmake/ctest and g++ unavailable" >&2 +87: echo "Set CERT_SMOKE_ALLOW_PREBUILT=1 to use existing checker/build binaries as non-source-build evidence." >&2 +113: echo "CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs" +115: echo "CERT-SMOKE: MLIR matcher configured active" +117: echo "CERT-SMOKE: MLIR matcher absent in ${build_mode} smoke mode" + +docs/harness/CURRENT.md +40: loader behavior, and dispatch tests from source when CMake/CTest or `g++` is +42: `CERT_SMOKE_ALLOW_PREBUILT=1` is set. Real MLIR-backed matching remains + +docs/harness/SOURCES.md +10:| llzk-lean repository HEAD | `ea2363f87bcc` | Bootstrap llzk-lean source state | +11:| Workspace VeIR repository HEAD | `4b0978bddec0` | Companion source state | +17:| `checker/src/CertChecker.cpp` | local file, 2026-06-05 | MLIR matcher status | +27:No external web source is trusted as canonical for Phase 0. Future phases may + +docs/harness/GATES.md +14:| Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds checker smoke binaries from source via CMake/CTest or direct `g++`, passes loader/schema smoke, and reports MLIR matcher active or absent | Strategy E smoke status is classified without pretending MLIR matching exists | +15:| Prebuilt certificate smoke | `CERT_SMOKE_ALLOW_PREBUILT=1 scripts/harness/cert-smoke.sh` | Uses existing `checker/build` binaries only when source-build tools are unavailable | Prebuilt evidence is explicit and not confused with source-build evidence | + +Script done on 2026-06-05 20:24:54+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/cert-smoke.txt b/reviews/PHASE-00/evidence/cert-smoke.txt new file mode 100644 index 0000000..fc2ae9e --- /dev/null +++ b/reviews/PHASE-00/evidence/cert-smoke.txt @@ -0,0 +1,9 @@ +Script started on 2026-06-05 20:26:26+01:00 [COMMAND="scripts/harness/cert-smoke.sh" ] +CERT-SMOKE: cmake/ctest unavailable; built checker from source with g++ +CERT-SMOKE: g++ schema/loader tests passed +CERT-SMOKE: theorem metadata present for 2/2 certs +CERT-SMOKE: driver cert summary passed +CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs +CERT-SMOKE: schema validation passed + +Script done on 2026-06-05 20:26:29+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/check-doc-freshness.txt b/reviews/PHASE-00/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..ff17c26 --- /dev/null +++ b/reviews/PHASE-00/evidence/check-doc-freshness.txt @@ -0,0 +1,30 @@ +Script started on 2026-06-05 20:26:33+01:00 [COMMAND="scripts/harness/check-doc-freshness.sh" ] +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: SOURCES marks stale historical material +PASS: Phase 0 disposition exists +PASS: evidence present reviews/PHASE-00/evidence/doctor-strict.txt +PASS: evidence present reviews/PHASE-00/evidence/doctor-exploratory.txt +PASS: evidence present reviews/PHASE-00/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-00/evidence/diff-smoke.txt +PASS: evidence present reviews/PHASE-00/evidence/cert-smoke.txt +PASS: evidence present reviews/PHASE-00/evidence/dependency-status.txt +PASS: evidence present reviews/PHASE-00/evidence/adversarial-review.txt + +doc freshness summary: 0 fail + +Script done on 2026-06-05 20:26:33+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/dependency-ref.txt b/reviews/PHASE-00/evidence/dependency-ref.txt new file mode 100644 index 0000000..aeeefa8 --- /dev/null +++ b/reviews/PHASE-00/evidence/dependency-ref.txt @@ -0,0 +1,4 @@ +Script started on 2026-06-05 20:16:21+01:00 [COMMAND="git -C .lake/packages/VeIR rev-parse --short=12 HEAD" ] +09d5f00f0d2b + +Script done on 2026-06-05 20:16:21+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/dependency-status.txt b/reviews/PHASE-00/evidence/dependency-status.txt new file mode 100644 index 0000000..093aaf4 --- /dev/null +++ b/reviews/PHASE-00/evidence/dependency-status.txt @@ -0,0 +1,6 @@ +Script started on 2026-06-05 20:16:21+01:00 [COMMAND="git -C .lake/packages/VeIR status --short" ] + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean + +Script done on 2026-06-05 20:16:21+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/diff-smoke.txt b/reviews/PHASE-00/evidence/diff-smoke.txt new file mode 100644 index 0000000..81c977d --- /dev/null +++ b/reviews/PHASE-00/evidence/diff-smoke.txt @@ -0,0 +1,4 @@ +Script started on 2026-06-05 20:26:23+01:00 [COMMAND="scripts/harness/diff-smoke.sh" ] +TOOL-MISSING: llzk-opt is not on PATH and LLZK_OPT is unset + +Script done on 2026-06-05 20:26:23+01:00 [COMMAND_EXIT_CODE="77"] diff --git a/reviews/PHASE-00/evidence/doctor-exploratory.txt b/reviews/PHASE-00/evidence/doctor-exploratory.txt new file mode 100644 index 0000000..d3aca80 --- /dev/null +++ b/reviews/PHASE-00/evidence/doctor-exploratory.txt @@ -0,0 +1,34 @@ +Script started on 2026-06-05 20:26:13+01:00 [COMMAND="scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir" ] +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +WARN: dependency checkout is dirty in exploratory mode: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +PASS: workspace VeIR HEAD matches 4b0978bddec0 +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence + +doctor summary: 0 fail, 3 warn, mode=exploratory + +Script done on 2026-06-05 20:26:13+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/doctor-strict.txt b/reviews/PHASE-00/evidence/doctor-strict.txt new file mode 100644 index 0000000..b210f0c --- /dev/null +++ b/reviews/PHASE-00/evidence/doctor-strict.txt @@ -0,0 +1,34 @@ +Script started on 2026-06-05 20:26:09+01:00 [COMMAND="scripts/harness/doctor.sh" ] +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +FAIL: dependency checkout is dirty: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +WARN: workspace VeIR repo was not checked; pass --workspace-veir PATH +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence + +doctor summary: 1 fail, 3 warn, mode=strict + +Script done on 2026-06-05 20:26:09+01:00 [COMMAND_EXIT_CODE="1"] diff --git a/reviews/PHASE-00/evidence/local-ref.txt b/reviews/PHASE-00/evidence/local-ref.txt new file mode 100644 index 0000000..a8aaa83 --- /dev/null +++ b/reviews/PHASE-00/evidence/local-ref.txt @@ -0,0 +1,4 @@ +Script started on 2026-06-05 20:16:21+01:00 [COMMAND="git rev-parse --short=12 HEAD" ] +ea2363f87bcc + +Script done on 2026-06-05 20:16:21+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/stale-references.txt b/reviews/PHASE-00/evidence/stale-references.txt new file mode 100644 index 0000000..04a09a2 --- /dev/null +++ b/reviews/PHASE-00/evidence/stale-references.txt @@ -0,0 +1,60 @@ +Script started on 2026-06-05 20:24:42+01:00 [COMMAND="rg -n 'llzkfelt_test1|2026-05-28|CI workflow stubbed|Skips green|harness/' README.md docs differential .github" ] +README.md +29:VEIR on the [`llzkfelt_test1`](https://github.com/project-llzk/veir/tree/llzkfelt_test1) + +differential/run-differential.sh +24:# See differential/README.md for the protocol and docs/harness/GATES.md for the + +docs/REVIEW.md +132:deliver; L3 VEIR README still references the dropped `llzkfelt_test1` branch. + +differential/README.md +114: [`FELT_PARITY_ASSESSMENT_2026-05-28.md`](https://github.com/alexanderlhicks/veir/blob/llzkfelt_test1/FELT_PARITY_ASSESSMENT_2026-05-28.md)) + +docs/strategy-a-oracle.md +86: reduction yet — see VEIR's `FELT_PARITY_ASSESSMENT_2026-05-28.md` +121:Current state (2026-05-28): +131:- 🚧 CI workflow stubbed in `.github/workflows/differential.yml`. +132: Skips green if `llzk-opt` not provisioned — CI provisioning is +175: [VEIR FELT_PARITY_ASSESSMENT_2026-05-28.md](https://github.com/alexanderlhicks/veir/blob/llzkfelt_test1/FELT_PARITY_ASSESSMENT_2026-05-28.md) + +docs/phases/PHASE-00-harness-reset.md +44:- `docs/harness/CURRENT.md`: active phase, refs, dependency mode, known hazards, +46:- `docs/harness/SOURCES.md`: trusted source ledger for LLZK, VeIR, MLIR, Lean, +48:- `docs/harness/GATES.md`: executable gate inventory and what each gate proves. +49:- `docs/harness/REVIEWS.md`: independent review protocol, severity definitions, +54:- `scripts/harness/doctor.sh`: validate dependency pin, dirty state, local tool +56:- `scripts/harness/check-doc-freshness.sh`: reject stale phase metadata and +58:- `scripts/harness/diff-smoke.sh`: run a minimal differential check and classify +60:- `scripts/harness/cert-smoke.sh`: run a minimal Strategy E checker smoke test +62:- `scripts/harness/validate-skills.sh`: validate any repo-local skills. +76:references, and have a validation path in `scripts/harness/validate-skills.sh`. +80:- `scripts/harness/doctor.sh` passes from the llzk-lean root only when the VeIR +102:- `docs/harness/CURRENT.md` is the single source of truth for active phase, + +docs/harness/REVIEWS.md +16:`docs/harness/SOURCES.md`, command output under `evidence/`, or an explicitly + +docs/harness/GATES.md +9:| Strict doctor | `scripts/harness/doctor.sh` | Fails while `.lake/packages/VeIR` is dirty | Dirty dependency state is not hidden | +10:| Exploratory doctor | `scripts/harness/doctor.sh --mode exploratory` | Passes with dirty-file warnings | Local investigation can continue with explicit dependency state | +11:| Workspace doctor | `scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir` | Passes if workspace VeIR is at the bootstrap ref | Companion repo state is explicit | +12:| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when canonical docs and review disposition exist | Phase metadata and review state are present | +13:| Differential smoke | `scripts/harness/diff-smoke.sh` | Exits 0 on real pass, 77 on missing `llzk-opt`, 1 on divergence, 2 on tool/parse/pass failure | Strategy A smoke status is classified | +14:| Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds checker smoke binaries from source via CMake/CTest or direct `g++`, passes loader/schema smoke, and reports MLIR matcher active or absent | Strategy E smoke status is classified without pretending MLIR matching exists | +15:| Prebuilt certificate smoke | `CERT_SMOKE_ALLOW_PREBUILT=1 scripts/harness/cert-smoke.sh` | Uses existing `checker/build` binaries only when source-build tools are unavailable | Prebuilt evidence is explicit and not confused with source-build evidence | +16:| Skill validation | `scripts/harness/validate-skills.sh` | Passes when every repo-local skill has required sections | Repo-local skills are concise and auditable | + +docs/harness/SOURCES.md +44:- Historical references to `llzkfelt_test1` and dates before 2026-06-05 + +docs/harness/CURRENT.md +20:`docs/harness/SOURCES.md`, and review evidence before treating the harness as +45: acceptance evidence unless `docs/harness/SOURCES.md` revalidates a claim. +53:- `scripts/harness/doctor.sh` fails in strict mode on the known dirty +55:- `scripts/harness/doctor.sh --mode exploratory` passes while reporting the +57:- `scripts/harness/check-doc-freshness.sh` passes. +58:- `scripts/harness/validate-skills.sh` passes. +59:- `scripts/harness/diff-smoke.sh` and `scripts/harness/cert-smoke.sh` report + +Script done on 2026-06-05 20:24:42+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/evidence/validate-skills.txt b/reviews/PHASE-00/evidence/validate-skills.txt new file mode 100644 index 0000000..0a36389 --- /dev/null +++ b/reviews/PHASE-00/evidence/validate-skills.txt @@ -0,0 +1,25 @@ +Script started on 2026-06-05 20:26:19+01:00 [COMMAND="scripts/harness/validate-skills.sh" ] +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills + +Script done on 2026-06-05 20:26:19+01:00 [COMMAND_EXIT_CODE="0"] diff --git a/reviews/PHASE-00/findings.md b/reviews/PHASE-00/findings.md new file mode 100644 index 0000000..b5804ee --- /dev/null +++ b/reviews/PHASE-00/findings.md @@ -0,0 +1,54 @@ +# Phase 0 Findings + +Reviewed: 2026-06-05 +Repository: llzk-lean + +## Findings + +### L-P0-001: Dirty Lake dependency can hide proof state + +Severity: Critical + +`.lake/packages/VeIR` is dirty at bootstrap. Any review that relies only on +`lakefile.toml` or `lake-manifest.json` would miss local modifications to proof +and rewrite files. + +Evidence: + +- `reviews/PHASE-00/evidence/dependency-status.txt` + +### L-P0-002: Differential smoke must not count missing llzk-opt as pass + +Severity: High + +Strategy A depends on `llzk-opt`. Missing `llzk-opt` must be classified as a +tool skip or missing-tool status, not as differential agreement. + +Evidence: + +- `reviews/PHASE-00/evidence/diff-smoke.txt` + +### L-P0-003: Certificate checker smoke does not prove MLIR rewrite matching + +Severity: Medium + +The checker loader and schema tests are meaningful, but `DefaultMatcher` still +contains W4B TODOs. Phase 0 must report MLIR matcher absence rather than +claiming runtime LLZK rewrite verification. + +Evidence: + +- `reviews/PHASE-00/evidence/cert-smoke.txt` + +### L-P0-004: Certificate smoke must not silently trust stale build artifacts + +Severity: High + +The first Phase 0 `cert-smoke.sh` fallback used existing +`checker/build/{test_loader,llzk-lean-check}` binaries when CMake/CTest were +unavailable. Those binaries may be stale relative to the edited source, so they +are weak evidence unless explicitly requested. + +Evidence: + +- `reviews/PHASE-00/evidence/cert-smoke.txt` diff --git a/reviews/PHASE-00/request.md b/reviews/PHASE-00/request.md new file mode 100644 index 0000000..3f8175f --- /dev/null +++ b/reviews/PHASE-00/request.md @@ -0,0 +1,17 @@ +# Phase 0 Review Request + +Requested: 2026-06-05 +Repository: llzk-lean + +Review the Phase 0 harness reset artifacts: + +- `AGENTS.md` +- `docs/harness/*.md` +- `docs/phases/PHASE-00-harness-reset.md` +- `docs/phases/PHASE_TEMPLATE.md` +- `scripts/harness/*.sh` +- `skills/*/SKILL.md` + +The review should confirm that the harness records exact refs, exposes dirty +Lake dependency state, classifies Strategy A smoke failures, and reports +Strategy E MLIR matcher coverage accurately. diff --git a/scripts/harness/cert-smoke.sh b/scripts/harness/cert-smoke.sh new file mode 100755 index 0000000..caace2c --- /dev/null +++ b/scripts/harness/cert-smoke.sh @@ -0,0 +1,121 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +BUILD_DIR="${CHECKER_BUILD_DIR:-${ROOT}/checker/build}" +CERT="${1:-${ROOT}/certs/felt-combine.cert.json}" + +if [[ ! -r "$CERT" ]]; then + echo "CERT-SMOKE: cert snapshot is not readable: ${CERT}" >&2 + exit 2 +fi + +TMPDIR_LOCAL="$(mktemp -d -t llzk-lean-cert-smoke-XXXXXX)" +cleanup() { + rm -rf "$TMPDIR_LOCAL" +} +trap cleanup EXIT + +loader="${BUILD_DIR}/test_loader" +driver="${BUILD_DIR}/llzk-lean-check" +build_mode="" + +if command -v cmake >/dev/null 2>&1 && command -v ctest >/dev/null 2>&1; then + if ! cmake -S "${ROOT}/checker" -B "$BUILD_DIR" -DCMAKE_BUILD_TYPE=Debug >"${TMPDIR_LOCAL}/configure.log" 2>&1; then + cat "${TMPDIR_LOCAL}/configure.log" >&2 + echo "CERT-SMOKE: cmake configure failed" >&2 + exit 2 + fi + + if ! cmake --build "$BUILD_DIR" >"${TMPDIR_LOCAL}/build.log" 2>&1; then + cat "${TMPDIR_LOCAL}/build.log" >&2 + echo "CERT-SMOKE: checker build failed" >&2 + exit 2 + fi + + if ! ctest --test-dir "$BUILD_DIR" --output-on-failure >"${TMPDIR_LOCAL}/ctest.log" 2>&1; then + cat "${TMPDIR_LOCAL}/ctest.log" >&2 + echo "CERT-SMOKE: schema/loader tests failed" >&2 + exit 1 + fi + echo "CERT-SMOKE: ctest schema/loader tests passed" + build_mode="cmake" +elif command -v g++ >/dev/null 2>&1; then + src_build="${TMPDIR_LOCAL}/source-build" + mkdir -p "$src_build" + common_sources=( + "${ROOT}/checker/src/JsonParser.cpp" + "${ROOT}/checker/src/OperandPath.cpp" + "${ROOT}/checker/src/CertChecker.cpp" + ) + if ! g++ -std=c++17 -I"${ROOT}/checker/src" \ + "${common_sources[@]}" "${ROOT}/checker/tests/test_loader.cpp" \ + -o "${src_build}/test_loader" >"${TMPDIR_LOCAL}/gxx-loader.log" 2>&1; then + cat "${TMPDIR_LOCAL}/gxx-loader.log" >&2 + echo "CERT-SMOKE: g++ loader build failed" >&2 + exit 2 + fi + if ! g++ -std=c++17 -I"${ROOT}/checker/src" \ + "${common_sources[@]}" "${ROOT}/checker/bin/llzk_lean_check.cpp" \ + -o "${src_build}/llzk-lean-check" >"${TMPDIR_LOCAL}/gxx-driver.log" 2>&1; then + cat "${TMPDIR_LOCAL}/gxx-driver.log" >&2 + echo "CERT-SMOKE: g++ driver build failed" >&2 + exit 2 + fi + loader="${src_build}/test_loader" + driver="${src_build}/llzk-lean-check" + echo "CERT-SMOKE: cmake/ctest unavailable; built checker from source with g++" + if ! "$loader" "$CERT" >"${TMPDIR_LOCAL}/loader.log" 2>&1; then + cat "${TMPDIR_LOCAL}/loader.log" >&2 + echo "CERT-SMOKE: g++ loader tests failed" >&2 + exit 1 + fi + echo "CERT-SMOKE: g++ schema/loader tests passed" + build_mode="g++" +elif [[ "${CERT_SMOKE_ALLOW_PREBUILT:-0}" == "1" && -x "$loader" && -x "$driver" ]]; then + echo "CERT-SMOKE: using prebuilt checker binaries because CERT_SMOKE_ALLOW_PREBUILT=1" + if ! "$loader" "$CERT" >"${TMPDIR_LOCAL}/loader.log" 2>&1; then + cat "${TMPDIR_LOCAL}/loader.log" >&2 + echo "CERT-SMOKE: prebuilt loader tests failed" >&2 + exit 1 + fi + echo "CERT-SMOKE: prebuilt schema/loader tests passed" + build_mode="prebuilt" +else + echo "TOOL-MISSING: cmake/ctest and g++ unavailable" >&2 + echo "Set CERT_SMOKE_ALLOW_PREBUILT=1 to use existing checker/build binaries as non-source-build evidence." >&2 + exit 77 +fi + +pattern_count="$(grep -c '"patternId"' "$CERT" || true)" +theorem_count="$(grep -c '"theoremName"' "$CERT" || true)" +if [[ "$pattern_count" -gt 0 && "$pattern_count" -eq "$theorem_count" ]]; then + echo "CERT-SMOKE: theorem metadata present for ${theorem_count}/${pattern_count} certs" +else + echo "CERT-SMOKE: theorem metadata mismatch (${theorem_count}/${pattern_count})" >&2 + exit 1 +fi + +if [[ -x "$driver" ]]; then + if ! "$driver" --cert "$CERT" >"${TMPDIR_LOCAL}/driver.log" 2>&1; then + cat "${TMPDIR_LOCAL}/driver.log" >&2 + echo "CERT-SMOKE: driver cert summary failed" >&2 + exit 1 + fi + echo "CERT-SMOKE: driver cert summary passed" +else + echo "CERT-SMOKE: driver executable missing after build" >&2 + exit 2 +fi + +if grep -q 'TODO(W4B follow-up)' "${ROOT}/checker/src/CertChecker.cpp"; then + echo "CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs" +elif [[ "$build_mode" == "cmake" ]] && grep -q 'MLIR found' "${TMPDIR_LOCAL}/configure.log"; then + echo "CERT-SMOKE: MLIR matcher configured active" +else + echo "CERT-SMOKE: MLIR matcher absent in ${build_mode} smoke mode" +fi + +echo "CERT-SMOKE: schema validation passed" +exit 0 diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh new file mode 100755 index 0000000..e97e970 --- /dev/null +++ b/scripts/harness/check-doc-freshness.sh @@ -0,0 +1,91 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +FAIL=0 + +fail() { + echo "FAIL: $*" >&2 + FAIL=$((FAIL + 1)) +} + +ok() { + echo "PASS: $*" +} + +require_file() { + local path="$1" + if [[ -f "${ROOT}/${path}" ]]; then + ok "found ${path}" + else + fail "missing ${path}" + fi +} + +require_file docs/phases/PHASE-00-harness-reset.md +require_file docs/phases/PHASE_TEMPLATE.md +require_file docs/harness/CURRENT.md +require_file docs/harness/SOURCES.md +require_file docs/harness/GATES.md +require_file docs/harness/REVIEWS.md +require_file reviews/PHASE-00/disposition.md +require_file reviews/PHASE-00/findings.md +require_file reviews/PHASE-00/request.md +require_file reviews/PHASE-00/adversarial-review.md + +phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-00-harness-reset.md" | head -1)" +if [[ "$phase_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then + ok "phase review date has ISO format" +else + fail "phase review date is missing or not ISO formatted" +fi + +for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md docs/harness/REVIEWS.md; do + doc_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/${doc}" | head -1)" + if [[ "$doc_date" == "$phase_date" ]]; then + ok "${doc} review date agrees with phase" + else + fail "${doc} review date (${doc_date:-}) does not match phase (${phase_date:-})" + fi +done + +if grep -q "Active phase: Phase 0" "${ROOT}/docs/harness/CURRENT.md"; then + ok "CURRENT names active phase" +else + fail "CURRENT does not name Phase 0 as active" +fi + +if grep -q "Stale Historical Material" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES marks stale historical material" +else + fail "SOURCES does not mark stale historical material" +fi + +if grep -q "Disposition" "${ROOT}/reviews/PHASE-00/disposition.md"; then + ok "Phase 0 disposition exists" +else + fail "Phase 0 disposition is not populated" +fi + +for evidence in \ + reviews/PHASE-00/evidence/doctor-strict.txt \ + reviews/PHASE-00/evidence/doctor-exploratory.txt \ + reviews/PHASE-00/evidence/validate-skills.txt \ + reviews/PHASE-00/evidence/diff-smoke.txt \ + reviews/PHASE-00/evidence/cert-smoke.txt \ + reviews/PHASE-00/evidence/dependency-status.txt \ + reviews/PHASE-00/evidence/adversarial-review.txt; do + if [[ -s "${ROOT}/${evidence}" ]]; then + ok "evidence present ${evidence}" + else + fail "missing or empty evidence ${evidence}" + fi +done + +echo +echo "doc freshness summary: ${FAIL} fail" +if [[ "$FAIL" -ne 0 ]]; then + exit 1 +fi +exit 0 diff --git a/scripts/harness/diff-smoke.sh b/scripts/harness/diff-smoke.sh new file mode 100755 index 0000000..ae9e95f --- /dev/null +++ b/scripts/harness/diff-smoke.sh @@ -0,0 +1,74 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +TARGET="${1:-${ROOT}/differential/corpus/felt/const_identities.mlir}" +DIFF_WRAPPER="${ROOT}/differential/run-differential.sh" +VEIR_DIFF="${ROOT}/.lake/packages/VeIR/scripts/llzk-diff.sh" + +if [[ ! -r "$TARGET" ]]; then + echo "TOOL-FAIL: target is not readable: ${TARGET}" >&2 + exit 2 +fi + +if [[ ! -x "$DIFF_WRAPPER" ]]; then + echo "TOOL-FAIL: differential wrapper is not executable: ${DIFF_WRAPPER}" >&2 + exit 2 +fi + +if [[ ! -x "$VEIR_DIFF" ]]; then + echo "TOOL-FAIL: VeIR diff script is not executable: ${VEIR_DIFF}" >&2 + exit 2 +fi + +if ! command -v lake >/dev/null 2>&1; then + echo "TOOL-MISSING: lake is not available" >&2 + exit 77 +fi + +if [[ -z "${LLZK_OPT:-}" ]] && ! command -v llzk-opt >/dev/null 2>&1; then + echo "TOOL-MISSING: llzk-opt is not on PATH and LLZK_OPT is unset" >&2 + exit 77 +fi + +TMPDIR_LOCAL="$(mktemp -d -t llzk-lean-diff-smoke-XXXXXX)" +cleanup() { + rm -rf "$TMPDIR_LOCAL" +} +trap cleanup EXIT + +"$DIFF_WRAPPER" "$TARGET" >"${TMPDIR_LOCAL}/out" 2>&1 +rc=$? + +cat "${TMPDIR_LOCAL}/out" +case "$rc" in + 0) + if grep -q '^EXPECTED-DIVERGE:' "${TMPDIR_LOCAL}/out"; then + echo "DIFF-SMOKE: expected divergence classified" + else + echo "DIFF-SMOKE: pass" + fi + exit 0 + ;; + 1) + if grep -Eq '^(DIVERGE|UNEXPECTED-PASS):' "${TMPDIR_LOCAL}/out"; then + echo "DIFF-SMOKE: semantic divergence or unexpected pass" >&2 + else + echo "DIFF-SMOKE: wrapper failure" >&2 + fi + exit 1 + ;; + 2) + echo "DIFF-SMOKE: tool, parse, pass, or invocation failure" >&2 + exit 2 + ;; + 77) + echo "DIFF-SMOKE: tool missing" >&2 + exit 77 + ;; + *) + echo "DIFF-SMOKE: unexpected exit ${rc}" >&2 + exit 2 + ;; +esac diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh new file mode 100755 index 0000000..a8e3115 --- /dev/null +++ b/scripts/harness/doctor.sh @@ -0,0 +1,199 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +MODE="strict" +WORKSPACE_VEIR="" + +EXPECTED_LLZK_LEAN_HEAD="ea2363f87bcc" +EXPECTED_WORKSPACE_VEIR_HEAD="4b0978bddec0" +EXPECTED_VEIR_DEP="09d5f00f0d2b4a8710afbe53dfdd7cf468578a04" +EXPECTED_VEIR_DEP_SHORT="09d5f00f0d2b" + +FAIL=0 +WARN=0 + +usage() { + cat <<'USAGE' +usage: scripts/harness/doctor.sh [--mode strict|exploratory] [--workspace-veir PATH] + +Validates the Phase 0 llzk-lean harness. Strict mode fails on dirty or +mismatched .lake/packages/VeIR state. Exploratory mode reports that state but +allows the command to complete successfully. +USAGE +} + +ok() { + echo "PASS: $*" +} + +warn() { + echo "WARN: $*" >&2 + WARN=$((WARN + 1)) +} + +fail() { + echo "FAIL: $*" >&2 + FAIL=$((FAIL + 1)) +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --mode) + MODE="${2:-}" + shift 2 + ;; + --workspace-veir) + WORKSPACE_VEIR="${2:-}" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + fail "unknown argument: $1" + usage + exit 2 + ;; + esac +done + +case "$MODE" in + strict|exploratory) ;; + *) + fail "invalid mode: ${MODE}" + exit 2 + ;; +esac + +require_file() { + local path="$1" + if [[ -f "${ROOT}/${path}" ]]; then + ok "found ${path}" + else + fail "missing ${path}" + fi +} + +require_executable() { + local path="$1" + if [[ -x "${ROOT}/${path}" ]]; then + ok "executable ${path}" + else + fail "missing executable ${path}" + fi +} + +require_tool() { + local tool="$1" + if command -v "$tool" >/dev/null 2>&1; then + ok "tool ${tool} is available" + else + fail "required tool ${tool} is not available" + fi +} + +optional_tool() { + local tool="$1" + if command -v "$tool" >/dev/null 2>&1; then + ok "optional tool ${tool} is available" + else + warn "optional tool ${tool} is not available" + fi +} + +require_tool git +require_tool lake +optional_tool cmake +optional_tool ctest + +git_root="$(git -C "$ROOT" rev-parse --show-toplevel 2>/dev/null || true)" +if [[ "$git_root" == "$ROOT" ]]; then + ok "git root is ${ROOT}" +else + fail "expected git root ${ROOT}, got ${git_root:-}" +fi + +head_short="$(git -C "$ROOT" rev-parse --short=12 HEAD 2>/dev/null || true)" +if [[ "$head_short" == "$EXPECTED_LLZK_LEAN_HEAD" ]]; then + ok "llzk-lean HEAD matches ${EXPECTED_LLZK_LEAN_HEAD}" +else + fail "llzk-lean HEAD ${head_short:-} does not match bootstrap ${EXPECTED_LLZK_LEAN_HEAD}" +fi + +if grep -q "$EXPECTED_VEIR_DEP" "${ROOT}/lakefile.toml" && + grep -q "$EXPECTED_VEIR_DEP" "${ROOT}/lake-manifest.json"; then + ok "Lake files pin VeIR ${EXPECTED_VEIR_DEP_SHORT}" +else + fail "Lake files do not both pin VeIR ${EXPECTED_VEIR_DEP}" +fi + +dep="${ROOT}/.lake/packages/VeIR" +if [[ -d "$dep/.git" ]]; then + dep_head="$(git -C "$dep" rev-parse --short=12 HEAD 2>/dev/null || true)" + if [[ "$dep_head" == "$EXPECTED_VEIR_DEP_SHORT" ]]; then + ok "dependency checkout is at ${EXPECTED_VEIR_DEP_SHORT}" + else + fail "dependency checkout ${dep_head:-} does not match ${EXPECTED_VEIR_DEP_SHORT}" + fi + + dep_status="$(git -C "$dep" status --short 2>/dev/null || true)" + if [[ -z "$dep_status" ]]; then + ok "dependency checkout is clean" + elif [[ "$MODE" == "exploratory" ]]; then + warn "dependency checkout is dirty in exploratory mode:" + printf '%s\n' "$dep_status" >&2 + else + fail "dependency checkout is dirty:" + printf '%s\n' "$dep_status" >&2 + fi +else + fail "dependency checkout missing at ${dep}" +fi + +if [[ -n "$WORKSPACE_VEIR" ]]; then + workspace="$(cd "$ROOT" && cd "$WORKSPACE_VEIR" 2>/dev/null && pwd || true)" + if [[ -z "$workspace" ]]; then + fail "workspace VeIR path is not readable: ${WORKSPACE_VEIR}" + else + workspace_head="$(git -C "$workspace" rev-parse --short=12 HEAD 2>/dev/null || true)" + if [[ "$workspace_head" == "$EXPECTED_WORKSPACE_VEIR_HEAD" ]]; then + ok "workspace VeIR HEAD matches ${EXPECTED_WORKSPACE_VEIR_HEAD}" + else + fail "workspace VeIR HEAD ${workspace_head:-} does not match ${EXPECTED_WORKSPACE_VEIR_HEAD}" + fi + fi +else + warn "workspace VeIR repo was not checked; pass --workspace-veir PATH" +fi + +require_file AGENTS.md +require_file docs/phases/PHASE-00-harness-reset.md +require_file docs/phases/PHASE_TEMPLATE.md +require_file docs/harness/CURRENT.md +require_file docs/harness/SOURCES.md +require_file docs/harness/GATES.md +require_file docs/harness/REVIEWS.md +require_file reviews/PHASE-00/request.md +require_file reviews/PHASE-00/findings.md +require_file reviews/PHASE-00/disposition.md +require_file reviews/PHASE-00/adversarial-review.md +require_executable scripts/harness/check-doc-freshness.sh +require_executable scripts/harness/diff-smoke.sh +require_executable scripts/harness/cert-smoke.sh +require_executable scripts/harness/validate-skills.sh + +if [[ -d "${ROOT}/reviews/PHASE-00/evidence" ]]; then + ok "found reviews/PHASE-00/evidence" +else + fail "missing reviews/PHASE-00/evidence" +fi + +echo +echo "doctor summary: ${FAIL} fail, ${WARN} warn, mode=${MODE}" +if [[ "$FAIL" -ne 0 ]]; then + exit 1 +fi +exit 0 diff --git a/scripts/harness/validate-skills.sh b/scripts/harness/validate-skills.sh new file mode 100755 index 0000000..1dc6a8b --- /dev/null +++ b/scripts/harness/validate-skills.sh @@ -0,0 +1,56 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +FAIL=0 +COUNT=0 + +fail() { + echo "FAIL: $*" >&2 + FAIL=$((FAIL + 1)) +} + +ok() { + echo "PASS: $*" +} + +if [[ ! -d "${ROOT}/skills" ]]; then + fail "missing skills directory" +else + while IFS= read -r skill; do + COUNT=$((COUNT + 1)) + rel="${skill#${ROOT}/}" + if grep -q '^# ' "$skill"; then + ok "${rel} has title" + else + fail "${rel} is missing title" + fi + if grep -q '^## When to use' "$skill"; then + ok "${rel} has usage trigger" + else + fail "${rel} is missing 'When to use'" + fi + if grep -q '^## Validation' "$skill"; then + ok "${rel} has validation path" + else + fail "${rel} is missing 'Validation'" + fi + if grep -q 'scripts/harness/' "$skill"; then + ok "${rel} points at harness scripts" + else + fail "${rel} does not point at a harness script" + fi + done < <(find "${ROOT}/skills" -mindepth 2 -maxdepth 2 -name SKILL.md | sort) +fi + +if [[ "$COUNT" -eq 0 ]]; then + fail "no repo-local skills found" +fi + +echo +echo "skill validation summary: ${FAIL} fail over ${COUNT} skills" +if [[ "$FAIL" -ne 0 ]]; then + exit 1 +fi +exit 0 diff --git a/skills/cert-checker-review/SKILL.md b/skills/cert-checker-review/SKILL.md new file mode 100644 index 0000000..bf2eef5 --- /dev/null +++ b/skills/cert-checker-review/SKILL.md @@ -0,0 +1,17 @@ +# Certificate Checker Review + +## When to use + +Use this skill when reviewing Strategy E certificate schema, checker behavior, +or MLIR matcher status. + +## Procedure + +- Use `scripts/harness/cert-smoke.sh` for Phase 0 smoke status. +- Distinguish schema validation, theorem metadata coverage, driver behavior, + and MLIR matcher coverage. +- Treat MLIR matcher absence as a reported status, not as runtime verification. + +## Validation + +Run `scripts/harness/validate-skills.sh` and `scripts/harness/cert-smoke.sh`. diff --git a/skills/lean-axiom-audit/SKILL.md b/skills/lean-axiom-audit/SKILL.md new file mode 100644 index 0000000..7da0ff0 --- /dev/null +++ b/skills/lean-axiom-audit/SKILL.md @@ -0,0 +1,18 @@ +# Lean Axiom Audit + +## When to use + +Use this skill when reviewing Lean proof files, theorem claims, `axiom`, or +`sorry` usage. + +## Procedure + +- Audit the actual dependency checkout, not just the Lake pin. +- Record exact files and command evidence under `reviews/PHASE-00/evidence/` + when the claim affects Phase 0. +- Do not treat dirty proof files as release evidence. + +## Validation + +Run `scripts/harness/validate-skills.sh` and +`scripts/harness/doctor.sh --mode exploratory`. diff --git a/skills/llzk-lean-dependency-audit/SKILL.md b/skills/llzk-lean-dependency-audit/SKILL.md new file mode 100644 index 0000000..2905f2d --- /dev/null +++ b/skills/llzk-lean-dependency-audit/SKILL.md @@ -0,0 +1,19 @@ +# llzk-lean Dependency Audit + +## When to use + +Use this skill when a task depends on `.lake/packages/VeIR`, the Lake pin, or +the workspace VeIR checkout. + +## Procedure + +- Start from `docs/harness/CURRENT.md` and `docs/harness/SOURCES.md`. +- Compare `lakefile.toml`, `lake-manifest.json`, and the actual dependency + checkout. +- Treat dirty dependency state as exploratory unless a phase explicitly accepts + it. + +## Validation + +Run `scripts/harness/doctor.sh` or +`scripts/harness/doctor.sh --mode exploratory`. diff --git a/skills/mlir-differential/SKILL.md b/skills/mlir-differential/SKILL.md new file mode 100644 index 0000000..e4ceb03 --- /dev/null +++ b/skills/mlir-differential/SKILL.md @@ -0,0 +1,16 @@ +# MLIR Differential + +## When to use + +Use this skill when running or reviewing Strategy A differential checks. + +## Procedure + +- Use `scripts/harness/diff-smoke.sh` for Phase 0 smoke status. +- Classify missing tools, parse failures, pass failures, semantic divergence, + and expected divergence separately. +- Do not treat a missing `llzk-opt` skip as coverage. + +## Validation + +Run `scripts/harness/validate-skills.sh` and `scripts/harness/diff-smoke.sh`. diff --git a/skills/phase-bootstrap/SKILL.md b/skills/phase-bootstrap/SKILL.md new file mode 100644 index 0000000..08db1f2 --- /dev/null +++ b/skills/phase-bootstrap/SKILL.md @@ -0,0 +1,19 @@ +# Phase Bootstrap + +## When to use + +Use this skill when creating or closing a phase bootstrap file. + +## Procedure + +- Start from `docs/phases/PHASE_TEMPLATE.md`. +- Update `docs/harness/CURRENT.md`, `docs/harness/SOURCES.md`, and + `docs/harness/GATES.md` with exact refs and dependency mode. +- Create `reviews//request.md`, `findings.md`, `disposition.md`, and + `evidence/`. + +## Validation + +Run `scripts/harness/check-doc-freshness.sh`, +`scripts/harness/validate-skills.sh`, and +`scripts/harness/doctor.sh --mode exploratory`. From 336a5a221ae79d00e5d1346e09341232bdc4323d Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Fri, 5 Jun 2026 21:55:11 +0100 Subject: [PATCH 04/16] Fix Phase 0 harness HEAD drift handling --- docs/harness/CURRENT.md | 9 ++- docs/harness/GATES.md | 4 +- reviews/PHASE-00/disposition.md | 3 + reviews/PHASE-00/evidence/cert-smoke.txt | 15 ++--- .../PHASE-00/evidence/check-doc-freshness.txt | 56 ++++++++--------- .../PHASE-00/evidence/dependency-status.txt | 9 +-- reviews/PHASE-00/evidence/diff-smoke.txt | 5 +- .../PHASE-00/evidence/doctor-exploratory.txt | 63 +++++++++---------- reviews/PHASE-00/evidence/doctor-strict.txt | 63 +++++++++---------- reviews/PHASE-00/evidence/validate-skills.txt | 45 +++++++------ .../evidence/workspace-doctor-exploratory.txt | 31 +++++++++ reviews/PHASE-00/findings.md | 16 +++++ scripts/harness/check-doc-freshness.sh | 1 + scripts/harness/doctor.sh | 8 +-- 14 files changed, 181 insertions(+), 147 deletions(-) create mode 100644 reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index e7ceb5e..24027c7 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -16,9 +16,12 @@ Last reviewed: 2026-06-05 - Lake `VeIR` dependency pin: `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. - Lake `VeIR` dependency checkout observed at: `09d5f00f0d2b`. -These refs are Phase 0 acceptance inputs. If any ref changes, update this file, -`docs/harness/SOURCES.md`, and review evidence before treating the harness as -current. +These refs are Phase 0 bootstrap inputs, not a self-referential pin on the +commit that contains this file. The doctor reports repository HEAD drift from +these inputs as a warning. Dependency pin mismatches and hidden dirty dependency +state remain hard failures. If a later phase relies on a newer ref for a +semantic claim, update this file, `docs/harness/SOURCES.md`, and review +evidence before treating that claim as current. ## Dependency Mode diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index bb18102..7e118ea 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -7,8 +7,8 @@ Last reviewed: 2026-06-05 | Gate | Command | Expected Phase 0 behavior | What it proves | |---|---|---|---| | Strict doctor | `scripts/harness/doctor.sh` | Fails while `.lake/packages/VeIR` is dirty | Dirty dependency state is not hidden | -| Exploratory doctor | `scripts/harness/doctor.sh --mode exploratory` | Passes with dirty-file warnings | Local investigation can continue with explicit dependency state | -| Workspace doctor | `scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir` | Passes if workspace VeIR is at the bootstrap ref | Companion repo state is explicit | +| Exploratory doctor | `scripts/harness/doctor.sh --mode exploratory` | Passes with warnings when only repo HEAD or dirty dependency state differs from bootstrap inputs | Local investigation can continue with explicit dependency state | +| Workspace doctor | `scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir` | Passes with warnings if workspace VeIR differs from the bootstrap input | Companion repo state is explicit | | Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when canonical docs and review disposition exist | Phase metadata and review state are present | | Differential smoke | `scripts/harness/diff-smoke.sh` | Exits 0 on real pass, 77 on missing `llzk-opt`, 1 on divergence, 2 on tool/parse/pass failure | Strategy A smoke status is classified | | Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds checker smoke binaries from source via CMake/CTest or direct `g++`, passes loader/schema smoke, and reports MLIR matcher active or absent | Strategy E smoke status is classified without pretending MLIR matching exists | diff --git a/reviews/PHASE-00/disposition.md b/reviews/PHASE-00/disposition.md index e3c18f6..71bce4f 100644 --- a/reviews/PHASE-00/disposition.md +++ b/reviews/PHASE-00/disposition.md @@ -16,3 +16,6 @@ Repository: llzk-lean CMake/CTest when available or direct `g++` otherwise. Prebuilt `checker/build` binaries require `CERT_SMOKE_ALLOW_PREBUILT=1` and are reported explicitly. +- L-P0-005: fixed. `scripts/harness/doctor.sh` now reports repository HEAD + drift from bootstrap inputs as a warning. Dependency pin mismatches and dirty + `.lake/packages/VeIR` state remain hard failures. diff --git a/reviews/PHASE-00/evidence/cert-smoke.txt b/reviews/PHASE-00/evidence/cert-smoke.txt index fc2ae9e..b29cddf 100644 --- a/reviews/PHASE-00/evidence/cert-smoke.txt +++ b/reviews/PHASE-00/evidence/cert-smoke.txt @@ -1,9 +1,6 @@ -Script started on 2026-06-05 20:26:26+01:00 [COMMAND="scripts/harness/cert-smoke.sh" ] -CERT-SMOKE: cmake/ctest unavailable; built checker from source with g++ -CERT-SMOKE: g++ schema/loader tests passed -CERT-SMOKE: theorem metadata present for 2/2 certs -CERT-SMOKE: driver cert summary passed -CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs -CERT-SMOKE: schema validation passed - -Script done on 2026-06-05 20:26:29+01:00 [COMMAND_EXIT_CODE="0"] +CERT-SMOKE: cmake/ctest unavailable; built checker from source with g++ +CERT-SMOKE: g++ schema/loader tests passed +CERT-SMOKE: theorem metadata present for 2/2 certs +CERT-SMOKE: driver cert summary passed +CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs +CERT-SMOKE: schema validation passed diff --git a/reviews/PHASE-00/evidence/check-doc-freshness.txt b/reviews/PHASE-00/evidence/check-doc-freshness.txt index ff17c26..b554ee4 100644 --- a/reviews/PHASE-00/evidence/check-doc-freshness.txt +++ b/reviews/PHASE-00/evidence/check-doc-freshness.txt @@ -1,30 +1,28 @@ -Script started on 2026-06-05 20:26:33+01:00 [COMMAND="scripts/harness/check-doc-freshness.sh" ] -PASS: found docs/phases/PHASE-00-harness-reset.md -PASS: found docs/phases/PHASE_TEMPLATE.md -PASS: found docs/harness/CURRENT.md -PASS: found docs/harness/SOURCES.md -PASS: found docs/harness/GATES.md -PASS: found docs/harness/REVIEWS.md -PASS: found reviews/PHASE-00/disposition.md -PASS: found reviews/PHASE-00/findings.md -PASS: found reviews/PHASE-00/request.md -PASS: found reviews/PHASE-00/adversarial-review.md -PASS: phase review date has ISO format -PASS: docs/harness/CURRENT.md review date agrees with phase -PASS: docs/harness/SOURCES.md review date agrees with phase -PASS: docs/harness/GATES.md review date agrees with phase -PASS: docs/harness/REVIEWS.md review date agrees with phase -PASS: CURRENT names active phase -PASS: SOURCES marks stale historical material -PASS: Phase 0 disposition exists -PASS: evidence present reviews/PHASE-00/evidence/doctor-strict.txt -PASS: evidence present reviews/PHASE-00/evidence/doctor-exploratory.txt -PASS: evidence present reviews/PHASE-00/evidence/validate-skills.txt -PASS: evidence present reviews/PHASE-00/evidence/diff-smoke.txt -PASS: evidence present reviews/PHASE-00/evidence/cert-smoke.txt -PASS: evidence present reviews/PHASE-00/evidence/dependency-status.txt -PASS: evidence present reviews/PHASE-00/evidence/adversarial-review.txt - -doc freshness summary: 0 fail +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: SOURCES marks stale historical material +PASS: Phase 0 disposition exists +PASS: evidence present reviews/PHASE-00/evidence/doctor-strict.txt +PASS: evidence present reviews/PHASE-00/evidence/doctor-exploratory.txt +PASS: evidence present reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt +PASS: evidence present reviews/PHASE-00/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-00/evidence/diff-smoke.txt +PASS: evidence present reviews/PHASE-00/evidence/cert-smoke.txt +PASS: evidence present reviews/PHASE-00/evidence/dependency-status.txt +PASS: evidence present reviews/PHASE-00/evidence/adversarial-review.txt -Script done on 2026-06-05 20:26:33+01:00 [COMMAND_EXIT_CODE="0"] +doc freshness summary: 0 fail diff --git a/reviews/PHASE-00/evidence/dependency-status.txt b/reviews/PHASE-00/evidence/dependency-status.txt index 093aaf4..2ffe0e9 100644 --- a/reviews/PHASE-00/evidence/dependency-status.txt +++ b/reviews/PHASE-00/evidence/dependency-status.txt @@ -1,6 +1,3 @@ -Script started on 2026-06-05 20:16:21+01:00 [COMMAND="git -C .lake/packages/VeIR status --short" ] - M Veir/Passes/Felt/Combine.lean - M Veir/Passes/Felt/Proofs.lean -?? Veir/Passes/Felt/RewriteLemmas.lean - -Script done on 2026-06-05 20:16:21+01:00 [COMMAND_EXIT_CODE="0"] + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean diff --git a/reviews/PHASE-00/evidence/diff-smoke.txt b/reviews/PHASE-00/evidence/diff-smoke.txt index 81c977d..4a83128 100644 --- a/reviews/PHASE-00/evidence/diff-smoke.txt +++ b/reviews/PHASE-00/evidence/diff-smoke.txt @@ -1,4 +1 @@ -Script started on 2026-06-05 20:26:23+01:00 [COMMAND="scripts/harness/diff-smoke.sh" ] -TOOL-MISSING: llzk-opt is not on PATH and LLZK_OPT is unset - -Script done on 2026-06-05 20:26:23+01:00 [COMMAND_EXIT_CODE="77"] +TOOL-MISSING: llzk-opt is not on PATH and LLZK_OPT is unset diff --git a/reviews/PHASE-00/evidence/doctor-exploratory.txt b/reviews/PHASE-00/evidence/doctor-exploratory.txt index d3aca80..176e11c 100644 --- a/reviews/PHASE-00/evidence/doctor-exploratory.txt +++ b/reviews/PHASE-00/evidence/doctor-exploratory.txt @@ -1,34 +1,31 @@ -Script started on 2026-06-05 20:26:13+01:00 [COMMAND="scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir" ] -PASS: tool git is available -PASS: tool lake is available -WARN: optional tool cmake is not available -WARN: optional tool ctest is not available -PASS: git root is /home/alh/LLZK/llzk-lean -PASS: llzk-lean HEAD matches ea2363f87bcc -PASS: Lake files pin VeIR 09d5f00f0d2b -PASS: dependency checkout is at 09d5f00f0d2b -WARN: dependency checkout is dirty in exploratory mode: - M Veir/Passes/Felt/Combine.lean - M Veir/Passes/Felt/Proofs.lean -?? Veir/Passes/Felt/RewriteLemmas.lean -PASS: workspace VeIR HEAD matches 4b0978bddec0 -PASS: found AGENTS.md -PASS: found docs/phases/PHASE-00-harness-reset.md -PASS: found docs/phases/PHASE_TEMPLATE.md -PASS: found docs/harness/CURRENT.md -PASS: found docs/harness/SOURCES.md -PASS: found docs/harness/GATES.md -PASS: found docs/harness/REVIEWS.md -PASS: found reviews/PHASE-00/request.md -PASS: found reviews/PHASE-00/findings.md -PASS: found reviews/PHASE-00/disposition.md -PASS: found reviews/PHASE-00/adversarial-review.md -PASS: executable scripts/harness/check-doc-freshness.sh -PASS: executable scripts/harness/diff-smoke.sh -PASS: executable scripts/harness/cert-smoke.sh -PASS: executable scripts/harness/validate-skills.sh -PASS: found reviews/PHASE-00/evidence - -doctor summary: 0 fail, 3 warn, mode=exploratory +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +WARN: llzk-lean HEAD 34cbe65907bf differs from bootstrap input ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +WARN: dependency checkout is dirty in exploratory mode: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +WARN: workspace VeIR repo was not checked; pass --workspace-veir PATH +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence -Script done on 2026-06-05 20:26:13+01:00 [COMMAND_EXIT_CODE="0"] +doctor summary: 0 fail, 5 warn, mode=exploratory diff --git a/reviews/PHASE-00/evidence/doctor-strict.txt b/reviews/PHASE-00/evidence/doctor-strict.txt index b210f0c..7dd79be 100644 --- a/reviews/PHASE-00/evidence/doctor-strict.txt +++ b/reviews/PHASE-00/evidence/doctor-strict.txt @@ -1,34 +1,31 @@ -Script started on 2026-06-05 20:26:09+01:00 [COMMAND="scripts/harness/doctor.sh" ] -PASS: tool git is available -PASS: tool lake is available -WARN: optional tool cmake is not available -WARN: optional tool ctest is not available -PASS: git root is /home/alh/LLZK/llzk-lean -PASS: llzk-lean HEAD matches ea2363f87bcc -PASS: Lake files pin VeIR 09d5f00f0d2b -PASS: dependency checkout is at 09d5f00f0d2b -FAIL: dependency checkout is dirty: - M Veir/Passes/Felt/Combine.lean - M Veir/Passes/Felt/Proofs.lean -?? Veir/Passes/Felt/RewriteLemmas.lean -WARN: workspace VeIR repo was not checked; pass --workspace-veir PATH -PASS: found AGENTS.md -PASS: found docs/phases/PHASE-00-harness-reset.md -PASS: found docs/phases/PHASE_TEMPLATE.md -PASS: found docs/harness/CURRENT.md -PASS: found docs/harness/SOURCES.md -PASS: found docs/harness/GATES.md -PASS: found docs/harness/REVIEWS.md -PASS: found reviews/PHASE-00/request.md -PASS: found reviews/PHASE-00/findings.md -PASS: found reviews/PHASE-00/disposition.md -PASS: found reviews/PHASE-00/adversarial-review.md -PASS: executable scripts/harness/check-doc-freshness.sh -PASS: executable scripts/harness/diff-smoke.sh -PASS: executable scripts/harness/cert-smoke.sh -PASS: executable scripts/harness/validate-skills.sh -PASS: found reviews/PHASE-00/evidence - -doctor summary: 1 fail, 3 warn, mode=strict +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +WARN: llzk-lean HEAD 34cbe65907bf differs from bootstrap input ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +FAIL: dependency checkout is dirty: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +WARN: workspace VeIR repo was not checked; pass --workspace-veir PATH +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence -Script done on 2026-06-05 20:26:09+01:00 [COMMAND_EXIT_CODE="1"] +doctor summary: 1 fail, 4 warn, mode=strict diff --git a/reviews/PHASE-00/evidence/validate-skills.txt b/reviews/PHASE-00/evidence/validate-skills.txt index 0a36389..3e6aaec 100644 --- a/reviews/PHASE-00/evidence/validate-skills.txt +++ b/reviews/PHASE-00/evidence/validate-skills.txt @@ -1,25 +1,22 @@ -Script started on 2026-06-05 20:26:19+01:00 [COMMAND="scripts/harness/validate-skills.sh" ] -PASS: skills/cert-checker-review/SKILL.md has title -PASS: skills/cert-checker-review/SKILL.md has usage trigger -PASS: skills/cert-checker-review/SKILL.md has validation path -PASS: skills/cert-checker-review/SKILL.md points at harness scripts -PASS: skills/lean-axiom-audit/SKILL.md has title -PASS: skills/lean-axiom-audit/SKILL.md has usage trigger -PASS: skills/lean-axiom-audit/SKILL.md has validation path -PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts -PASS: skills/llzk-lean-dependency-audit/SKILL.md has title -PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger -PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path -PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts -PASS: skills/mlir-differential/SKILL.md has title -PASS: skills/mlir-differential/SKILL.md has usage trigger -PASS: skills/mlir-differential/SKILL.md has validation path -PASS: skills/mlir-differential/SKILL.md points at harness scripts -PASS: skills/phase-bootstrap/SKILL.md has title -PASS: skills/phase-bootstrap/SKILL.md has usage trigger -PASS: skills/phase-bootstrap/SKILL.md has validation path -PASS: skills/phase-bootstrap/SKILL.md points at harness scripts - -skill validation summary: 0 fail over 5 skills +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts -Script done on 2026-06-05 20:26:19+01:00 [COMMAND_EXIT_CODE="0"] +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt b/reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt new file mode 100644 index 0000000..c06c1ef --- /dev/null +++ b/reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt @@ -0,0 +1,31 @@ +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +WARN: llzk-lean HEAD 34cbe65907bf differs from bootstrap input ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +WARN: dependency checkout is dirty in exploratory mode: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +WARN: workspace VeIR HEAD 66413edb9bfa differs from bootstrap input 4b0978bddec0 +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence + +doctor summary: 0 fail, 5 warn, mode=exploratory diff --git a/reviews/PHASE-00/findings.md b/reviews/PHASE-00/findings.md index b5804ee..61b1560 100644 --- a/reviews/PHASE-00/findings.md +++ b/reviews/PHASE-00/findings.md @@ -52,3 +52,19 @@ are weak evidence unless explicitly requested. Evidence: - `reviews/PHASE-00/evidence/cert-smoke.txt` + +### L-P0-005: Doctor treated bootstrap commit refs as immutable current HEADs + +Severity: High + +After Phase 0 was committed, `scripts/harness/doctor.sh` failed in both strict +and exploratory mode because the current llzk-lean and workspace VeIR HEADs no +longer matched the pre-Phase-0 bootstrap refs. A committed script cannot +reliably require its repository HEAD to equal a literal hash stored inside that +same commit. The harness should report HEAD drift, while keeping dependency pin +and dirty-state checks as hard failures. + +Evidence: + +- Direct rerun of `scripts/harness/doctor.sh` on 2026-06-05 after the Phase 0 + commit. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index e97e970..2906216 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -71,6 +71,7 @@ fi for evidence in \ reviews/PHASE-00/evidence/doctor-strict.txt \ reviews/PHASE-00/evidence/doctor-exploratory.txt \ + reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt \ reviews/PHASE-00/evidence/validate-skills.txt \ reviews/PHASE-00/evidence/diff-smoke.txt \ reviews/PHASE-00/evidence/cert-smoke.txt \ diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh index a8e3115..156457f 100755 --- a/scripts/harness/doctor.sh +++ b/scripts/harness/doctor.sh @@ -118,9 +118,9 @@ fi head_short="$(git -C "$ROOT" rev-parse --short=12 HEAD 2>/dev/null || true)" if [[ "$head_short" == "$EXPECTED_LLZK_LEAN_HEAD" ]]; then - ok "llzk-lean HEAD matches ${EXPECTED_LLZK_LEAN_HEAD}" + ok "llzk-lean HEAD matches bootstrap input ${EXPECTED_LLZK_LEAN_HEAD}" else - fail "llzk-lean HEAD ${head_short:-} does not match bootstrap ${EXPECTED_LLZK_LEAN_HEAD}" + warn "llzk-lean HEAD ${head_short:-} differs from bootstrap input ${EXPECTED_LLZK_LEAN_HEAD}" fi if grep -q "$EXPECTED_VEIR_DEP" "${ROOT}/lakefile.toml" && @@ -160,9 +160,9 @@ if [[ -n "$WORKSPACE_VEIR" ]]; then else workspace_head="$(git -C "$workspace" rev-parse --short=12 HEAD 2>/dev/null || true)" if [[ "$workspace_head" == "$EXPECTED_WORKSPACE_VEIR_HEAD" ]]; then - ok "workspace VeIR HEAD matches ${EXPECTED_WORKSPACE_VEIR_HEAD}" + ok "workspace VeIR HEAD matches bootstrap input ${EXPECTED_WORKSPACE_VEIR_HEAD}" else - fail "workspace VeIR HEAD ${workspace_head:-} does not match ${EXPECTED_WORKSPACE_VEIR_HEAD}" + warn "workspace VeIR HEAD ${workspace_head:-} differs from bootstrap input ${EXPECTED_WORKSPACE_VEIR_HEAD}" fi fi else From 6b4a7ec3aa38e2da7e1de23fb347b5c2cbac6386 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Fri, 5 Jun 2026 21:58:21 +0100 Subject: [PATCH 05/16] Bootstrap Phase 1 reproducible pins --- docs/phases/PHASE-01-pins-and-repro.md | 87 ++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 docs/phases/PHASE-01-pins-and-repro.md diff --git a/docs/phases/PHASE-01-pins-and-repro.md b/docs/phases/PHASE-01-pins-and-repro.md new file mode 100644 index 0000000..336eb83 --- /dev/null +++ b/docs/phases/PHASE-01-pins-and-repro.md @@ -0,0 +1,87 @@ +# Phase 1: Reproducible Pins + +Status: bootstrap +Last reviewed: 2026-06-05 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-01-pins-and-repro.md + +## Objective + +Make llzk-lean's VeIR dependency clean, explicit, and reproducible. + +At the end of this phase, `lakefile.toml`, `lake-manifest.json`, and +`.lake/packages/VeIR` must all identify the same accepted VeIR commit, and the +dependency checkout must be clean. + +## Starting State + +- llzk-lean HEAD at Phase 1 bootstrap: + `336a5a221ae79d00e5d1346e09341232bdc4323d`. +- workspace veir HEAD at Phase 1 bootstrap: + `039068b68552bb37f1a887ec509e9b9111d4d54a`. +- Lake files currently pin VeIR to: + `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. +- `.lake/packages/VeIR` is currently at: + `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. +- `.lake/packages/VeIR` is currently dirty: + - modified `Veir/Passes/Felt/Combine.lean` + - modified `Veir/Passes/Felt/Proofs.lean` + - untracked `Veir/Passes/Felt/RewriteLemmas.lean` +- Phase 0 strict doctor intentionally fails on this dirty state. + +## Non-Goals + +- Do not port additional Felt operations. +- Do not change Lean theorem statements except as needed to make the dependency + pin build cleanly. +- Do not make Strategy A or Strategy E acceptance claims. +- Do not use `--mode exploratory` output as acceptance evidence. + +## Artifacts To Create Or Update + +- `docs/harness/CURRENT.md`: record Phase 1 as active once implementation + starts, and list the accepted VeIR pin mode. +- `docs/harness/SOURCES.md`: add the accepted VeIR commit, remote URL, and the + evidence that the dependency checkout is clean. +- `docs/harness/GATES.md`: add reproducible-pin gates. +- `docs/harness/PINS.md`: document the intended VeIR rev, update procedure, + rollback procedure, and what constitutes forbidden hidden state. +- `lakefile.toml`: update the `VeIR` rev deliberately after selecting the + accepted commit. +- `lake-manifest.json`: update consistently with `lakefile.toml`. +- `.lake/packages/VeIR`: refresh to the accepted clean commit. +- `scripts/harness/verify-pins.sh`: verify Lake file agreement, dependency HEAD, + dependency cleanliness, and optional workspace VeIR agreement. +- `reviews/PHASE-01/{request.md,findings.md,disposition.md,evidence/}`: + adversarial review workspace for the pin transition. + +## Gates To Implement + +- `scripts/harness/verify-pins.sh` fails in the current starting state because + `.lake/packages/VeIR` is dirty. +- `scripts/harness/doctor.sh` passes in strict mode only after the dependency + checkout is clean and at the accepted rev. +- `git -C .lake/packages/VeIR status --short` is empty. +- `git -C .lake/packages/VeIR rev-parse HEAD` equals both the `lakefile.toml` + rev and the `lake-manifest.json` rev. +- If `../veir` is supplied, its HEAD equals the accepted rev or the mismatch is + explicitly documented as a non-acceptance exploratory layout. +- `lake build` succeeds against the clean dependency. + +## Review Requirements + +- Capture exact command output under `reviews/PHASE-01/evidence/`. +- Review must include the Lake file diff, dependency checkout HEAD, dependency + cleanliness, and the result of `lake build`. +- Review must explicitly reject any proof state that only exists in a dirty + `.lake/packages/VeIR` checkout. +- Disposition every finding before closing the phase. + +## Done Criteria + +- `lakefile.toml` and `lake-manifest.json` pin the same accepted VeIR commit. +- `.lake/packages/VeIR` is clean and at that commit. +- `scripts/harness/verify-pins.sh` passes. +- `scripts/harness/doctor.sh` passes in strict mode. +- `lake build` succeeds without relying on dirty dependency files. +- Phase 1 review artifacts exist and contain fresh evidence. From 617702beadfbad6be784945e2bd98e8a788d357c Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Sat, 6 Jun 2026 02:02:16 +0100 Subject: [PATCH 06/16] Phase 2 LLZK source truth --- EmitCerts.lean | 2 +- LlzkLean/Cert.lean | 46 ++- LlzkLean/CertValidate.lean | 12 +- README.md | 12 +- certs/felt-combine.cert.json | 4 +- checker/src/CertChecker.cpp | 5 +- checker/src/CertChecker.h | 9 +- docs/README.md | 11 + docs/REVIEW.md | 92 ++++-- docs/harness/CURRENT.md | 95 +++--- docs/harness/GATES.md | 63 +++- docs/harness/LLZK_SOURCE.md | 92 ++++++ docs/harness/PINS.md | 74 +++++ docs/harness/REVIEWS.md | 2 +- docs/harness/SOURCES.md | 59 ++-- docs/phases/PHASE-01-pins-and-repro.md | 20 +- docs/phases/PHASE-02-llzk-source-truth.md | 120 +++++++ docs/strategy-a-oracle.md | 102 +++--- docs/strategy-e-certificates.md | 10 +- lake-manifest.json | 4 +- lakefile.toml | 14 +- reviews/PHASE-01/adversarial-review.md | 25 ++ reviews/PHASE-01/disposition.md | 64 ++++ .../evidence/adversarial-inputrev-after.txt | 16 + .../PHASE-01/evidence/adversarial-review.txt | 25 ++ .../evidence/adversarial-url-spoof-after.txt | 16 + .../PHASE-01/evidence/check-doc-freshness.txt | 34 ++ .../evidence/dependency-dirty-diff.txt | 157 +++++++++ .../evidence/dependency-ref-after.txt | 1 + .../evidence/dependency-ref-before.txt | 1 + .../evidence/dependency-status-after.txt | 1 + .../evidence/dependency-status-before.txt | 3 + ...ependency-untracked-RewriteLemmas.head.txt | 260 +++++++++++++++ .../PHASE-01/evidence/doctor-strict-after.txt | 48 +++ .../evidence/doctor-strict-before.txt | 31 ++ reviews/PHASE-01/evidence/lake-build.txt | 37 +++ reviews/PHASE-01/evidence/lake-pin-diff.txt | 30 ++ .../PHASE-01/evidence/local-ref-before.txt | 1 + .../PHASE-01/evidence/repo-status-before.txt | 1 + reviews/PHASE-01/evidence/validate-skills.txt | 22 ++ .../PHASE-01/evidence/verify-pins-after.txt | 15 + .../PHASE-01/evidence/verify-pins-before.txt | 14 + reviews/PHASE-01/findings.md | 94 ++++++ reviews/PHASE-01/request.md | 23 ++ reviews/PHASE-02/adversarial-review.md | 44 +++ reviews/PHASE-02/disposition.md | 15 + reviews/PHASE-02/evidence/README.md | 13 + .../PHASE-02/evidence/adversarial-review.txt | 44 +++ .../PHASE-02/evidence/lake-build-after.txt | 37 +++ reviews/PHASE-02/evidence/llzk-felt-ops.txt | 261 +++++++++++++++ .../PHASE-02/evidence/llzk-field-registry.txt | 312 ++++++++++++++++++ reviews/PHASE-02/evidence/llzk-lib-refs.txt | 2 + .../evidence/verify-llzk-source-after.txt | 65 ++++ .../PHASE-02/evidence/verify-pins-after.txt | 15 + reviews/PHASE-02/findings.md | 52 +++ reviews/PHASE-02/request.md | 10 + scripts/harness/check-doc-freshness.sh | 79 +++-- scripts/harness/doctor.sh | 91 +++-- scripts/harness/verify-llzk-source.sh | 261 +++++++++++++++ scripts/harness/verify-pins.sh | 236 +++++++++++++ 60 files changed, 3004 insertions(+), 300 deletions(-) create mode 100644 docs/harness/LLZK_SOURCE.md create mode 100644 docs/harness/PINS.md create mode 100644 docs/phases/PHASE-02-llzk-source-truth.md create mode 100644 reviews/PHASE-01/adversarial-review.md create mode 100644 reviews/PHASE-01/disposition.md create mode 100644 reviews/PHASE-01/evidence/adversarial-inputrev-after.txt create mode 100644 reviews/PHASE-01/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-01/evidence/adversarial-url-spoof-after.txt create mode 100644 reviews/PHASE-01/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-01/evidence/dependency-dirty-diff.txt create mode 100644 reviews/PHASE-01/evidence/dependency-ref-after.txt create mode 100644 reviews/PHASE-01/evidence/dependency-ref-before.txt create mode 100644 reviews/PHASE-01/evidence/dependency-status-after.txt create mode 100644 reviews/PHASE-01/evidence/dependency-status-before.txt create mode 100644 reviews/PHASE-01/evidence/dependency-untracked-RewriteLemmas.head.txt create mode 100644 reviews/PHASE-01/evidence/doctor-strict-after.txt create mode 100644 reviews/PHASE-01/evidence/doctor-strict-before.txt create mode 100644 reviews/PHASE-01/evidence/lake-build.txt create mode 100644 reviews/PHASE-01/evidence/lake-pin-diff.txt create mode 100644 reviews/PHASE-01/evidence/local-ref-before.txt create mode 100644 reviews/PHASE-01/evidence/repo-status-before.txt create mode 100644 reviews/PHASE-01/evidence/validate-skills.txt create mode 100644 reviews/PHASE-01/evidence/verify-pins-after.txt create mode 100644 reviews/PHASE-01/evidence/verify-pins-before.txt create mode 100644 reviews/PHASE-01/findings.md create mode 100644 reviews/PHASE-01/request.md create mode 100644 reviews/PHASE-02/adversarial-review.md create mode 100644 reviews/PHASE-02/disposition.md create mode 100644 reviews/PHASE-02/evidence/README.md create mode 100644 reviews/PHASE-02/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-02/evidence/lake-build-after.txt create mode 100644 reviews/PHASE-02/evidence/llzk-felt-ops.txt create mode 100644 reviews/PHASE-02/evidence/llzk-field-registry.txt create mode 100644 reviews/PHASE-02/evidence/llzk-lib-refs.txt create mode 100644 reviews/PHASE-02/evidence/verify-llzk-source-after.txt create mode 100644 reviews/PHASE-02/evidence/verify-pins-after.txt create mode 100644 reviews/PHASE-02/findings.md create mode 100644 reviews/PHASE-02/request.md create mode 100755 scripts/harness/verify-llzk-source.sh create mode 100755 scripts/harness/verify-pins.sh diff --git a/EmitCerts.lean b/EmitCerts.lean index 34673b0..84c0849 100644 --- a/EmitCerts.lean +++ b/EmitCerts.lean @@ -92,7 +92,7 @@ def jsonHeader (certCount : Nat) : String := s!"\{\n \"schemaVersion\": \"0.2.0\",\n \ \"source\": \"VEIR Veir.Passes.Felt.Combine (stub catalog — {certCount} of 15 patterns)\",\n \ \"_note\": \"Hand-listed catalog. The full 15-pattern catalog will be derived reflectively from VEIR's Veir.Passes.Felt.Combine; today's source is LlzkLean.Cert.feltCombineCatalog.\",\n \ -\"_aboutLlzkParityStatus\": \"Per-cert tag indicating how a VEIR rewrite relates to LLZK's runtime: 'aligned' = LLZK performs the same rewrite exactly; 'aligned-with-caveats' = LLZK performs it under additional conditions (e.g. modular reduction, field-name guard); 'veir-only' = LLZK has no matching fold or canonicalization pattern, the cert is a Lean-side soundness statement only. The C++ checker uses this to pick assertion polarity.\",\n \ +\"_aboutLlzkParityStatus\": \"Per-cert tag indicating how a VEIR rewrite relates to LLZK's runtime: 'aligned' = LLZK performs the same rewrite exactly; 'aligned-with-caveats' = LLZK performs it under additional source-specific conditions; 'veir-only' = LLZK has no matching fold or canonicalization pattern, the cert is a Lean-side soundness statement only. The C++ checker uses this to pick assertion polarity.\",\n \ \"certs\": [\n " def main : IO Unit := do diff --git a/LlzkLean/Cert.lean b/LlzkLean/Cert.lean index c7d34f1..c6b6b16 100644 --- a/LlzkLean/Cert.lean +++ b/LlzkLean/Cert.lean @@ -255,14 +255,13 @@ def Cert.mk' (patternId : String) (rootKind : String) -/ def feltCombineCatalog : List Cert := [ -- VEIR-side soundness claim with no current LLZK counterpart. - -- LLZK's `AddFeltOp::fold` (lib/Dialect/Felt/IR/Ops.cpp:141-149) - -- only folds when *both* operands are FeltConstAttrs with - -- matching, registered field names; LLZK registers no - -- canonicalization patterns for AddFeltOp. So this cert is a - -- VEIR-only soundness statement, not a contract on LLZK runtime - -- behavior. Strategy-E's checker should treat veir-only certs as - -- informational (label them in --verify-rewrites output, do not - -- assert LLZK ever exhibits the rewrite). + -- LLZK's `AddFeltOp::fold` only folds when *both* operands are + -- FeltConstAttrs with matching, registered field names; LLZK + -- registers no canonicalization patterns for AddFeltOp. So this + -- cert is a VEIR-only soundness statement, not a contract on LLZK + -- runtime behavior. Strategy-E's checker should treat veir-only + -- certs as informational (label them in --verify-rewrites output, + -- do not assert LLZK ever exhibits the rewrite). -- v0.2.0: `.const "felt.const" (some 0)` pins the literal value -- in the shape itself rather than via a separate constEquals -- condition. `commutative := true` flags felt.add as @@ -276,26 +275,19 @@ def feltCombineCatalog : List Cert := [ (conditions := []) (llzkParityStatus := .veirOnly) (description := "felt.add x (felt.const 0) → x. Sound over any ZMod p."), - -- LLZK does this fold (Ops.cpp:141-149) but with two caveats VEIR - -- doesn't share today: + -- LLZK does this fold but with two caveats VEIR doesn't fully + -- share today: -- (a) LLZK short-circuits unless both operands have a registered - -- field name (tryGetBinaryFoldData, Ops.cpp:57-79); VEIR's - -- fold has no field-name guard. - -- (b) LLZK applies modular reduction (field->reduce); VEIR's - -- implementation stores c1+c2 as an unreduced Int. - -- Both gaps are tracked in VEIR's FELT_PARITY_ASSESSMENT. + -- field name (`tryGetBinaryFoldData` in + -- lib/Dialect/Felt/IR/Ops.cpp); VEIR now guards equal field + -- types, but does not model LLZK's registry membership check. + -- (b) LLZK applies modular reduction (`Field::reduce` in + -- lib/Util/Field.cpp); VEIR's implementation stores c1+c2 as + -- an unreduced Int. -- v0.2.0 expresses LLZK's actual fold conditions structurally: - -- - both operands' fieldName attrs must match (sameAttr) — - -- this is `lhsFieldName == rhsFieldName` in - -- llzk-lib/lib/Dialect/Felt/IR/Ops.cpp:66 - -- - the shared fieldName must resolve in LLZK's Field - -- registry (attrInRegistry) — i.e. Field::tryGetField at - -- Ops.cpp:70-73 succeeds - -- With these conditions in place, this cert correctly describes - -- LLZK's fold *when the inputs are named-field*. (For unnamed - -- !felt.type operands LLZK still short-circuits to a no-op; - -- VEIR's fold fires unconditionally — that gap remains and - -- requires the Field-registry parity work on the VEIR side.) + -- - both operands' fieldName attrs must match (sameAttr) + -- - the shared fieldName must resolve in LLZK's Field registry + -- (attrInRegistry) Cert.mk' (patternId := "constant_fold_add") (rootKind := "felt.add") @@ -306,7 +298,7 @@ def feltCombineCatalog : List Cert := [ .attrInRegistry "lhs" "fieldName" "field" ]) (llzkParityStatus := .alignedWithCaveats) - (description := "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (field->reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned.") + (description := "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (Field::reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned.") -- TODO: derive the remaining 13 entries from -- Veir.Passes.Felt.Combine reflectively. Hand-listed here as -- stub-quality scaffolding — the real emitter walks the Lean diff --git a/LlzkLean/CertValidate.lean b/LlzkLean/CertValidate.lean index 57274e4..de7a138 100644 --- a/LlzkLean/CertValidate.lean +++ b/LlzkLean/CertValidate.lean @@ -87,12 +87,20 @@ elab "#assertCatalogCoverage" : command => do -- - `Combine.impl` — the pass body (compound name; filtered -- by the `Name.str parent baseName` pattern only matching -- single-segment names below the namespace). + -- - `projectToOperand`, `replaceWithNewOp`, and + -- `replaceWithBinOpOfConst` — shared rewrite tails used by the + -- verified patterns, not standalone rewrite patterns. -- A rewrite pattern's base name doesn't start with `match` or - -- `Combine` and isn't an internal `_*` name. + -- `Combine`, isn't an internal `_*` name, and isn't one of those + -- shared helper tails. let isHelper := baseName.startsWith "match" let isPass := baseName == "Combine" let isInternal := baseName.startsWith "_" - if parent == nsPrefix && !isHelper && !isPass && !isInternal then + let isRewriteTailHelper := + baseName == "projectToOperand" || + baseName == "replaceWithNewOp" || + baseName == "replaceWithBinOpOfConst" + if parent == nsPrefix && !isHelper && !isPass && !isInternal && !isRewriteTailHelper then veirPatternIds := baseName :: veirPatternIds | _, _ => pure () let catalogIds := feltCombineCatalog.map (·.patternId) diff --git a/README.md b/README.md index 3845444..82140cb 100644 --- a/README.md +++ b/README.md @@ -25,9 +25,10 @@ LLZK's Felt dialect: actual MLIR rewrites conform to the catalog at runtime, keeping Lean and Mathlib out of LLZK's runtime trusted base. -The 15 verified Felt-dialect rewrites the catalog references live in -VEIR on the [`llzkfelt_test1`](https://github.com/project-llzk/veir/tree/llzkfelt_test1) -branch. +The current proof basis is the clean VEIR commit +[`d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`](docs/harness/PINS.md), +selected from `project-llzk/veir` branch `felt-review-structural-close` +and pinned through Lake metadata. ## Repository contents @@ -49,6 +50,11 @@ documented under [`docs/`](docs/): A design + harness usage. - [`docs/strategy-e-certificates.md`](docs/strategy-e-certificates.md) — Strategy E cert format, lifecycle, and checker design. +- [`docs/harness/PINS.md`](docs/harness/PINS.md) — current accepted + VEIR pin, update procedure, rollback procedure, and forbidden hidden + dependency state. +- [`docs/harness/CURRENT.md`](docs/harness/CURRENT.md) — active + phase and acceptance rule for the harness. - [`docs/future-b-extraction.md`](docs/future-b-extraction.md) — Future: extract VEIR's verified rewriter to C++. - [`docs/future-c-drop-in.md`](docs/future-c-drop-in.md) — Future: diff --git a/certs/felt-combine.cert.json b/certs/felt-combine.cert.json index 11750e2..fbcfcf3 100644 --- a/certs/felt-combine.cert.json +++ b/certs/felt-combine.cert.json @@ -2,9 +2,9 @@ "schemaVersion": "0.2.0", "source": "VEIR Veir.Passes.Felt.Combine (stub catalog — 2 of 15 patterns)", "_note": "Hand-listed catalog. The full 15-pattern catalog will be derived reflectively from VEIR's Veir.Passes.Felt.Combine; today's source is LlzkLean.Cert.feltCombineCatalog.", - "_aboutLlzkParityStatus": "Per-cert tag indicating how a VEIR rewrite relates to LLZK's runtime: 'aligned' = LLZK performs the same rewrite exactly; 'aligned-with-caveats' = LLZK performs it under additional conditions (e.g. modular reduction, field-name guard); 'veir-only' = LLZK has no matching fold or canonicalization pattern, the cert is a Lean-side soundness statement only. The C++ checker uses this to pick assertion polarity.", + "_aboutLlzkParityStatus": "Per-cert tag indicating how a VEIR rewrite relates to LLZK's runtime: 'aligned' = LLZK performs the same rewrite exactly; 'aligned-with-caveats' = LLZK performs it under additional source-specific conditions; 'veir-only' = LLZK has no matching fold or canonicalization pattern, the cert is a Lean-side soundness statement only. The C++ checker uses this to pick assertion polarity.", "certs": [ {"patternId":"right_identity_zero_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"any"},{"kind":"const","opKind":"felt.const","value":0}],"commutative":true},"rhs":{"kind":"any"},"conditions":[],"theoremName":"Veir.Data.Felt.right_identity_zero_add","llzkParityStatus":"veir-only","description":"felt.add x (felt.const 0) → x. Sound over any ZMod p."}, - {"patternId":"constant_fold_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"const","opKind":"felt.const"},{"kind":"const","opKind":"felt.const"}],"commutative":true},"rhs":{"kind":"const","opKind":"felt.const"},"conditions":[{"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]},{"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"}],"theoremName":"Veir.Data.Felt.constant_fold_add","llzkParityStatus":"aligned-with-caveats","description":"felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (field->reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned."} + {"patternId":"constant_fold_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"const","opKind":"felt.const"},{"kind":"const","opKind":"felt.const"}],"commutative":true},"rhs":{"kind":"const","opKind":"felt.const"},"conditions":[{"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]},{"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"}],"theoremName":"Veir.Data.Felt.constant_fold_add","llzkParityStatus":"aligned-with-caveats","description":"felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (Field::reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned."} ] } diff --git a/checker/src/CertChecker.cpp b/checker/src/CertChecker.cpp index a4c10fd..a4a8ec7 100644 --- a/checker/src/CertChecker.cpp +++ b/checker/src/CertChecker.cpp @@ -566,8 +566,9 @@ class DefaultMatcher : public Matcher { // - ConstEquals: resolve `pos`, check it's a constant of expected value. // - SameAttr: resolve each position, extract named attribute, compare. // - AttrInRegistry: resolve `pos`, extract attr, check against - // a hardcoded LLZK Field registry (initial: the six built-in - // fields {bn128, bn254, babybear, goldilocks, mersenne31, + // the accepted LLZK Field registry (Phase 2 source: + // lib/Util/Field.cpp at llzk-lib db922857bc5a; built-ins + // {bn128, bn254, grumpkin, babybear, goldilocks, mersenne31, // koalabear}). Pluggable registries are a v0.3 feature. // - ConstCompare: like ConstEquals, with CompareOp dispatch. // - ResultTypeFromOperand: resolve `pos`, compare mlir::Type. diff --git a/checker/src/CertChecker.h b/checker/src/CertChecker.h index 48fca9f..5939525 100644 --- a/checker/src/CertChecker.h +++ b/checker/src/CertChecker.h @@ -88,8 +88,8 @@ enum class LlzkParityStatus { /// LLZK performs exactly this rewrite, same canonical output as the /// Lean spec. checkRewrite asserts LLZK's transformation matches. Aligned, - /// LLZK performs this rewrite under additional conditions the Lean - /// spec doesn't impose (e.g. field-name guard, modular reduction). + /// LLZK performs this rewrite under additional source-specific + /// conditions the Lean spec doesn't impose. /// checkRewrite asserts match-modulo-caveat; full alignment is a /// future-work item tracked per pattern. AlignedWithCaveats, @@ -167,9 +167,8 @@ std::optional loadCertCatalog(const std::string &path, /// AlignedWithCaveats cert — no caveat was needed). /// - `matchedParity == AlignedWithCaveats` + `caveatTriggered == true`: /// LHS + conditions matched but LLZK's replacement differs from -/// the cert's RHS shape. The cert acknowledges this can happen -/// (e.g., LLZK applies field->reduce; VEIR doesn't); the -/// `caveatTriggered` flag surfaces the divergence in the pass +/// the cert's RHS shape. The cert acknowledges this can happen; +/// the `caveatTriggered` flag surfaces the divergence in the pass /// diagnostics. /// /// `accepted == false` means no cert matched. `rejectReason` is a diff --git a/docs/README.md b/docs/README.md index a74255e..8863589 100644 --- a/docs/README.md +++ b/docs/README.md @@ -14,6 +14,17 @@ LLZK maintainers. Per-rewrite cert emission from Lean + structural validation in C++. Requires upstream PR. +## Current harness state + +- [Harness current state](harness/CURRENT.md). Active phase, accepted VEIR pin, + and acceptance rule. +- [Dependency pins](harness/PINS.md). Exact VEIR commit, allowed modes, update + procedure, rollback procedure, and forbidden hidden state. +- [Harness gates](harness/GATES.md). Strict checks required before claiming + Phase 1 acceptance. +- [Phase 1 — reproducible pins](phases/PHASE-01-pins-and-repro.md). Current + phase plan and review requirements. + ## Documented future options - [Strategy F — Folders-only replacement](future-f-folders-only.md). diff --git a/docs/REVIEW.md b/docs/REVIEW.md index 522ac26..f33ab89 100644 --- a/docs/REVIEW.md +++ b/docs/REVIEW.md @@ -1,6 +1,7 @@ # llzk-lean — Independent Review: Status & Findings -> **Status:** in progress. Last updated 2026-06-02 (F1: joint 2 closed — see §3). +> **Status:** in progress. Last updated 2026-06-05 (Phase 1 reproducible pins +> active; accepted VEIR pin recorded below). > **Reviewer note:** This is an independent, adversarial review conducted at > the maintainer's request, aimed at making the work's guarantees, tradeoffs, > and caveats legible — especially to readers who are *not* Lean experts. @@ -10,6 +11,34 @@ --- +## 0. Phase 1 update — reproducible proof basis (2026-06-05) + +The current accepted VEIR proof basis is +`project-llzk/veir@d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, selected from +branch `felt-review-structural-close` and documented in +`docs/harness/PINS.md`. `lakefile.toml`, `lake-manifest.json`, and +`.lake/packages/VeIR` are now expected to agree on that commit and on the +accepted remote URL; the manifest `type`, `rev`, and `inputRev` are checked by +`scripts/harness/verify-pins.sh`. + +Current Phase 1 evidence establishes: + +- the dependency checkout is clean and at the accepted commit; +- `lake build` succeeds against that clean dependency; +- the Lean catalog scan sees 15 Felt pattern definitions, with 2 covered by the + hand-authored certificate catalog and 13 intentionally reported as uncovered; +- all 15 VEIR Felt patterns remain structurally sorry-free and axiom-clean under + the accepted pin. + +This closes the old H4 stale-manifest risk. It does **not** close the remaining +assurance joints: theorem↔pattern linkage is still by convention, the Strategy E +catalog is still hand-authored for 2 of 15 patterns, Strategy A remains a +minimal parse/print differential rather than acceptance coverage, and the +interpreter work is still value-level rather than a whole-program rewrite +soundness theorem. + +--- + ## 1. Scope & method Reviewed: the `llzk-lean` bridge in full (cert layer, emitter, C++ checker, @@ -30,17 +59,17 @@ normalizer. See §8. --- -## 2. Phase 0 baseline (reproduced facts) +## 2. Baseline and current reproduced facts | Item | Finding | How confirmed | |---|---|---| | Build | `llzk-lean` builds clean (1244 jobs) under Lean v4.30.0 | full `lake build` | | Toolchain split | `veir` pins `v4.30.0-rc2`, `llzk-lean` pins `v4.30.0`; did **not** break this build | observed | -| **Stale manifest (H4)** | `lake-manifest.json` pinned `alexanderlhicks/veir @ bf086362` (personal fork, **3 commits old, predates the parser fix `ab77c1c57`**) while `lakefile.toml` pins `project-llzk/veir @ 09d5f00f0`. A plain local `lake build` builds the wrong/older proof basis. | git ancestry; **remediated** by `lake update` (uncommitted) | +| **Stale manifest (H4)** | **RESOLVED by Phase 1.** `lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR` now point at `project-llzk/veir @ d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`; the gate also checks manifest `url`, `type`, `rev`, and `inputRev`. | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | | 15 theorems | axiom-clean: `[propext, Quot.sound]` only — no `sorryAx` | axiom audit | | 15 patterns + the `Combine` pass | ~~carry `sorryAx`~~ **RESOLVED (F1, 2026-06-02):** all 15 patterns now axiom-clean `[propext, Classical.choice, Quot.sound]` — no `sorryAx`, no `WfIRContext.Dom`. See §3 joint 2. | axiom audit (veir `lake build` + `#print axioms`) | | `Combine.lean` admissions | ~~140 `sorry` tokens~~ **0 (F1):** every rewriter precondition discharged in `RewriteLemmas.lean` (no `set_option warn.sorry false`) | count | -| Interpreter link | absent — `Veir.Data.Felt` is imported only by `Proofs.lean` + its own `Basic.lean` | grep | +| Interpreter link | partially started — VEIR now has a value-level `add x 0 → x` interpreter bridge, but no whole-program rewrite soundness theorem and no full 18-op Felt interpreter | `veir/FOLLOWUP.md` §F2 | | Catalog | 2 of 15 patterns; `#assertCatalogCoverage` lists the 13 uncovered | build output | | C++ matcher | fail-closed stub ("MLIR not found"); the "26 tests" are internal `EXPECT`s across 2 ctest exes driven by a **mock** matcher — no real-IR matching is built or tested | cmake log + ctest | | Strategy A | one positive corpus file, parse-print only (no canonicalization) | inspection | @@ -81,8 +110,10 @@ preservation* — still **not** semantic preservation. The three joints between defensive runtime guards (no `WfIRContext.Dom`). This establishes IR *well-formedness* preservation, not semantic preservation (joint 3). 3. **Algebra ↔ IR semantics**: the abstract `Veir.Data.Felt.add` (a thin - `ZMod p` wrapper) is never connected to the IR op `OpCode.felt Felt.add`'s - interpreter meaning. No such bridge exists anywhere in VEIR. + `ZMod p` wrapper) is still not connected to a whole-program + `interpret(after rewrite) = interpret(before rewrite)` theorem. VEIR now has + a value-level PoC for `add x 0 → x` (`Veir/Passes/Felt/InterpModel.lean`), + but that is not a general rewrite-soundness bridge. Two framing caveats worth stating to non-Lean readers: - **The verified subset is the *easy* subset.** All 15 are commutative-ring @@ -116,9 +147,11 @@ Two framing caveats worth stating to non-Lean readers: C2 risk that nothing catches. - **H2** `#certThmExists` is a weak invariant (name-resolution only). - **H3** Strategy A demonstrates little yet: 1 file, parse-print only; LLZK has - zero Felt canonicalizers and its folds no-op on unnamed fields, so - fold-agreement is currently unreachable (named-field path parser-blocked). -- **H4** Stale `lake-manifest.json` (see §2) — **remediated** (uncommitted). + zero Felt canonicalizers and its folds no-op on unnamed fields. Named-field + parser parity is now empirically resolved for the generic output path, so the + next blockers are meaningful canonicalization plus field-registry/modular + reduction parity. +- **H4** Stale `lake-manifest.json` (see §2) — **resolved by Phase 1 gates**. **Medium:** M1 no CI axiom-gate (the `warn.sorry false` admits are gone as of F1, but a CI `#print axioms` gate to *prevent regressions* is still absent); M2 @@ -129,7 +162,8 @@ unconditionally while LLZK requires a registered field name. **Low:** L1 `JsonParser` `LLONG_MAX_REL_LIMIT` misnamed + most-negative-int64 edge; L2 README "26 tests / 15 verified" reads as more coverage than the stubs -deliver; L3 VEIR README still references the dropped `llzkfelt_test1` branch. +deliver; L3 historical branch references should stay confined to historical +evidence, not live setup docs. --- @@ -147,8 +181,8 @@ discharging them). So: - **Add (incremental):** discharge the preconditions via `WfRewriter`; derive cert structural fields from the patterns (kills C2/H1/H2 by construction); a working C++ matcher; reframed claims. -- **Add (research):** the one load-bearing bridge — `eval(IR op) = - Veir.Data.Felt.op` — which is net-new under *any* plan. +- **Add (research):** widen the value-level interpreter bridge and, if needed, + build the much larger whole-program rewrite-soundness framework. The legitimate worry is **sequencing**, not quality: the project built horizontal scaffolding around a vertical hole (no single rewrite has a closed @@ -157,20 +191,22 @@ end-to-end, then widen. **Strategic caveat (not about this repo):** the ceiling on "fully verified rewrites" is set by VEIR. Its README marks the peephole rewriter "Complete" -but *not* "Verified"; no VEIR pass has a closed rewrite→interpreter theorem; -felt isn't in the interpreter; the interpreter's value domain is fixed-width -`LLVM.Int`/`BitVec`, not `ZMod p`; and `!felt.type` pins no prime, so there is -no canonical runtime meaning to bridge to. How deep a guarantee is reachable -is a VEIR-maturity question, identical whether this code is kept or rewritten. +but *not* "Verified"; no VEIR pass has a closed rewrite→interpreter theorem. +The current Felt interpreter work is a scoped value-level model with a +name→prime registry, not a complete whole-program semantics story for all 18 +Felt ops. How deep a guarantee is reachable is a VEIR-maturity question, +identical whether this code is kept or rewritten. --- -## 6. Spike — structural close: DONE (both shapes, landed in veir) +## 6. Historical spike — structural close superseded by 15/15 closure The salvage thesis was tested, not asserted, and the result is now landed in -the veir repo: **2 of 15 Felt patterns are fully sorry-free and axiom-clean** -(`[propext, Classical.choice, Quot.sound]` — no `sorryAx`, no `WfIRContext.Dom` -axiom), one per structural shape: +the veir repo. This section records the original 2-pattern spike, which has now +been superseded by the F1 close: **all 15 of 15 Felt patterns are fully +sorry-free and axiom-clean** (`[propext, Classical.choice, Quot.sound]` — no +`sorryAx`, no `WfIRContext.Dom` axiom). The original spike covered one pattern +per structural shape: - `right_identity_zero_add` — projection shape (`replaceValue` + `eraseOp`). - `constant_fold_add` — synthesis shape (`createOp` + `replaceOp`). @@ -188,24 +224,24 @@ guards** (each only skips the rewrite in states impossible in well-formed IR). So the structural close is achievable and axiom-clean — but it is *not* free assembly; it surfaces that VEIR's well-formedness model omits per-opcode shape constraints and SSA dominance (a substrate limitation, not a Felt defect — it's -why every VEIR pass `sorry`s these). The remaining 13 patterns are mechanical -follow-up on the same library + recipe. See `veir/REVIEW.md` §0 and -`veir/FOLLOWUP.md`. +why every VEIR pass `sorry`s these). The remaining 13 patterns were completed +with the same library + recipe. See `veir/REVIEW.md` §0 and `veir/FOLLOWUP.md`. --- ## 7. Working-tree state / housekeeping -- `lake-manifest.json` — **modified** (the H4 fix; `lake update` repointed it - to `project-llzk/veir @ 09d5f00f0`). -- The structural-close lemmas + the 2 verified patterns now live in the veir +- Phase 1 pin state is explicit: `lakefile.toml`, `lake-manifest.json`, and + `.lake/packages/VeIR` are expected to agree on + `project-llzk/veir@d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- The structural-close lemmas + all 15 verified patterns now live in the veir repo (`Veir/Passes/Felt/RewriteLemmas.lean`); the `Spike*.lean` scratch files used to develop them have been removed. - `.mcp.json` (at the `/home/alh/LLZK` session root, not in this repo) — adds the `lean-lsp` MCP server pinned to this project. ### veir repo changes (companion) -- `Veir/Passes/Felt/RewriteLemmas.lean` — **new**; verified patterns + lemma library. +- `Veir/Passes/Felt/RewriteLemmas.lean` — verified patterns + lemma library. - `Veir/Passes/Felt/Combine.lean` — VC1 docstring, VC3 guards, imports + uses the verified patterns (old sorry-laden defs removed). - `Veir/Passes/Felt/Proofs.lean` — VM1 citation fix. diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index 24027c7..f9e298a 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -1,63 +1,76 @@ # Current Harness State -Last reviewed: 2026-06-05 +Last reviewed: 2026-06-06 ## Active Phase -- Active phase: Phase 0, harness reset. -- Phase bootstrap file: `docs/phases/PHASE-00-harness-reset.md`. +- Active phase: Phase 2, LLZK source truth and field registry parity. +- Phase bootstrap file: `docs/phases/PHASE-02-llzk-source-truth.md`. - Companion repository: `../veir`. -- Companion phase file: `../veir/docs/phases/PHASE-00-harness-reset.md`. +- Companion phase file: `../veir/docs/phases/PHASE-02-llzk-source-truth.md`. -## Refs +## Accepted VeIR Pin + +- Accepted VeIR commit: + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- Accepted source branch: `felt-review-structural-close`. +- Accepted source remote: `https://github.com/project-llzk/veir.git`. +- Pin mode: remote commit, consumed through Lake metadata and a clean + `.lake/packages/VeIR` checkout. + +## Accepted LLZK Source -- llzk-lean bootstrap HEAD: `ea2363f87bcc`. -- Workspace VeIR bootstrap HEAD: `4b0978bddec0`. -- Lake `VeIR` dependency pin: `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. -- Lake `VeIR` dependency checkout observed at: `09d5f00f0d2b`. +- Accepted `llzk-lib` commit: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Accepted source ref: `origin/main`. +- Accepted source checkout: `../llzk-lib`. +- Source ledger: `docs/harness/LLZK_SOURCE.md`. + +## Refs -These refs are Phase 0 bootstrap inputs, not a self-referential pin on the -commit that contains this file. The doctor reports repository HEAD drift from -these inputs as a warning. Dependency pin mismatches and hidden dirty dependency -state remain hard failures. If a later phase relies on a newer ref for a -semantic claim, update this file, `docs/harness/SOURCES.md`, and review -evidence before treating that claim as current. +- llzk-lean Phase 1 bootstrap HEAD: + `336a5a221ae79d00e5d1346e09341232bdc4323d`. +- Workspace VeIR Phase 1 bootstrap HEAD: + `039068b68552bb37f1a887ec509e9b9111d4d54a`. +- llzk-lean implementation HEAD when Phase 1 started locally: + `6b4a7ec3aa38e2da7e1de23fb347b5c2cbac6386`. +- Workspace VeIR implementation HEAD when Phase 1 started locally: + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. -## Dependency Mode +The bootstrap refs are historical inputs from the phase file. The accepted +VeIR pin above is the dependency state this repository is allowed to treat as +acceptance evidence. -The Lake dependency checkout `.lake/packages/VeIR` is dirty at bootstrap: +## Dependency Policy -- `Veir/Passes/Felt/Combine.lean` -- `Veir/Passes/Felt/Proofs.lean` -- `Veir/Passes/Felt/RewriteLemmas.lean` +`lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR` must all name +the accepted VeIR commit. The dependency checkout must be clean. -Strict harness runs fail on this state. Exploratory runs may continue with -`--mode exploratory`, but exploratory output is not release or acceptance -evidence. +Dirty files under `.lake/packages/VeIR`, local patches, stashes, or a workspace +path override are not acceptance evidence. A workspace VeIR descendant may be +reported as context when repo-local metadata has moved past the accepted pin; +the clean dependency checkout remains the source of truth. ## Known Hazards -- `differential/run-differential.sh` depends on `.lake/packages/VeIR` and - `llzk-opt`. Missing `llzk-opt` is a tool skip, not a differential pass. -- The certificate checker smoke gate validates schema, theorem metadata, - loader behavior, and dispatch tests from source when CMake/CTest or `g++` is - available. Existing `checker/build` binaries are not used unless - `CERT_SMOKE_ALLOW_PREBUILT=1` is set. Real MLIR-backed matching remains - absent while `DefaultMatcher` is TODO/fail-closed. -- Strategy docs under `docs/` predate Phase 0. They are design context, not - acceptance evidence unless `docs/harness/SOURCES.md` revalidates a claim. -- CI warnings about skipped external tooling do not count as Strategy A or - Strategy E coverage. +- The Phase 1 bootstrap state included a dirty dependency checkout containing + partial Felt proof cleanup. That state is preserved under + `reviews/PHASE-01/evidence/` and must not be relied on after the pin is + refreshed. +- Strategy A and Strategy E smoke gates still classify their own tool status, + but Phase 1 does not make new semantic, differential, or certificate + acceptance claims. +- The local `../llzk-lib` worktree is behind fetched `origin/main`. Current + Phase 2 source claims use `git show origin/main:...` at + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`, not stale worktree files. ## Acceptance Rule -Phase 0 is current only when: +Phase 2 is current only when: -- `scripts/harness/doctor.sh` fails in strict mode on the known dirty - dependency and prints exact files. -- `scripts/harness/doctor.sh --mode exploratory` passes while reporting the - same dirty dependency. +- `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` passes. +- `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes. +- `scripts/harness/doctor.sh --workspace-veir ../veir` passes in strict mode. +- `lake build` succeeds against the clean dependency checkout. - `scripts/harness/check-doc-freshness.sh` passes. - `scripts/harness/validate-skills.sh` passes. -- `scripts/harness/diff-smoke.sh` and `scripts/harness/cert-smoke.sh` report - precise status without claiming skipped or absent tooling as coverage. diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index 7e118ea..bd455b8 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -1,26 +1,65 @@ # Harness Gates -Last reviewed: 2026-06-05 +Last reviewed: 2026-06-06 ## Gate Inventory -| Gate | Command | Expected Phase 0 behavior | What it proves | +| Gate | Command | Expected behavior | What it proves | |---|---|---|---| -| Strict doctor | `scripts/harness/doctor.sh` | Fails while `.lake/packages/VeIR` is dirty | Dirty dependency state is not hidden | -| Exploratory doctor | `scripts/harness/doctor.sh --mode exploratory` | Passes with warnings when only repo HEAD or dirty dependency state differs from bootstrap inputs | Local investigation can continue with explicit dependency state | -| Workspace doctor | `scripts/harness/doctor.sh --mode exploratory --workspace-veir ../veir` | Passes with warnings if workspace VeIR differs from the bootstrap input | Companion repo state is explicit | -| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when canonical docs and review disposition exist | Phase metadata and review state are present | -| Differential smoke | `scripts/harness/diff-smoke.sh` | Exits 0 on real pass, 77 on missing `llzk-opt`, 1 on divergence, 2 on tool/parse/pass failure | Strategy A smoke status is classified | -| Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds checker smoke binaries from source via CMake/CTest or direct `g++`, passes loader/schema smoke, and reports MLIR matcher active or absent | Strategy E smoke status is classified without pretending MLIR matching exists | -| Prebuilt certificate smoke | `CERT_SMOKE_ALLOW_PREBUILT=1 scripts/harness/cert-smoke.sh` | Uses existing `checker/build` binaries only when source-build tools are unavailable | Prebuilt evidence is explicit and not confused with source-build evidence | -| Skill validation | `scripts/harness/validate-skills.sh` | Passes when every repo-local skill has required sections | Repo-local skills are concise and auditable | +| LLZK source truth | `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` | Passes only when the accepted LLZK source commit is available, `origin/main` equals the accepted commit, the source ledger records the accepted commit, the accepted Felt op set matches the ledger, and checker registry comments enumerate the accepted built-ins | Phase 2 source facts are exact-ref based and certificate/checker comments match the LLZK source registry | +| Pin verification | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | Passes only when Lake file URLs/revs, manifest `type`/`inputRev`, and dependency HEAD agree on the accepted commit, the dependency is clean, and workspace VeIR is either the accepted commit or a descendant used only for metadata context | llzk-lean is not relying on hidden `.lake/packages/VeIR` edits or a spoofed source | +| Strict doctor | `scripts/harness/doctor.sh --workspace-veir ../veir` | Passes after the pin gate and layout checks pass | Phase 1 harness state is complete and strict | +| Local doctor | `scripts/harness/doctor.sh` | Passes with a warning that workspace VeIR was not checked | Local layout is valid, but the run is not full acceptance evidence | +| Lake build | `lake build` | Builds against the clean accepted VeIR dependency | The selected pin is buildable by llzk-lean | +| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when Phase 1 docs and review evidence are present | Canonical phase metadata and evidence are current | +| Differential smoke | `scripts/harness/diff-smoke.sh` | Keeps smoke status classification behavior | Strategy A status remains classified without becoming a Phase 1 acceptance claim | +| Certificate smoke | `scripts/harness/cert-smoke.sh` | Keeps smoke status classification behavior | Strategy E status remains classified without becoming a Phase 1 acceptance claim | +| Skill validation | `scripts/harness/validate-skills.sh` | Passes when repo-local skills have required sections | Repo-local skills remain auditable | + +## Reproducible-Pin Failures + +## LLZK Source-Truth Failures + +`scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` must fail if: + +- `../llzk-lib` is missing or not a git checkout. +- The accepted source commit + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` is unavailable. +- `../llzk-lib origin/main` differs from the accepted source commit. +- `docs/harness/LLZK_SOURCE.md` does not record the accepted source commit or + `lib/Util/Field.cpp`. +- `include/llzk/Dialect/Felt/IR/Ops.td` does not define the accepted 18-op + Felt ledger: `const`, `add`, `sub`, `mul`, `pow`, `div`, `uintdiv`, + `sintdiv`, `umod`, `smod`, `neg`, `inv`, `bit_and`, `bit_or`, `bit_xor`, + `bit_not`, `shl`, `shr`. +- `lib/Util/Field.cpp::initKnownFields` does not define `bn128`, `bn254`, + `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and `koalabear` as + recorded in `docs/harness/LLZK_SOURCE.md`. +- Checker registry comments omit an accepted built-in field. + +`scripts/harness/verify-pins.sh` must fail if: + +- `lakefile.toml` and `lake-manifest.json` disagree. +- `lakefile.toml` or `lake-manifest.json` names a VeIR source URL other than + `https://github.com/project-llzk/veir.git`. +- `lake-manifest.json` does not record VeIR as a `git` dependency. +- Either Lake file names a commit other than + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- `lake-manifest.json` records a VeIR `inputRev` other than + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- `.lake/packages/VeIR` HEAD differs from the manifest rev. +- `.lake/packages/VeIR` has any modified, deleted, staged, or untracked file. +- A supplied workspace VeIR path neither equals nor descends from the accepted + rev in strict mode. ## Non-Claims -Phase 0 does not prove: +Phase 1 does not prove: - Felt semantic parity. - Complete differential corpus coverage. - Runtime LLZK rewrite verification. -- Full Lean proof audit. +- Full Lean proof audit beyond buildability of the selected pin. - CI coverage when external tooling is missing. +- Missing Felt operation semantics beyond the registry source facts. Phase 2 + does not port additional Felt operations. diff --git a/docs/harness/LLZK_SOURCE.md b/docs/harness/LLZK_SOURCE.md new file mode 100644 index 0000000..b8c2729 --- /dev/null +++ b/docs/harness/LLZK_SOURCE.md @@ -0,0 +1,92 @@ +# LLZK Felt Source Ledger + +Last reviewed: 2026-06-06 + +## Accepted Source + +| Item | Value | +|---|---| +| Repository | `../llzk-lib` | +| Remote | `git@github.com:Veridise/llzk-lib.git` | +| Accepted ref | `origin/main` | +| Accepted commit | `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | +| Retrieval form | `git -C ../llzk-lib show db922857bc5a88a9107627ef6b36a8b5e57bc5c2:` | + +The local `../llzk-lib` worktree is stale at +`30b0fa1eb77de154ff60c13fa88ef286d8b01c65`. Phase 2 source truth uses fetched +`origin/main` at the accepted commit above and reads files through `git show`, +not through the stale worktree checkout. + +## Source Files + +| Path at accepted commit | Use | +|---|---| +| `include/llzk/Dialect/Felt/IR/Ops.td` | Felt op mnemonic ledger | +| `include/llzk/Dialect/Felt/IR/Types.td` | Felt type syntax ledger | +| `include/llzk/Dialect/Felt/IR/Attrs.td` | Felt attribute syntax ledger | +| `include/llzk/Dialect/Felt/IR/OpInterfaces.td` | Felt op interface ledger | +| `lib/Dialect/Felt/IR/Ops.cpp` | Felt folder implementation ledger | +| `lib/Util/Field.cpp` | Built-in field registry and reduction source | +| `test/Dialect/Felt/felt_arith_pass.llzk` | Accepted Felt op syntax examples | +| `test/Dialect/Felt/felt_arith_fail.llzk` | Accepted Felt verifier failures | +| `test/Dialect/Felt/felt_const_fold.llzk` | Accepted Felt fold examples | +| `test/Dialect/Felt/felt_spec_pass.llzk` | Accepted field-spec syntax examples | +| `test/Dialect/Felt/types_pass.llzk` | Accepted Felt type syntax examples | +| `unittests/IR/FeltFoldTests.cpp` | Accepted unit-level fold behavior | + +The stale local worktree must not be used for source evidence unless it is +explicitly checked out to the accepted commit. + +## Felt Ops + +`include/llzk/Dialect/Felt/IR/Ops.td` at the accepted commit defines these +Felt op mnemonics, in source order: + +- `const` +- `add` +- `sub` +- `mul` +- `pow` +- `div` +- `uintdiv` +- `sintdiv` +- `umod` +- `smod` +- `neg` +- `inv` +- `bit_and` +- `bit_or` +- `bit_xor` +- `bit_not` +- `shl` +- `shr` + +The accepted source does not define `nondet` or `mod` in the Felt dialect at +this ref. + +## Field Registry + +`lib/Util/Field.cpp::initKnownFields` at the accepted commit defines: + +| Field | Prime | +|---|---:| +| `bn128` | `21888242871839275222246405745257275088548364400416034343698204186575808495617` | +| `bn254` | `21888242871839275222246405745257275088548364400416034343698204186575808495617` | +| `grumpkin` | `21888242871839275222246405745257275088696311157297823662689037894645226208583` | +| `babybear` | `2013265921` | +| `goldilocks` | `18446744069414584321` | +| `mersenne31` | `2147483647` | +| `koalabear` | `2130706433` | + +## Verification + +Run: + +```bash +scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib +``` + +The gate reads source through `git show` at the accepted commit, checks +`origin/main`, verifies the Felt op mnemonic list above, verifies the field +registry, and checks llzk-lean's checker comments for the full built-in field +list. diff --git a/docs/harness/PINS.md b/docs/harness/PINS.md new file mode 100644 index 0000000..aca0faa --- /dev/null +++ b/docs/harness/PINS.md @@ -0,0 +1,74 @@ +# Dependency Pins + +Last reviewed: 2026-06-06 + +## Accepted VeIR Pin + +- Commit: `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3` +- Short ref: `d4cc1bf2d31b` +- Remote: `https://github.com/project-llzk/veir.git` +- Branch at selection time: `felt-review-structural-close` +- Mode: remote commit pinned through Lake metadata and a clean Lake package + checkout + +This commit is a descendant of the Phase 1 accepted pin +`d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`, which was itself a descendant of +the previous Lake pin `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. + +This pin includes the Phase 2 VeIR field-registry update and source-truth gate. + +## Required State + +The following must all identify the accepted commit: + +- `lakefile.toml` `git` and `rev` +- `lake-manifest.json` `url`, `type`, `rev`, and `inputRev` +- `.lake/packages/VeIR` HEAD + +`git -C .lake/packages/VeIR status --short` must be empty. + +## Allowed Modes + +- Strict acceptance: Lake files and dependency checkout all match the accepted + commit, the dependency checkout is clean, and any supplied `../veir` + workspace either points at the accepted commit or is a descendant used only + for repo-local metadata. The dependency checkout remains the source of truth. +- Local layout: `scripts/harness/doctor.sh` may run without `--workspace-veir` + and emit a warning. This is useful for local checks but is not full + acceptance evidence. +- Exploratory workspace: `scripts/harness/verify-pins.sh --mode exploratory + --workspace-veir PATH` may warn about a workspace mismatch. This output must + not be used to close Phase 2. + +## Forbidden Hidden State + +Do not rely on: + +- Modified, staged, deleted, or untracked files under `.lake/packages/VeIR`. +- Local commits in `.lake/packages/VeIR` that are not the recorded accepted + commit. +- A workspace path override as the source of truth. +- `lake update` output that changes the VeIR rev without a deliberate review + evidence update. + +## Update Procedure + +1. Select a new VeIR commit and verify that it is available from the accepted + remote. +2. Record the branch, remote, and exact commit under `docs/harness/SOURCES.md` + and Phase review evidence. +3. Update `lakefile.toml` and `lake-manifest.json` to the exact commit. +4. Refresh `.lake/packages/VeIR` to that commit and ensure it is clean. +5. Run `scripts/harness/verify-pins.sh --workspace-veir ../veir`. +6. Run `lake build`. +7. Record all command output under `reviews/PHASE-XX/evidence/`. + +## Rollback Procedure + +1. Restore `lakefile.toml` and `lake-manifest.json` to the previous accepted + commit. +2. Refresh `.lake/packages/VeIR` to that commit. +3. Confirm `git -C .lake/packages/VeIR status --short` is empty. +4. Re-run `scripts/harness/verify-pins.sh --workspace-veir ../veir` and + `lake build`. +5. Record the rollback evidence and disposition the reason for rollback. diff --git a/docs/harness/REVIEWS.md b/docs/harness/REVIEWS.md index 3814d7b..425f9ea 100644 --- a/docs/harness/REVIEWS.md +++ b/docs/harness/REVIEWS.md @@ -1,6 +1,6 @@ # Review Protocol -Last reviewed: 2026-06-05 +Last reviewed: 2026-06-06 ## Scope diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md index 7b2bfb6..626326e 100644 --- a/docs/harness/SOURCES.md +++ b/docs/harness/SOURCES.md @@ -1,37 +1,46 @@ # Source Ledger -Last reviewed: 2026-06-05 +Last reviewed: 2026-06-06 ## Trusted Local Sources | Source | Ref or retrieval | Use | |---|---:|---| -| `docs/phases/PHASE-00-harness-reset.md` | local file, 2026-06-05 | Phase 0 objective, artifacts, gates, done criteria | -| llzk-lean repository HEAD | `ea2363f87bcc` | Bootstrap llzk-lean source state | -| Workspace VeIR repository HEAD | `4b0978bddec0` | Companion source state | +| `docs/phases/PHASE-01-pins-and-repro.md` | local file, 2026-06-05 | Phase 1 objective, artifacts, gates, done criteria | +| Accepted VeIR pin | `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3` | Dependency commit consumed by llzk-lean | +| Accepted VeIR branch | `felt-review-structural-close` | Remote branch containing the accepted commit | +| Accepted VeIR remote | `https://github.com/project-llzk/veir.git` | Canonical source repository for the accepted pin | | `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | | `lake-manifest.json` | local file, 2026-06-05 | Resolved `VeIR` dependency pin | -| `.lake/packages/VeIR` | `09d5f00f0d2b`, dirty | Actual dependency checkout state | -| `differential/run-differential.sh` | local file, 2026-06-05 | Strategy A wrapper behavior | -| `checker/CMakeLists.txt` | local file, 2026-06-05 | Strategy E CMake build/test surface | -| `checker/src/CertChecker.cpp` | local file, 2026-06-05 | MLIR matcher status | -| `checker/tests/test_loader.cpp` | local file, 2026-06-05 | Certificate loader and dispatch smoke tests | -| `checker/bin/llzk_lean_check.cpp` | local file, 2026-06-05 | Certificate summary driver smoke test | -| `certs/felt-combine.cert.json` | local file, 2026-06-05 | Certificate schema and theorem metadata smoke input | - -Evidence for the bootstrap state is captured under -`reviews/PHASE-00/evidence/`. +| `.lake/packages/VeIR` | clean checkout at accepted pin | Actual dependency state used by `lake build` | +| `scripts/harness/verify-pins.sh` | local file, 2026-06-05 | Phase 1 pin agreement and cleanliness gate | +| `scripts/harness/doctor.sh` | local file, 2026-06-05 | Strict harness wrapper around pin and layout gates | +| `docs/phases/PHASE-02-llzk-source-truth.md` | local file, 2026-06-06 | Phase 2 source-truth objective, artifacts, gates, and done criteria | +| `docs/harness/LLZK_SOURCE.md` | local file, 2026-06-06 | Accepted LLZK Felt source ledger | +| Accepted LLZK source commit | `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Exact `llzk-lib` source commit for Phase 2 Felt source facts | +| Accepted LLZK source ref | `../llzk-lib origin/main` | Fetched source ref selected for Phase 2 | +| Accepted LLZK field registry | `lib/Util/Field.cpp` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Built-in field registry facts | +| Accepted LLZK Felt ops | `include/llzk/Dialect/Felt/IR/Ops.td` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Felt op mnemonic ledger | +| `scripts/harness/verify-llzk-source.sh` | local file, 2026-06-06 | Phase 2 LLZK source-truth gate | + +Evidence for the dirty bootstrap state and the refreshed clean state is +captured under `reviews/PHASE-01/evidence/`. ## External Sources -No external web source is trusted as canonical for Phase 0. Future phases may -add upstream LLZK, MLIR, Lean, or GitHub Actions references, but each must list -an exact URL or commit and retrieval date here. +The accepted remote branch was checked with `git ls-remote origin +refs/heads/felt-review-structural-close` from the VeIR repository and recorded +under `../veir/reviews/PHASE-01/evidence/accepted-remote-branch.txt`. + +No web page, issue, or mutable branch name is trusted without the exact commit +hash above. For LLZK source facts, `origin/main` is accepted only through the +exact commit `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. -## Stale Historical Material +## Contextual Non-Canonical Material -These files are design context, not Phase 0 acceptance evidence unless a claim -is revalidated against current refs: +These files remain design and review context, not Phase 1 pin evidence unless a +specific claim is revalidated against the accepted commit and recorded under +Phase 1 evidence: - `README.md` - `docs/README.md` @@ -39,9 +48,7 @@ is revalidated against current refs: - `docs/strategy-e-certificates.md` - `docs/future-*.md` - `docs/REVIEW.md` -- `.github/workflows/differential.yml` -- `.github/workflows/certify.yml` -- Historical references to `llzkfelt_test1` and dates before 2026-06-05 - -When using any of these, cite the exact local file and explain whether the claim -was revalidated. +- `.github/workflows/*.yml` +- Historical references to `llzkfelt_test1` in archived evidence or old notes +- Local `../llzk-lib` worktree files while the worktree remains at + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65` diff --git a/docs/phases/PHASE-01-pins-and-repro.md b/docs/phases/PHASE-01-pins-and-repro.md index 336eb83..5f0f5fa 100644 --- a/docs/phases/PHASE-01-pins-and-repro.md +++ b/docs/phases/PHASE-01-pins-and-repro.md @@ -1,6 +1,6 @@ # Phase 1: Reproducible Pins -Status: bootstrap +Status: active Last reviewed: 2026-06-05 Repository: llzk-lean Companion phase file: ../../../veir/docs/phases/PHASE-01-pins-and-repro.md @@ -50,8 +50,9 @@ dependency checkout must be clean. accepted commit. - `lake-manifest.json`: update consistently with `lakefile.toml`. - `.lake/packages/VeIR`: refresh to the accepted clean commit. -- `scripts/harness/verify-pins.sh`: verify Lake file agreement, dependency HEAD, - dependency cleanliness, and optional workspace VeIR agreement. +- `scripts/harness/verify-pins.sh`: verify Lake file URL/rev agreement, + manifest `url`/`type`/`rev`/`inputRev`, dependency HEAD, dependency + cleanliness, and optional workspace VeIR agreement. - `reviews/PHASE-01/{request.md,findings.md,disposition.md,evidence/}`: adversarial review workspace for the pin transition. @@ -62,8 +63,11 @@ dependency checkout must be clean. - `scripts/harness/doctor.sh` passes in strict mode only after the dependency checkout is clean and at the accepted rev. - `git -C .lake/packages/VeIR status --short` is empty. +- `lakefile.toml` uses the accepted VeIR remote URL and accepted commit. +- `lake-manifest.json` uses the accepted VeIR remote URL, has `type: "git"`, + and records the accepted commit in both `rev` and `inputRev`. - `git -C .lake/packages/VeIR rev-parse HEAD` equals both the `lakefile.toml` - rev and the `lake-manifest.json` rev. + rev and the `lake-manifest.json` rev/inputRev. - If `../veir` is supplied, its HEAD equals the accepted rev or the mismatch is explicitly documented as a non-acceptance exploratory layout. - `lake build` succeeds against the clean dependency. @@ -71,15 +75,17 @@ dependency checkout must be clean. ## Review Requirements - Capture exact command output under `reviews/PHASE-01/evidence/`. -- Review must include the Lake file diff, dependency checkout HEAD, dependency - cleanliness, and the result of `lake build`. +- Review must include the Lake file diff, Lake source URL/type/inputRev, + dependency checkout HEAD, dependency cleanliness, and the result of + `lake build`. - Review must explicitly reject any proof state that only exists in a dirty `.lake/packages/VeIR` checkout. - Disposition every finding before closing the phase. ## Done Criteria -- `lakefile.toml` and `lake-manifest.json` pin the same accepted VeIR commit. +- `lakefile.toml` and `lake-manifest.json` pin the same accepted VeIR remote and + commit, with manifest `type`, `rev`, and `inputRev` checked. - `.lake/packages/VeIR` is clean and at that commit. - `scripts/harness/verify-pins.sh` passes. - `scripts/harness/doctor.sh` passes in strict mode. diff --git a/docs/phases/PHASE-02-llzk-source-truth.md b/docs/phases/PHASE-02-llzk-source-truth.md new file mode 100644 index 0000000..6752e78 --- /dev/null +++ b/docs/phases/PHASE-02-llzk-source-truth.md @@ -0,0 +1,120 @@ +# Phase 2: LLZK Source Truth And Field Registry Parity + +Status: active +Last reviewed: 2026-06-06 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-02-llzk-source-truth.md + +## Objective + +Ground llzk-lean's Felt certificates, documentation, and checker assumptions in +a fresh LLZK Felt source ledger, and keep them aligned with the VeIR field +registry selected by Phase 2. + +This phase does not make Strategy A or Strategy E complete. It ensures the +source facts those strategies depend on are current and mechanically checked. + +## Starting State + +- llzk-lean HEAD at Phase 2 bootstrap: + `6b4a7ec3aa38e2da7e1de23fb347b5c2cbac6386`. +- Workspace VeIR HEAD at Phase 2 bootstrap: + `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. +- llzk-lean currently pins VeIR to: + `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. +- Local `llzk-lib` checkout after fetch: + - local `main`: `30b0fa1eb77de154ff60c13fa88ef286d8b01c65` + - fetched `origin/main`: `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` + - local checkout is behind `origin/main` and must not be treated as current + source truth without an explicit checkout or `git show origin/main:...`. +- Fetched `llzk-lib origin/main` changes Felt source truth relative to local + `main`: + - `lib/Util/Field.cpp` separates `bn128`/`bn254` from `grumpkin`. + - `include/llzk/Dialect/Felt/IR/Attrs.td` lists `grumpkin` as built-in. + - `include/llzk/Dialect/Felt/IR/Ops.td` documents shift semantics. +- Current llzk-lean comments and checker TODOs mention built-in fields but do + not yet have a Phase 2 source-ledger gate. + +## Non-Goals + +- Do not expand the certificate catalog beyond source-ledger maintenance. +- Do not implement the MLIR runtime matcher. +- Do not claim Strategy A differential acceptance. +- Do not port missing VeIR Felt operations. +- Do not use stale local `llzk-lib` files as source truth. + +## Artifacts To Create Or Update + +- `docs/harness/LLZK_SOURCE.md`: source ledger for accepted LLZK Felt files and + exact source ref. +- `docs/harness/SOURCES.md`: add Phase 2 LLZK source refs. +- `docs/harness/GATES.md`: add source-truth gates. +- `docs/strategy-a-oracle.md`, `docs/strategy-e-certificates.md`, + `LlzkLean/Cert.lean`, and checker comments as needed to remove stale field + registry assumptions. +- `scripts/harness/verify-llzk-source.sh`: verify accepted LLZK source ref, + Felt op set, and built-in field registry facts. +- `reviews/PHASE-02/{request.md,findings.md,disposition.md,evidence/}`: + adversarial review workspace. + +## Source Files To Ledger + +Use `../llzk-lib` as the local repository, but use fetched `origin/main` as the +initial source truth until a newer source ref is deliberately selected. + +- `include/llzk/Dialect/Felt/IR/Ops.td` +- `include/llzk/Dialect/Felt/IR/Types.td` +- `include/llzk/Dialect/Felt/IR/Attrs.td` +- `lib/Dialect/Felt/IR/Ops.cpp` +- `lib/Util/Field.cpp` +- `test/Dialect/Felt/*` + +## Field Registry Target + +The initial accepted LLZK source ref defines these built-in fields: + +- `bn128`: + `21888242871839275222246405745257275088548364400416034343698204186575808495617` +- `bn254`: + `21888242871839275222246405745257275088548364400416034343698204186575808495617` +- `grumpkin`: + `21888242871839275222246405745257275088696311157297823662689037894645226208583` +- `babybear`: `2013265921` +- `goldilocks`: `18446744069414584321` +- `mersenne31`: `2147483647` +- `koalabear`: `2130706433` + +## Gates To Implement + +- `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` fails if the + accepted source ref is unavailable or unrecorded. +- The source gate checks the 18 Felt op mnemonics: + `const`, `add`, `sub`, `mul`, `pow`, `div`, `uintdiv`, `sintdiv`, `umod`, + `smod`, `neg`, `inv`, `bit_and`, `bit_or`, `bit_xor`, `bit_not`, `shl`, + `shr`. +- The source gate checks the built-in field registry facts above. +- `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass. +- `lake build` succeeds after any documentation or certificate metadata + updates. + +## Review Requirements + +- Every LLZK source claim must cite an exact `llzk-lib` commit and file path. +- Review evidence must include `git -C ../llzk-lib rev-parse HEAD origin/main` + and source extraction output. +- The reviewer must explicitly reject stale local `llzk-lib` checkout facts + unless they match the accepted source ref. +- The reviewer must confirm llzk-lean docs and checker comments include + `grumpkin` and `koalabear` where they enumerate built-in fields. +- Disposition every finding before closing the phase. + +## Done Criteria + +- `docs/harness/LLZK_SOURCE.md` records the accepted LLZK Felt source ref and + files. +- llzk-lean docs and checker assumptions match the accepted source ledger. +- A source-truth gate catches missing `grumpkin`, missing `koalabear`, or + stale `bn128`/`bn254` registry facts. +- `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes. +- `lake build` succeeds. +- Phase 2 review artifacts contain fresh adversarial evidence. diff --git a/docs/strategy-a-oracle.md b/docs/strategy-a-oracle.md index 587aac9..26a47dc 100644 --- a/docs/strategy-a-oracle.md +++ b/docs/strategy-a-oracle.md @@ -24,67 +24,57 @@ below. ### Known alignment caveats (read before adding to the corpus) Four structural gaps between LLZK and VEIR constrain what the -harness can actually demonstrate today — surfaced in the -external-alignment audit that drove commit `3c33115` ("Alignment -audit fixes: cert parity, parser incompatibility, schema gaps"; -see `git log 3c33115^!` for the full rationale): - -1. **LLZK has no canonicalization patterns for Felt ops.** A - `grep -rn "getCanonicalizationPatterns" llzk-lib/lib/Dialect/Felt/` - returns zero matches; the Felt dialect ships only `fold` - implementations (`Ops.cpp:141-333`). VEIR's rewrites that *aren't* - constant folds — e.g., `right_identity_zero_add` (x+0 → x) — have - no LLZK counterpart. They are correct VEIR soundness claims, but - the differential cannot demonstrate LLZK and VEIR producing - identical canonical forms for them, because LLZK doesn't reduce. +harness can actually demonstrate today. Phase 2 re-baselines those +claims to `llzk-lib` commit +`db922857bc5a88a9107627ef6b36a8b5e57bc5c2`: + +1. **LLZK has no canonicalization patterns for Felt ops.** VEIR + rewrites that *aren't* constant folds, e.g. + `right_identity_zero_add` (x+0 → x), have no LLZK counterpart. + They are correct VEIR soundness claims, but the differential + cannot demonstrate LLZK and VEIR producing identical canonical + forms for them, because LLZK doesn't reduce. 2. **LLZK's binary folds require a registered field name.** - `tryGetBinaryFoldData` (`Ops.cpp:57-79`) returns null unless both - operands are `FeltConstAttr`s with matching, registered field - names (one of `bn128`, `bn254`, `babybear`, `goldilocks`, - `mersenne31`, `koalabear`, or a `#felt.field`-registered custom - name). Our seed corpus `corpus/felt/const_identities.mlir` uses - bare `!felt.type` — so LLZK's fold short-circuits to a no-op, - and the parse-print round-trip is what the differential - actually catches. - -3. **Named-field FeltConstAttr is parser-incompatible.** VEIR's - parser accepts `#felt : !felt.type<"name">` (field - annotation on the outer type) but rejects LLZK's - `#felt>` (field annotation inside the const). - LLZK accepts both, but silently drops VEIR's outer annotation - and fails verification on the result-type mismatch. Until one - side fixes its parser, the corpus *cannot* include any - named-field FeltConstAttr — both directions of the round-trip - error out. `corpus/expected-divergence/named_field_const.mlir` - documents this gap as an expected-divergence test. + `tryGetBinaryFoldData` in `lib/Dialect/Felt/IR/Ops.cpp` returns + null unless both operands are `FeltConstAttr`s with matching, + registered field names. The accepted built-ins are `bn128`, + `bn254`, `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and + `koalabear`; custom fields can be specified with `#felt.field`. + Bare `!felt.type` inputs short-circuit to a no-op, and the + parse-print round-trip is what the differential actually catches. + +3. **Named-field FeltConstAttr parser parity is resolved on the + generic-MLIR path.** VEIR accepts the generic form emitted by + `llzk-opt --mlir-print-op-generic`, and the outer + `!felt.type<"name">` retains the field. The remaining difference + is cosmetic printer style: LLZK prints a redundant inner + annotation, while VEIR relies on the outer type annotation; the + normalizer strips only that redundant inner form. 4. **VEIR's folds don't apply modular reduction.** LLZK's - `field->reduce(...)` (`Util/Field.cpp`) normalizes constants + `Field::reduce` in `lib/Util/Field.cpp` normalizes constants modulo the prime; VEIR's `constant_fold_add` stores the raw - integer. For unnamed-field inputs this never bites (LLZK - doesn't fold). For named-field inputs it would bite, but #3 - blocks that path. + integer. For named-field inputs, this modular-reduction difference + is the expected arithmetic divergence to classify. The right v1 ordering, given these gaps: - - First **fix the named-field parser incompatibility** in VEIR - (one-side fix; smallest blast radius) so corpus expansion to - named-field inputs is even possible. - - *Then* add a Field registry on VEIR's side so its folds + - First **re-test the named-field corpus** under the Phase 1 pin and + reclassify stale expected-divergence inputs. + - Then add a Field registry on VEIR's side so its folds short-circuit-or-reduce consistent with LLZK. - - *Then* enable canonicalization in the diff script and start + - Then enable canonicalization in the diff script and start mirroring `llzk-lib/test/Dialect/Felt/`. -Without that ordering, every named-field corpus addition just goes -into `expected-divergence/` and the harness, while honest, doesn't -demonstrate alignment. +Without that ordering, named-field corpus additions will mostly document +the known modular-reduction gap rather than demonstrate alignment. When the outputs diverge, the harness reports the diff inline. The divergence is then classified as one of: 1. A canonical-form mismatch (e.g., VEIR's folds don't apply modular - reduction yet — see VEIR's `FELT_PARITY_ASSESSMENT_2026-05-28.md` - §2.2 row #1 for the parity-gap list). + reduction yet — see `../veir/REVIEW.md` VH3 for the current + parity-gap framing). 2. An LLZK bug to file against `llzk-lib`. 3. A spec disagreement to escalate. @@ -118,13 +108,16 @@ No user-visible change to `llzk-opt`. ## What this v1 needs -Current state (2026-05-28): +Current state (2026-06-05): - ✅ `differential/run-differential.sh` wraps VEIR's diff script; recurses into directory args; plumbs `LOWER_FIRST=1` through to `--lower-first` for LLZK custom-asm inputs. - 🌱 Seed input: `corpus/felt/const_identities.mlir` (one file). Corpus expansion is the headline v1 work item. -- ✅ VEIR has 15 verified rewrites in `Veir.Passes.Felt.Combine`. +- ✅ VEIR has 15 Felt rewrite patterns whose structural preconditions are + sorry-free and axiom-clean under the accepted Phase 1 pin. This still does + not close the theorem↔pattern or IR-semantics joints; see + `docs/REVIEW.md`. - 🚧 Harness is a **parse-print round-trip differential**, not a pass-pipeline differential. v1 adds `--canonicalize` / `-p felt-combine` invocations (see #1 below). @@ -158,8 +151,9 @@ Outstanding work to reach v1: way we can mirror `llzk-lib/test/Dialect/Felt/` quickly. 4. **Coverage reporting.** When a corpus input passes, record which - VEIR patterns (and LLZK folders) it exercised. Surface "12 of 15 - VEIR patterns differentially confirmed; 4 of 18 LLZK folders". + VEIR patterns and LLZK folders it exercised. Surface "12 of 15 + VEIR patterns differentially confirmed; N of 18 LLZK Felt ops + covered by corpus inputs". 5. **Failing-case corpus.** Programs LLZK rejects but VEIR accepts (or vice versa) belong in `corpus/expected-divergence/`. The @@ -170,10 +164,10 @@ Outstanding work to reach v1: for the polarity convention. 6. **Field-registry parity.** VEIR currently folds constants without - modular reduction; LLZK does. Until VEIR ships a Field registry, - any named-field constant arithmetic diverges textually. Tracked in - [VEIR FELT_PARITY_ASSESSMENT_2026-05-28.md](https://github.com/alexanderlhicks/veir/blob/llzkfelt_test1/FELT_PARITY_ASSESSMENT_2026-05-28.md) - — fix lives upstream in VEIR, not in llzk-lean. + modular reduction; LLZK does. Until VEIR's folds model the accepted + Field registry, named-field constant arithmetic can diverge + textually. Tracked in `../veir/REVIEW.md` VH3 — fix lives upstream + in VEIR, not in llzk-lean. ## Effort diff --git a/docs/strategy-e-certificates.md b/docs/strategy-e-certificates.md index dafe8e9..a5d8955 100644 --- a/docs/strategy-e-certificates.md +++ b/docs/strategy-e-certificates.md @@ -20,6 +20,14 @@ Each entry in the certificate file describes one verified rewrite pattern: identifier, LHS shape, RHS shape, side conditions, and the name of the Lean theorem that justifies it. +The current certificate proof basis is pinned to VEIR commit +`d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3` from +`project-llzk/veir`. Under that pin, the Lean catalog scan still finds +15 Felt pattern definitions, with 2 covered by the hand-authored +certificate catalog and 13 reported as uncovered. The pin gate is a +reproducibility claim only; it does not make Strategy E acceptance +claims beyond the checker and catalog status below. + ## Architecture ``` @@ -265,7 +273,7 @@ later for explicit downgrades. ## What this v1 needs -Current state (2026-05-29): +Current state (2026-06-05): - ✅ Schema v0.2.0 (defined here + `LlzkLean/Cert.lean`). Closes the v0.1.1 known schema gaps; see "Schema gaps closed in v0.2.0" below for the audit trail. diff --git a/lake-manifest.json b/lake-manifest.json index c2390f9..c80a4d5 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -5,10 +5,10 @@ "type": "git", "subDir": null, "scope": "", - "rev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", + "rev": "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", + "inputRev": "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", diff --git a/lakefile.toml b/lakefile.toml index dcf66cf..dccdad6 100644 --- a/lakefile.toml +++ b/lakefile.toml @@ -11,13 +11,13 @@ moreServerArgs = ["--tstack=400000"] # # Why the fork pin (project-llzk/veir vs opencompl/veir): # the LLZK port + verified rewrites do not exist in upstream -# opencompl/veir yet. They live on the project-llzk/veir fork's -# `llzkfelt_test1` branch pending upstream-merge. Migration plan: +# opencompl/veir yet. They live on the project-llzk/veir fork, with the current +# accepted Phase 1 proof basis selected from `felt-review-structural-close`. +# Migration plan: # -# 1. (done) Bootstrap pin on alexanderlhicks/veir's -# `llzkfelt_test1` branch. -# 2. (current) Pin to project-llzk/veir at the SHA below -# (the fork is now organization-owned). +# 1. (done) Bootstrap pin on the original personal fork branch. +# 2. (current) Pin to project-llzk/veir at the accepted SHA below +# (the fork is now organization-owned; see docs/harness/PINS.md). # 3. (eventually) Upstream the LLZK port to opencompl/veir; # migrate this pin to opencompl/veir. # @@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] [[require]] name = "VeIR" git = "https://github.com/project-llzk/veir.git" -rev = "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04" +rev = "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" [[lean_lib]] name = "LlzkLean" diff --git a/reviews/PHASE-01/adversarial-review.md b/reviews/PHASE-01/adversarial-review.md new file mode 100644 index 0000000..8993f2c --- /dev/null +++ b/reviews/PHASE-01/adversarial-review.md @@ -0,0 +1,25 @@ +# Phase 1 Adversarial Review + +Repository: llzk-lean + +## Checks + +- Dirty dependency rejection: `scripts/harness/verify-pins.sh --workspace-veir + ../veir` was run before cleanup and failed while the dependency checkout was + dirty and Lake files still named the old pin. +- Clean dependency acceptance: the same command was run after cleanup and + passed only after `lakefile.toml`, `lake-manifest.json`, and + `.lake/packages/VeIR` agreed on + `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. +- Source spoof rejection: a temp-copy Lakefile and manifest with the accepted + commit but a non-canonical VeIR URL was rejected. +- Manifest inputRev rejection: a temp-copy manifest with accepted `rev` but + stale `inputRev` was rejected. +- Build check: `lake build` was run after the dependency refresh to ensure the + accepted pin is buildable without hidden local dependency edits. + +## Result + +The dirty `.lake/packages/VeIR` proof state was rejected as acceptance evidence. +The accepted Phase 1 state is the clean remote VeIR commit recorded in +`docs/harness/PINS.md`. diff --git a/reviews/PHASE-01/disposition.md b/reviews/PHASE-01/disposition.md new file mode 100644 index 0000000..2b1a971 --- /dev/null +++ b/reviews/PHASE-01/disposition.md @@ -0,0 +1,64 @@ +# Phase 1 Disposition + +Repository: llzk-lean + +## P1-L1 + +Disposition: fixed + +The dirty dependency diff and untracked file were preserved under +`reviews/PHASE-01/evidence/` before cleanup. `.lake/packages/VeIR` was then +reset to the accepted commit +`d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`; post-transition evidence records a +clean checkout. + +## P1-L2 + +Disposition: fixed + +`lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR` now agree on +`d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. `scripts/harness/verify-pins.sh` +is the strict gate for this invariant. + +## P1-L3 + +Disposition: fixed + +`scripts/harness/verify-pins.sh` now verifies the VeIR `git` URL in +`lakefile.toml` and the VeIR `url` field in `lake-manifest.json` against +`https://github.com/project-llzk/veir.git`. The URL spoof adversarial probe is +recorded in `evidence/adversarial-url-spoof-after.txt` and exits non-zero as +expected. + +## P1-L4 + +Disposition: fixed + +`scripts/harness/verify-pins.sh` now verifies `lake-manifest.json` `inputRev` +against the accepted commit. The stale-`inputRev` adversarial probe is recorded +in `evidence/adversarial-inputrev-after.txt` and exits non-zero as expected. + +## P1-L5 + +Disposition: fixed + +`LlzkLean.CertValidate` now excludes shared rewrite tail helpers from the +catalog coverage scan, so the informational uncovered count matches the current +stub expectation under the accepted VeIR pin. + +## P1-L6 + +Disposition: fixed + +`docs/phases/PHASE-01-pins-and-repro.md` now records `Status: active`. + +## Closure Rule + +Phase 1 is closed only if the final evidence includes: + +- `scripts/harness/verify-pins.sh --workspace-veir ../veir` +- `scripts/harness/doctor.sh --workspace-veir ../veir` +- `lake build` +- adversarial URL and `inputRev` spoof probes +- `scripts/harness/check-doc-freshness.sh` +- `scripts/harness/validate-skills.sh` diff --git a/reviews/PHASE-01/evidence/adversarial-inputrev-after.txt b/reviews/PHASE-01/evidence/adversarial-inputrev-after.txt new file mode 100644 index 0000000..cdf54e0 --- /dev/null +++ b/reviews/PHASE-01/evidence/adversarial-inputrev-after.txt @@ -0,0 +1,16 @@ +accepted VeIR pin: d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d52917ca4a57 +PASS: lake-manifest.json pins VeIR d52917ca4a57 +FAIL: lake-manifest.json VeIR inputRev 09d5f00f0d2b4a8710afbe53dfdd7cf468578a04 does not match d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d52917ca4a57 +PASS: dependency checkout HEAD is d52917ca4a57 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d52917ca4a57 + +pin verification summary: 1 fail, 0 warn, mode=strict +exit=1 diff --git a/reviews/PHASE-01/evidence/adversarial-review.txt b/reviews/PHASE-01/evidence/adversarial-review.txt new file mode 100644 index 0000000..8993f2c --- /dev/null +++ b/reviews/PHASE-01/evidence/adversarial-review.txt @@ -0,0 +1,25 @@ +# Phase 1 Adversarial Review + +Repository: llzk-lean + +## Checks + +- Dirty dependency rejection: `scripts/harness/verify-pins.sh --workspace-veir + ../veir` was run before cleanup and failed while the dependency checkout was + dirty and Lake files still named the old pin. +- Clean dependency acceptance: the same command was run after cleanup and + passed only after `lakefile.toml`, `lake-manifest.json`, and + `.lake/packages/VeIR` agreed on + `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. +- Source spoof rejection: a temp-copy Lakefile and manifest with the accepted + commit but a non-canonical VeIR URL was rejected. +- Manifest inputRev rejection: a temp-copy manifest with accepted `rev` but + stale `inputRev` was rejected. +- Build check: `lake build` was run after the dependency refresh to ensure the + accepted pin is buildable without hidden local dependency edits. + +## Result + +The dirty `.lake/packages/VeIR` proof state was rejected as acceptance evidence. +The accepted Phase 1 state is the clean remote VeIR commit recorded in +`docs/harness/PINS.md`. diff --git a/reviews/PHASE-01/evidence/adversarial-url-spoof-after.txt b/reviews/PHASE-01/evidence/adversarial-url-spoof-after.txt new file mode 100644 index 0000000..e4f863c --- /dev/null +++ b/reviews/PHASE-01/evidence/adversarial-url-spoof-after.txt @@ -0,0 +1,16 @@ +accepted VeIR pin: d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +FAIL: lakefile.toml VeIR git URL file:///tmp/not-canonical-veir.git does not match https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d52917ca4a57 +PASS: lake-manifest.json pins VeIR d52917ca4a57 +PASS: lake-manifest.json inputRev pins VeIR d52917ca4a57 +FAIL: lake-manifest.json VeIR URL file:///tmp/not-canonical-veir.git does not match https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d52917ca4a57 +PASS: dependency checkout HEAD is d52917ca4a57 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d52917ca4a57 + +pin verification summary: 2 fail, 0 warn, mode=strict +exit=1 diff --git a/reviews/PHASE-01/evidence/check-doc-freshness.txt b/reviews/PHASE-01/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..fa09159 --- /dev/null +++ b/reviews/PHASE-01/evidence/check-doc-freshness.txt @@ -0,0 +1,34 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: SOURCES records accepted VeIR pin +PASS: PINS records accepted VeIR commit +PASS: Phase 1 disposition exists +PASS: evidence present reviews/PHASE-01/evidence/dependency-status-before.txt +PASS: evidence present reviews/PHASE-01/evidence/dependency-dirty-diff.txt +PASS: evidence present reviews/PHASE-01/evidence/verify-pins-before.txt +PASS: evidence present reviews/PHASE-01/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-01/evidence/adversarial-url-spoof-after.txt +PASS: evidence present reviews/PHASE-01/evidence/adversarial-inputrev-after.txt +PASS: evidence present reviews/PHASE-01/evidence/doctor-strict-after.txt +PASS: evidence present reviews/PHASE-01/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-01/evidence/dependency-status-after.txt +PASS: evidence present reviews/PHASE-01/evidence/adversarial-review.txt + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-01/evidence/dependency-dirty-diff.txt b/reviews/PHASE-01/evidence/dependency-dirty-diff.txt new file mode 100644 index 0000000..448b9c6 --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-dirty-diff.txt @@ -0,0 +1,157 @@ +diff --git a/Veir/Passes/Felt/Combine.lean b/Veir/Passes/Felt/Combine.lean +index f04f378cd..06daf5c10 100644 +--- a/Veir/Passes/Felt/Combine.lean ++++ b/Veir/Passes/Felt/Combine.lean +@@ -6,13 +6,21 @@ import Veir.Passes.Felt.Matching + -- are orphan files in the current lakefile; we depart from that + -- precedent here to defend against silent proof bitrot.) + import Veir.Passes.Felt.Proofs ++-- Fully sorry-free, axiom-clean versions of `right_identity_zero_add` and ++-- `constant_fold_add` (rewriter preconditions discharged, not admitted). ++import Veir.Passes.Felt.RewriteLemmas + + namespace Veir.FeltPass + + /-! + Felt-dialect peephole combines. + +- 15 verified rewrites as of Tier 1+2 (2026-05-20): ++ 15 peephole rewrites as of Tier 1+2 (2026-05-20). They cover **5 of ++ the 18 `felt` opcodes** (`const`, `add`, `sub`, `mul`, `neg`); the ++ other 13 (`div`, `inv`, `pow`, `uintdiv`/`sintdiv`, `umod`/`smod`, ++ `bit_and`/`bit_or`/`bit_xor`/`bit_not`, `shl`/`shr`) are declared in ++ the opcode enum but have no properties, matcher, pattern, proof, or ++ interpreter case — the field- and prime-dependent ops are not ported. + + - Phase E.1–E.4 (4): `right_identity_zero_add` (x+0→x), + `constant_fold_add` (c1+c2), `self_subtraction_to_zero` (x-x→0), +@@ -26,50 +34,35 @@ namespace Veir.FeltPass + `sub_add_const_cancel` ((x-c)+c→x), `assoc_const_fold_mul` + ((x·c1)·c2 → x·(c1·c2)). + +- Each pattern has a paired soundness theorem in +- `Veir/Passes/Felt/Proofs.lean` proved against +- `Felt p := ZMod p` (Phase E.5). All identities hold in any +- commutative ring; primality is not yet threaded through. ++ ## What "verified" means here (read before relying on it) ++ ++ Each pattern has a paired theorem in `Veir/Passes/Felt/Proofs.lean` ++ proving the **algebraic identity** over `Felt p := ZMod p` (Phase ++ E.5; holds in any commutative ring — primality is not threaded). That ++ theorem is machine-checked and axiom-clean. **However**, the link ++ from the theorem to the IR rewrite is NOT proven: every rewriter ++ well-formedness precondition below is discharged with `sorry` ++ (`set_option warn.sorry false` suppresses the warning), so this pass ++ transitively depends on `sorryAx`. The theorems justify the *arithmetic*; ++ they do not establish that the *IR transformation* is semantics- or ++ well-formedness-preserving. Discharging the preconditions (via the ++ sorry-free `WfRewriter` layer) is tracked as follow-up. See `REVIEW.md` ++ (findings VC2/VC3) for the full trust-boundary writeup. + + Style note: each pattern follows the same shape — syntactic + `matchX`, build replacement op(s), `replaceValue` + `eraseOp` (for + pure projection) or `replaceOp` (when synthesizing a new op). +- Rewriter precondition `sorry`s are consistent with current VEIR +- pass-side practice (see `harness/coverage.md` §Verification +- machinery, "Pattern preconditions discharged" row). + -/ + + /-! # Lowering Patterns -/ + +-set_option warn.sorry false in +-/-- felt.add x (felt.const 0) -> x -/ +-def right_identity_zero_add (rewriter : PatternRewriter OpCode) (op : OperationPtr) : +- Option (PatternRewriter OpCode) := do +- let some (lhs, rhs, _) := matchAdd op rewriter.ctx | return rewriter +- let some rhsOp := rhs.getDefiningOp! rewriter.ctx.raw | return rewriter +- let some cst := matchConst rhsOp rewriter.ctx | return rewriter +- if cst.value.value ≠ 0 then return rewriter +- let rewriter ← rewriter.replaceValue (op.getResult 0) lhs sorry sorry +- rewriter.eraseOp op sorry sorry sorry +- +-set_option warn.sorry false in +-/-- felt.add (felt.const c1) (felt.const c2) -> felt.const (c1+c2) -/ +-def constant_fold_add (rewriter : PatternRewriter OpCode) (op : OperationPtr) : +- Option (PatternRewriter OpCode) := do +- let some (lhs, rhs, _) := matchAdd op rewriter.ctx | return rewriter +- let some cstL := matchConstFromValue lhs rewriter.ctx | return rewriter +- let some cstR := matchConstFromValue rhs rewriter.ctx | return rewriter +- let sumVal := cstL.value.value + cstR.value.value +- -- Preserve the input constants' field type (they're TypesUnify'd by +- -- felt.add's input constraint, so picking either is fine). +- let cstProp : FeltConstProperties := +- { value := { value := sumVal, fieldType := cstL.value.fieldType } } +- -- lhs and the original add result share the same `!felt.type` type; +- -- reuse lhs's type for the new const op (mirrors InstCombine's pattern). +- let resultType := lhs.getType! rewriter.ctx.raw +- let (rewriter, newOp) ← rewriter.createOp (OpCode.felt Felt.const) +- #[resultType] #[] #[] #[] cstProp (some <| .before op) sorry sorry sorry sorry +- rewriter.replaceOp op newOp sorry sorry sorry sorry sorry ++-- `right_identity_zero_add` (felt.add x (felt.const 0) → x) and ++-- `constant_fold_add` (felt.add (const c1) (const c2) → const (c1+c2)) are now ++-- the fully sorry-free, axiom-clean versions in `RewriteLemmas.lean` (imported ++-- above). They are referenced unqualified by the `Combine` pass list below. ++-- The remaining 13 patterns still admit their rewriter preconditions with ++-- `sorry` (see REVIEW.md VC2); porting them onto the same lemma library + ++-- defensive-guard recipe is tracked follow-up. + + set_option warn.sorry false in + /-- felt.sub x x -> felt.const 0 -/ +@@ -110,6 +103,8 @@ def assoc_const_fold_add (rewriter : PatternRewriter OpCode) (op : OperationPtr) + let some (x, c1Val, _) := matchAddFromValue innerVal rewriter.ctx | return rewriter + -- Inner add's rhs must be a constant. + let some c1 := matchConstFromValue c1Val rewriter.ctx | return rewriter ++ -- VC3: require matching field types before folding (see constant_fold_add). ++ if c1.value.fieldType ≠ c2.value.fieldType then return rewriter + -- Build the combined constant (c1+c2) and create a fresh add. + let combinedVal := c1.value.value + c2.value.value + let combinedCst : FeltConstProperties := +@@ -169,6 +164,8 @@ def constant_fold_sub (rewriter : PatternRewriter OpCode) (op : OperationPtr) : + let some (lhs, rhs, _) := matchSub op rewriter.ctx | return rewriter + let some cstL := matchConstFromValue lhs rewriter.ctx | return rewriter + let some cstR := matchConstFromValue rhs rewriter.ctx | return rewriter ++ -- VC3: require matching field types before folding (see constant_fold_add). ++ if cstL.value.fieldType ≠ cstR.value.fieldType then return rewriter + let diffVal := cstL.value.value - cstR.value.value + let cstProp : FeltConstProperties := + { value := { value := diffVal, fieldType := cstL.value.fieldType } } +@@ -184,6 +181,8 @@ def constant_fold_mul (rewriter : PatternRewriter OpCode) (op : OperationPtr) : + let some (lhs, rhs, _) := matchMul op rewriter.ctx | return rewriter + let some cstL := matchConstFromValue lhs rewriter.ctx | return rewriter + let some cstR := matchConstFromValue rhs rewriter.ctx | return rewriter ++ -- VC3: require matching field types before folding (see constant_fold_add). ++ if cstL.value.fieldType ≠ cstR.value.fieldType then return rewriter + let prodVal := cstL.value.value * cstR.value.value + let cstProp : FeltConstProperties := + { value := { value := prodVal, fieldType := cstL.value.fieldType } } +@@ -293,6 +292,8 @@ def assoc_const_fold_mul (rewriter : PatternRewriter OpCode) (op : OperationPtr) + let some c2 := matchConstFromValue c2Val rewriter.ctx | return rewriter + let some (x, c1Val, _) := matchMulFromValue innerVal rewriter.ctx | return rewriter + let some c1 := matchConstFromValue c1Val rewriter.ctx | return rewriter ++ -- VC3: require matching field types before folding (see constant_fold_add). ++ if c1.value.fieldType ≠ c2.value.fieldType then return rewriter + let combinedVal := c1.value.value * c2.value.value + let combinedCst : FeltConstProperties := + { value := { value := combinedVal, fieldType := c1.value.fieldType } } +diff --git a/Veir/Passes/Felt/Proofs.lean b/Veir/Passes/Felt/Proofs.lean +index 75040b5e8..9ff7d8585 100644 +--- a/Veir/Passes/Felt/Proofs.lean ++++ b/Veir/Passes/Felt/Proofs.lean +@@ -4,11 +4,12 @@ import Veir.Data.Felt.Basic + Soundness proofs for `Veir/Passes/Felt/Combine.lean`. + + Each pattern in `Combine.lean` is paired with an algebraic identity +- here. The pattern matches the syntactic shape; this file proves the +- semantic equivalence. The pass-side `sorry`s on rewriter preconditions +- are consistent with current VEIR practice (see `harness/coverage.md` +- §Verification machinery); the bar this file clears is the semantic +- theorem, not the precondition discharge. ++ here, proven over `Felt p := ZMod p`. This file proves the *arithmetic ++ identity only*; it does NOT prove that the IR rewrite preserves program ++ semantics or well-formedness. The pass-side rewriter preconditions are ++ discharged with `sorry` in `Combine.lean`, so the bar this file clears ++ is the algebraic theorem, not the transformation. See `REVIEW.md` ++ (finding VC2) for the full trust-boundary writeup. + + Phase E.5 (2026-05-19) upgraded the proof model from `abbrev Felt + := Int` to `abbrev Felt p := ZMod p`. Each theorem now universally diff --git a/reviews/PHASE-01/evidence/dependency-ref-after.txt b/reviews/PHASE-01/evidence/dependency-ref-after.txt new file mode 100644 index 0000000..b35a25e --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-ref-after.txt @@ -0,0 +1 @@ +d52917ca4a57c4094b1aa61dd413aca4e1c2a56e diff --git a/reviews/PHASE-01/evidence/dependency-ref-before.txt b/reviews/PHASE-01/evidence/dependency-ref-before.txt new file mode 100644 index 0000000..367e2c9 --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-ref-before.txt @@ -0,0 +1 @@ +09d5f00f0d2b4a8710afbe53dfdd7cf468578a04 diff --git a/reviews/PHASE-01/evidence/dependency-status-after.txt b/reviews/PHASE-01/evidence/dependency-status-after.txt new file mode 100644 index 0000000..4e6b354 --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-status-after.txt @@ -0,0 +1 @@ + diff --git a/reviews/PHASE-01/evidence/dependency-status-before.txt b/reviews/PHASE-01/evidence/dependency-status-before.txt new file mode 100644 index 0000000..2ffe0e9 --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-status-before.txt @@ -0,0 +1,3 @@ + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean diff --git a/reviews/PHASE-01/evidence/dependency-untracked-RewriteLemmas.head.txt b/reviews/PHASE-01/evidence/dependency-untracked-RewriteLemmas.head.txt new file mode 100644 index 0000000..dab2031 --- /dev/null +++ b/reviews/PHASE-01/evidence/dependency-untracked-RewriteLemmas.head.txt @@ -0,0 +1,260 @@ +import Veir.Passes.Matching +import Veir.Passes.Felt.Matching + +namespace Veir + +theorem matchOp_spec {op : OperationPtr} {ctx : IRContext OpCode} {opType : OpCode} + {n : Nat} {r : Array ValuePtr × propertiesOf opType} + (h : matchOp op ctx opType n = some r) : + op.getOpType! ctx = opType ∧ op.getNumOperands! ctx = n ∧ op.getNumResults! ctx = 1 := by + simp only [matchOp, bind, Option.bind, guard, pure, failure] at h + grind + +/-- Generalized in-bounds: a successful `matchOp` for ANY `opType` (whose value differs + from the default operation's opType) implies the matched op is in bounds. The + per-opcode wrappers below pin `opType` so `decide` discharges the inequality. -/ +theorem matchOp_inBounds {op : OperationPtr} {ctx : IRContext OpCode} {opType : OpCode} + {n : Nat} {r : Array ValuePtr × propertiesOf opType} + (hd : (default : Operation OpCode).opType ≠ opType) + (h : matchOp op ctx opType n = some r) : op.InBounds ctx := by + have hspec := (matchOp_spec h).1 + refine Decidable.byContradiction (fun hb => ?_) + rw [OperationPtr.getOpType!, OperationPtr.get!_of_not_inBounds hb] at hspec + exact absurd hspec hd + +theorem matchOp_inBounds_add {op : OperationPtr} {ctx : IRContext OpCode} {n : Nat} + {r : Array ValuePtr × propertiesOf (OpCode.felt Felt.add)} + (h : matchOp op ctx (OpCode.felt Felt.add) n = some r) : op.InBounds ctx := + matchOp_inBounds (by decide) h + +theorem matchOp_inBounds_mul {op : OperationPtr} {ctx : IRContext OpCode} {n : Nat} + {r : Array ValuePtr × propertiesOf (OpCode.felt Felt.mul)} + (h : matchOp op ctx (OpCode.felt Felt.mul) n = some r) : op.InBounds ctx := + matchOp_inBounds (by decide) h + +theorem matchOp_inBounds_sub {op : OperationPtr} {ctx : IRContext OpCode} {n : Nat} + {r : Array ValuePtr × propertiesOf (OpCode.felt Felt.sub)} + (h : matchOp op ctx (OpCode.felt Felt.sub) n = some r) : op.InBounds ctx := + matchOp_inBounds (by decide) h + +theorem matchOp_inBounds_neg {op : OperationPtr} {ctx : IRContext OpCode} {n : Nat} + {r : Array ValuePtr × propertiesOf (OpCode.felt Felt.neg)} + (h : matchOp op ctx (OpCode.felt Felt.neg) n = some r) : op.InBounds ctx := + matchOp_inBounds (by decide) h + +theorem matchOp_inBounds_const {op : OperationPtr} {ctx : IRContext OpCode} {n : Nat} + {r : Array ValuePtr × propertiesOf (OpCode.felt Felt.const)} + (h : matchOp op ctx (OpCode.felt Felt.const) n = some r) : op.InBounds ctx := + matchOp_inBounds (by decide) h + +namespace FeltPass + +theorem matchAdd_inBounds {op : OperationPtr} {ctx : IRContext OpCode} + {r : ValuePtr × ValuePtr × propertiesOf (OpCode.felt Felt.add)} + (h : matchAdd op ctx = some r) : op.InBounds ctx := by + unfold matchAdd at h + simp only [bind, Option.bind] at h + split at h <;> first | exact matchOp_inBounds_add (by assumption) | simp_all + +theorem matchMul_inBounds {op : OperationPtr} {ctx : IRContext OpCode} + {r : ValuePtr × ValuePtr × propertiesOf (OpCode.felt Felt.mul)} + (h : matchMul op ctx = some r) : op.InBounds ctx := by + unfold matchMul at h + simp only [bind, Option.bind] at h + split at h <;> first | exact matchOp_inBounds_mul (by assumption) | simp_all + +theorem matchSub_inBounds {op : OperationPtr} {ctx : IRContext OpCode} + {r : ValuePtr × ValuePtr × propertiesOf (OpCode.felt Felt.sub)} + (h : matchSub op ctx = some r) : op.InBounds ctx := by + unfold matchSub at h + simp only [bind, Option.bind] at h + split at h <;> first | exact matchOp_inBounds_sub (by assumption) | simp_all + +theorem matchNeg_inBounds {op : OperationPtr} {ctx : IRContext OpCode} + {r : ValuePtr × propertiesOf (OpCode.felt Felt.neg)} + (h : matchNeg op ctx = some r) : op.InBounds ctx := by + unfold matchNeg at h + simp only [bind, Option.bind] at h + split at h <;> first | exact matchOp_inBounds_neg (by assumption) | simp_all + +theorem matchConst_inBounds {op : OperationPtr} {ctx : IRContext OpCode} + {r : propertiesOf (OpCode.felt Felt.const)} + (h : matchConst op ctx = some r) : op.InBounds ctx := by + unfold matchConst at h + simp only [bind, Option.bind] at h + split at h <;> first | exact matchOp_inBounds_const (by assumption) | simp_all + +/-- The `PatternRewriter.replaceValue` postcondition, exposed as a relation between the + raw contexts via `Rewriter.replaceValue?`. -/ +theorem replaceValue_post + (rewriter rewriter' : PatternRewriter OpCode) (oldVal newVal : ValuePtr) + (oldIn : oldVal.InBounds rewriter.ctx.raw) (newIn : newVal.InBounds rewriter.ctx.raw) + (h : rewriter.replaceValue oldVal newVal oldIn newIn = some rewriter') : + ∃ o n c d, + Rewriter.replaceValue? rewriter.ctx.raw oldVal newVal o n c d = some rewriter'.ctx.raw := by + -- `(addUsersInWorklist …)` only touches the worklist, leaving `.ctx = rewriter.ctx`; after + -- unfolding, `simp_all` closes the goal using that equation together with the inner + -- `replaceValue?` result equation. + unfold PatternRewriter.replaceValue WfRewriter.replaceValue at h + simp only [pure] at h + split at h + · simp at h + · rename_i rawCtx hreplace + split at hreplace + · simp at hreplace + · rename_i c hc + have hctx := PatternRewriter.addUsersInWorklist_same_ctx (rewriter := rewriter) + (value := oldVal) (hv := oldIn) + refine ⟨oldIn, newIn, ?_, 1_000_000_000, ?_⟩ + · grind + · -- `hc` gives the raw result `c`; tie it back to `rewriter'.ctx.raw`. + simp only [Option.some.injEq] at h hreplace + subst h + simp only [← hreplace, ← hctx] + exact hc + +/-- `replaceValue` preserves an operation's region count. -/ +theorem getNumRegions!_replaceValue + (rewriter rewriter' : PatternRewriter OpCode) (oldVal newVal : ValuePtr) (op : OperationPtr) + (oldIn : oldVal.InBounds rewriter.ctx.raw) (newIn : newVal.InBounds rewriter.ctx.raw) + (h : rewriter.replaceValue oldVal newVal oldIn newIn = some rewriter') : + op.getNumRegions! rewriter'.ctx.raw = op.getNumRegions! rewriter.ctx.raw := by + obtain ⟨o, n, c, d, hrv⟩ := replaceValue_post rewriter rewriter' oldVal newVal oldIn newIn h + exact OperationPtr.getNumRegions!_replaceValue? hrv + +/-- `replaceValue` preserves `InBounds` of an operation. -/ +theorem inBounds_replaceValue + (rewriter rewriter' : PatternRewriter OpCode) (oldVal newVal : ValuePtr) (op : OperationPtr) + (oldIn : oldVal.InBounds rewriter.ctx.raw) (newIn : newVal.InBounds rewriter.ctx.raw) + (hOp : op.InBounds rewriter.ctx.raw) + (h : rewriter.replaceValue oldVal newVal oldIn newIn = some rewriter') : + op.InBounds rewriter'.ctx.raw := by + obtain ⟨o, n, c, d, hrv⟩ := replaceValue_post rewriter rewriter' oldVal newVal oldIn newIn h + have := Rewriter.replaceValue?_inBounds (GenericPtr.operation op) hrv + grind + +/-- `replaceValue` preserves an operation's result count. -/ +theorem getNumResults!_replaceValue + (rewriter rewriter' : PatternRewriter OpCode) (oldVal newVal : ValuePtr) (op : OperationPtr) + (oldIn : oldVal.InBounds rewriter.ctx.raw) (newIn : newVal.InBounds rewriter.ctx.raw) + (hOp : op.InBounds rewriter.ctx.raw) + (h : rewriter.replaceValue oldVal newVal oldIn newIn = some rewriter') : + op.getNumResults! rewriter'.ctx.raw = op.getNumResults! rewriter.ctx.raw := by + obtain ⟨o, n, c, d, hrv⟩ := replaceValue_post rewriter rewriter' oldVal newVal oldIn newIn h + exact Rewriter.replaceValue?_preserves_results_size op hOp hrv + +/-- After `replaceValue oldVal newVal` (with `oldVal ≠ newVal`), `oldVal` has no uses. -/ +theorem hasUses!_oldVal_replaceValue + (rewriter rewriter' : PatternRewriter OpCode) (oldVal newVal : ValuePtr) + (oldIn : oldVal.InBounds rewriter.ctx.raw) (newIn : newVal.InBounds rewriter.ctx.raw) + (hNe : oldVal ≠ newVal) + (h : rewriter.replaceValue oldVal newVal oldIn newIn = some rewriter') : + oldVal.hasUses! rewriter'.ctx.raw = false := by + obtain ⟨o, n, c, d, hrv⟩ := replaceValue_post rewriter rewriter' oldVal newVal oldIn newIn h + exact ValuePtr.hasUses!_replaceValue_oldValue rewriter.ctx.wellFormed hNe hrv + +/-- `felt.add x (felt.const 0) → x`, fully sorry-free. The two defensive guards + (`hRegNe`, `hEq`) supply the only two facts `WfIRContext` does not carry — + `felt.add`'s region count and SSA acyclicity (result ≠ operand) — so the + `eraseOp` preconditions discharge WITHOUT VEIR's `WfIRContext.Dom` axiom. The + guards are sound: they only skip the rewrite in degenerate states impossible + in well-formed IR. -/ +def right_identity_zero_add (rewriter : PatternRewriter OpCode) (op : OperationPtr) : + Option (PatternRewriter OpCode) := do + match h : matchAdd op rewriter.ctx with + | none => return rewriter + | some (lhs, _rhs, _) => + let some rhsOp := _rhs.getDefiningOp! rewriter.ctx.raw | return rewriter + let some cst := matchConst rhsOp rewriter.ctx | return rewriter + if cst.value.value ≠ 0 then return rewriter + -- Defensive guards for the two facts WfIRContext does not carry. + if hRegNe : op.getNumRegions! rewriter.ctx.raw ≠ 0 then return rewriter else + if hEq : (op.getResult 0 : ValuePtr) = lhs then return rewriter else + have hReg0 : op.getNumRegions! rewriter.ctx.raw = 0 := by omega + have hNe : (op.getResult 0 : ValuePtr) ≠ lhs := hEq + -- Facts established from the match. + have hIn : op.InBounds rewriter.ctx.raw := matchAdd_inBounds h + have hWf : rewriter.ctx.raw.WellFormed := rewriter.ctx.wellFormed + have hFib : rewriter.ctx.raw.FieldsInBounds := hWf.inBounds + -- The guards inside `matchOp` must have passed for `matchAdd` to succeed, so `matchOp` + -- returns `some (getOperands!, getProperties!)`. + -- The `matchOp` inside `matchAdd` returned some value; its spec gives the operand/result + -- counts, and `lhs` is operand 0. + have key : op.getNumOperands! rewriter.ctx.raw = 2 ∧ + op.getNumResults! rewriter.ctx.raw = 1 ∧ + lhs = (op.getOperands! rewriter.ctx.raw)[0]! := by + have h' := h + simp only [matchAdd] at h' + rcases hb : matchOp op rewriter.ctx.raw (OpCode.felt Felt.add) 2 with _ | ⟨o, p⟩ + · simp [hb] at h' + · have hsp := matchOp_spec hb + rw [hb] at h' + simp only [bind, Option.bind, pure, Option.some.injEq, Prod.mk.injEq] at h' + have hoeq : o = op.getOperands! rewriter.ctx.raw := by + simp only [matchOp, bind, Option.bind, guard, pure] at hb; grind + grind + have hNumOps : op.getNumOperands! rewriter.ctx.raw = 2 := key.1 + have hNumRes : op.getNumResults! rewriter.ctx.raw = 1 := key.2.1 + have hLhsEq : lhs = (op.getOperands! rewriter.ctx.raw)[0]! := key.2.2 + -- Obligation #1: `(op.getResult 0).InBounds`. + have hResIn : (op.getResult 0 : ValuePtr).InBounds rewriter.ctx.raw := by + rw [ValuePtr.inBounds_opResult] + exact op.getResult_inBounds hIn 0 (by grind) + -- Obligation #2: `lhs.InBounds`. `lhs = (op.getOperands! ctx)[0]!`, a member of the + -- operands array (size = numOperands = 2 > 0), hence in bounds. + have hLhsMem : lhs ∈ op.getOperands! rewriter.ctx.raw := by + have hsize : (op.getOperands! rewriter.ctx.raw).size = 2 := by + rw [OperationPtr.getOperands!.size_eq_getNumOperands!]; exact hNumOps + rw [hLhsEq, OperationPtr.getOperands!.getElem!_eq_getOperand!, + ← OperationPtr.getOperands!.getElem_eq_getOperand! (h := by omega)] + exact Array.getElem_mem (by omega) + have hLhsIn : lhs.InBounds rewriter.ctx.raw := + OperationPtr.getOperands!_inBounds hFib hIn hLhsMem + match hrep : rewriter.replaceValue (op.getResult 0) lhs hResIn hLhsIn with + | none => none + | some rewriter' => + -- Obligation #3: `replaceValue` preserves region count, reducing to the pre-state count + -- (which the matcher does not constrain — see report). + have hRegions : op.getNumRegions! rewriter'.ctx.raw = op.getNumRegions! rewriter.ctx.raw := + getNumRegions!_replaceValue rewriter rewriter' _ _ op hResIn hLhsIn hrep + -- Obligation #5: `replaceValue` preserves `InBounds`. + have hOpIn' : op.InBounds rewriter'.ctx.raw := + inBounds_replaceValue rewriter rewriter' _ _ op hResIn hLhsIn hIn hrep + -- Obligation #4: after replacing all uses of `op.getResult 0` by `lhs`, the (sole) + -- result has no uses, hence neither does `op`. + have hNumRes' : op.getNumResults! rewriter'.ctx.raw = 1 := by + rw [getNumResults!_replaceValue rewriter rewriter' _ _ op hResIn hLhsIn hIn hrep] + exact hNumRes + have hNoUses : op.hasUses! rewriter'.ctx.raw = false := by + rw [OperationPtr.hasUses!_eq_false_iff_hasUses!_getResult_eq_false] + intro i hi + rw [hNumRes'] at hi + obtain rfl : i = 0 := by omega + exact hasUses!_oldVal_replaceValue rewriter rewriter' _ _ hResIn hLhsIn hNe hrep + -- eraseOp opRegions: via `hRegions` (replaceValue preserves region count) this + -- reduces to the guarded `hReg0`. + rewriter'.eraseOp op (hRegions.trans hReg0) (by simp [hNoUses]) hOpIn' + +/-- The `PatternRewriter.createOp` postcondition, exposed as a relation between the raw + contexts via `Rewriter.createOp`. -/ +theorem createOp_post + (rewriter rewriter' : PatternRewriter OpCode) (opType : OpCode) + (resultTypes : Array TypeAttr) (operands : Array ValuePtr) (blockOperands : Array BlockPtr) + (regions : Array RegionPtr) (properties : propertiesOf opType) + (insertionPoint : Option InsertPoint) (newOp : OperationPtr) + (hoper : ∀ oper, oper ∈ operands → oper.InBounds rewriter.ctx.raw) + (hblockOperands : ∀ blockOper, blockOper ∈ blockOperands → blockOper.InBounds rewriter.ctx.raw) + (hregions : ∀ region, region ∈ regions → region.InBounds rewriter.ctx.raw) + (hins : insertionPoint.maybe InsertPoint.InBounds rewriter.ctx.raw) + (h : rewriter.createOp opType resultTypes operands blockOperands regions properties + insertionPoint hoper hblockOperands hregions hins = some (rewriter', newOp)) : + ∃ h₅, + Rewriter.createOp rewriter.ctx.raw opType resultTypes operands blockOperands regions + properties insertionPoint hoper hblockOperands hregions hins h₅ + = some (rewriter'.ctx.raw, newOp) := by + unfold PatternRewriter.createOp WfRewriter.createOp at h + simp only [pure] at h + -- The inner `Rewriter.createOp` either fails (contradiction) or yields `(ctx, op)`. + split at h + · -- inner createOp returned none + rename_i hnone diff --git a/reviews/PHASE-01/evidence/doctor-strict-after.txt b/reviews/PHASE-01/evidence/doctor-strict-after.txt new file mode 100644 index 0000000..da312d7 --- /dev/null +++ b/reviews/PHASE-01/evidence/doctor-strict-after.txt @@ -0,0 +1,48 @@ +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +WARN: llzk-lean HEAD 6b4a7ec3aa38 differs from bootstrap input ea2363f87bcc +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d52917ca4a57 +PASS: lake-manifest.json pins VeIR d52917ca4a57 +PASS: lake-manifest.json inputRev pins VeIR d52917ca4a57 +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d52917ca4a57 +PASS: dependency checkout HEAD is d52917ca4a57 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d52917ca4a57 + +pin verification summary: 0 fail, 0 warn, mode=strict +PASS: Phase 1 pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence + +doctor summary: 0 fail, 3 warn, mode=strict diff --git a/reviews/PHASE-01/evidence/doctor-strict-before.txt b/reviews/PHASE-01/evidence/doctor-strict-before.txt new file mode 100644 index 0000000..b4a164f --- /dev/null +++ b/reviews/PHASE-01/evidence/doctor-strict-before.txt @@ -0,0 +1,31 @@ +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +WARN: llzk-lean HEAD 6b4a7ec3aa38 differs from bootstrap input ea2363f87bcc +PASS: Lake files pin VeIR 09d5f00f0d2b +PASS: dependency checkout is at 09d5f00f0d2b +FAIL: dependency checkout is dirty: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +WARN: workspace VeIR repo was not checked; pass --workspace-veir PATH +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/validate-skills.sh +PASS: found reviews/PHASE-00/evidence + +doctor summary: 1 fail, 4 warn, mode=strict diff --git a/reviews/PHASE-01/evidence/lake-build.txt b/reviews/PHASE-01/evidence/lake-build.txt new file mode 100644 index 0000000..5842154 --- /dev/null +++ b/reviews/PHASE-01/evidence/lake-build.txt @@ -0,0 +1,37 @@ +$ lake build +⚠ [39/652] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1238/1240] Built LlzkLean.CertValidate (1.5s) +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +✔ [1239/1240] Built LlzkLean (1.1s) +Build completed successfully (1240 jobs). +exit=0 diff --git a/reviews/PHASE-01/evidence/lake-pin-diff.txt b/reviews/PHASE-01/evidence/lake-pin-diff.txt new file mode 100644 index 0000000..2f9847e --- /dev/null +++ b/reviews/PHASE-01/evidence/lake-pin-diff.txt @@ -0,0 +1,30 @@ +diff --git a/lake-manifest.json b/lake-manifest.json +index c2390f9..a56dcab 100644 +--- a/lake-manifest.json ++++ b/lake-manifest.json +@@ -5,10 +5,10 @@ + "type": "git", + "subDir": null, + "scope": "", +- "rev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", ++ "rev": "d52917ca4a57c4094b1aa61dd413aca4e1c2a56e", + "name": "VeIR", + "manifestFile": "lake-manifest.json", +- "inputRev": "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04", ++ "inputRev": "d52917ca4a57c4094b1aa61dd413aca4e1c2a56e", + "inherited": false, + "configFile": "lakefile.toml"}, + {"url": "https://github.com/leanprover-community/mathlib4", +diff --git a/lakefile.toml b/lakefile.toml +index dcf66cf..84cf955 100644 +--- a/lakefile.toml ++++ b/lakefile.toml +@@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] + [[require]] + name = "VeIR" + git = "https://github.com/project-llzk/veir.git" +-rev = "09d5f00f0d2b4a8710afbe53dfdd7cf468578a04" ++rev = "d52917ca4a57c4094b1aa61dd413aca4e1c2a56e" + + [[lean_lib]] + name = "LlzkLean" diff --git a/reviews/PHASE-01/evidence/local-ref-before.txt b/reviews/PHASE-01/evidence/local-ref-before.txt new file mode 100644 index 0000000..9a55601 --- /dev/null +++ b/reviews/PHASE-01/evidence/local-ref-before.txt @@ -0,0 +1 @@ +6b4a7ec3aa38e2da7e1de23fb347b5c2cbac6386 diff --git a/reviews/PHASE-01/evidence/repo-status-before.txt b/reviews/PHASE-01/evidence/repo-status-before.txt new file mode 100644 index 0000000..3083480 --- /dev/null +++ b/reviews/PHASE-01/evidence/repo-status-before.txt @@ -0,0 +1 @@ +?? reviews/PHASE-01/ diff --git a/reviews/PHASE-01/evidence/validate-skills.txt b/reviews/PHASE-01/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-01/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-01/evidence/verify-pins-after.txt b/reviews/PHASE-01/evidence/verify-pins-after.txt new file mode 100644 index 0000000..fd2c244 --- /dev/null +++ b/reviews/PHASE-01/evidence/verify-pins-after.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d52917ca4a57 +PASS: lake-manifest.json pins VeIR d52917ca4a57 +PASS: lake-manifest.json inputRev pins VeIR d52917ca4a57 +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d52917ca4a57 +PASS: dependency checkout HEAD is d52917ca4a57 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d52917ca4a57 + +pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-01/evidence/verify-pins-before.txt b/reviews/PHASE-01/evidence/verify-pins-before.txt new file mode 100644 index 0000000..a415e5b --- /dev/null +++ b/reviews/PHASE-01/evidence/verify-pins-before.txt @@ -0,0 +1,14 @@ +accepted VeIR pin: d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +FAIL: lakefile.toml VeIR rev 09d5f00f0d2b4a8710afbe53dfdd7cf468578a04 does not match d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +FAIL: lake-manifest.json VeIR rev 09d5f00f0d2b4a8710afbe53dfdd7cf468578a04 does not match d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +PASS: Lake files agree on VeIR 09d5f00f0d2b +FAIL: dependency checkout HEAD 09d5f00f0d2b4a8710afbe53dfdd7cf468578a04 does not match d52917ca4a57c4094b1aa61dd413aca4e1c2a56e +PASS: dependency checkout HEAD equals manifest rev +FAIL: dependency checkout is dirty: + M Veir/Passes/Felt/Combine.lean + M Veir/Passes/Felt/Proofs.lean +?? Veir/Passes/Felt/RewriteLemmas.lean +PASS: workspace VeIR HEAD equals accepted pin d52917ca4a57 + +pin verification summary: 4 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-01/findings.md b/reviews/PHASE-01/findings.md new file mode 100644 index 0000000..1f405c3 --- /dev/null +++ b/reviews/PHASE-01/findings.md @@ -0,0 +1,94 @@ +# Phase 1 Findings + +Repository: llzk-lean + +## P1-L1 - Dirty dependency state could masquerade as proof state + +Severity: Critical + +At bootstrap, `.lake/packages/VeIR` was at +`09d5f00f0d2b4a8710afbe53dfdd7cf468578a04` with modified +`Combine.lean`, modified `Proofs.lean`, and untracked `RewriteLemmas.lean`. +That meant proof-relevant state existed only in a local dependency checkout. + +Evidence: + +- `evidence/dependency-status-before.txt` +- `evidence/dependency-dirty-diff.txt` +- `evidence/verify-pins-before.txt` + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## P1-L2 - Lake metadata and dependency checkout needed a single accepted rev + +Severity: High + +`lakefile.toml` and `lake-manifest.json` previously pinned +`09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. Phase 1 requires both files and +`.lake/packages/VeIR` HEAD to identify the accepted VeIR commit +`d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. + +Evidence: + +- `evidence/lake-pin-diff.txt` +- `evidence/dependency-ref-after.txt` +- `evidence/verify-pins-after.txt` + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## P1-L3 - Accepted remote URL was documented but not enforced + +Severity: High + +The Phase 1 pin mode records `https://github.com/project-llzk/veir.git` as the +accepted source, but the first implementation only checked the commit rev. A +Lakefile and manifest pair using another URL could pass strict verification if +the dependency checkout was locally at the accepted commit. + +Evidence: + +- `evidence/adversarial-url-spoof-after.txt` + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## P1-L4 - Manifest inputRev was not checked + +Severity: Medium + +The first implementation checked `lake-manifest.json` `rev` but not +`inputRev`. A stale `inputRev` could make the manifest internally inconsistent +while strict verification still passed. + +Evidence: + +- `evidence/adversarial-inputrev-after.txt` + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## P1-L5 - Catalog coverage warning was stale under the accepted VeIR pin + +Severity: Medium + +The accepted VeIR pin exposed shared rewrite helper tails in `Veir.FeltPass`, +and `LlzkLean.CertValidate` counted them as rewrite patterns. The build +therefore reported 18 pattern defs and 16 uncovered while still saying +"expected 13 today". + +Evidence: + +- `evidence/lake-build.txt` + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## P1-L6 - Phase file status lagged the active harness state + +Severity: Low + +`docs/phases/PHASE-01-pins-and-repro.md` still said `Status: bootstrap` after +the harness docs marked Phase 1 active. + +Disposition: fixed in `reviews/PHASE-01/disposition.md`. + +## Open Findings + +No open Critical or High findings remain for Phase 1 pin reproducibility. diff --git a/reviews/PHASE-01/request.md b/reviews/PHASE-01/request.md new file mode 100644 index 0000000..6dfbfce --- /dev/null +++ b/reviews/PHASE-01/request.md @@ -0,0 +1,23 @@ +# Phase 1 Review Request + +Requested: 2026-06-05 +Repository: llzk-lean + +Review the Phase 1 reproducible-pin transition: + +- `docs/phases/PHASE-01-pins-and-repro.md` +- `docs/harness/CURRENT.md` +- `docs/harness/SOURCES.md` +- `docs/harness/GATES.md` +- `docs/harness/PINS.md` +- `lakefile.toml` +- `lake-manifest.json` +- `scripts/harness/verify-pins.sh` +- `scripts/harness/doctor.sh` +- `scripts/harness/check-doc-freshness.sh` +- `reviews/PHASE-01/evidence/` + +The review should confirm that llzk-lean no longer depends on dirty +`.lake/packages/VeIR` state, that Lake metadata and dependency checkout agree +on the accepted VeIR commit, and that `lake build` runs against the clean +dependency. diff --git a/reviews/PHASE-02/adversarial-review.md b/reviews/PHASE-02/adversarial-review.md new file mode 100644 index 0000000..fcee150 --- /dev/null +++ b/reviews/PHASE-02/adversarial-review.md @@ -0,0 +1,44 @@ +# Phase 2 Preflight Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-06 + +## Checks Run + +- Phase 1 pin verification passed against `../veir`. +- Strict Phase 1 doctor passed. +- `lake build` succeeded against the clean accepted VeIR pin. +- `../llzk-lib` refs were inspected with `git rev-parse HEAD origin/main`. +- `../llzk-lib` local `main` resolves to + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65`. +- Fetched `../llzk-lib origin/main` resolves to + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Fetched `origin/main` Felt source was inspected through `git show`. + +## Result + +The llzk-lean pin state is reproducible, but Phase 2 must establish a fresh +LLZK Felt source ledger at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` before +certificate, checker, or Strategy A/E source claims can be trusted. + +## Fresh Review After Phase 2 Edits + +Reviewed: 2026-06-06 + +### Findings + +- The first source gate checked the accepted LLZK source and the checker comment + block, but it did not verify the Strategy A source claim, the Lean certificate + catalog, or the committed JSON snapshot that carry the Phase 2 + `constant_fold_add` assumptions. +- llzk-lean could not claim it consumed the Phase 2 VeIR registry update while + Lake still pinned the Phase 1 VeIR commit. + +### Disposition + +- Fixed the source gate by checking the Strategy A field-list claim, checker + registry comments, source ledger field list, Lean `constant_fold_add` + side-conditions, and committed JSON side-conditions. +- Fixed pin propagation by selecting + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and + refreshing `.lake/packages/VeIR` to a clean checkout of that commit. diff --git a/reviews/PHASE-02/disposition.md b/reviews/PHASE-02/disposition.md new file mode 100644 index 0000000..9cff5cf --- /dev/null +++ b/reviews/PHASE-02/disposition.md @@ -0,0 +1,15 @@ +# Phase 2 Disposition + +Repository: llzk-lean +Created: 2026-06-06 + +Findings in `findings.md` are dispositioned as follows: + +- P2-L1: fixed by exact-ref LLZK source ledger and gate. +- P2-L2: fixed by updating certificate/checker source claims and strengthening + the source gate to check exact registry pairs plus local docs/cert artifacts. +- P2-L3: fixed by updating checker registry comments and checking the accepted + built-ins in both comments and source-ledger-backed docs. +- P2-L4: fixed by selecting + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and + refreshing `.lake/packages/VeIR` to a clean checkout of that commit. diff --git a/reviews/PHASE-02/evidence/README.md b/reviews/PHASE-02/evidence/README.md new file mode 100644 index 0000000..65c4360 --- /dev/null +++ b/reviews/PHASE-02/evidence/README.md @@ -0,0 +1,13 @@ +# Phase 2 Evidence + +Populate this directory with exact command output during Phase 2. + +Required evidence: + +- `llzk-lib-refs.txt` +- `llzk-field-registry.txt` +- `llzk-felt-ops.txt` +- `verify-llzk-source-after.txt` +- `verify-pins-after.txt` +- `lake-build-after.txt` +- `adversarial-review.txt` diff --git a/reviews/PHASE-02/evidence/adversarial-review.txt b/reviews/PHASE-02/evidence/adversarial-review.txt new file mode 100644 index 0000000..fcee150 --- /dev/null +++ b/reviews/PHASE-02/evidence/adversarial-review.txt @@ -0,0 +1,44 @@ +# Phase 2 Preflight Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-06 + +## Checks Run + +- Phase 1 pin verification passed against `../veir`. +- Strict Phase 1 doctor passed. +- `lake build` succeeded against the clean accepted VeIR pin. +- `../llzk-lib` refs were inspected with `git rev-parse HEAD origin/main`. +- `../llzk-lib` local `main` resolves to + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65`. +- Fetched `../llzk-lib origin/main` resolves to + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Fetched `origin/main` Felt source was inspected through `git show`. + +## Result + +The llzk-lean pin state is reproducible, but Phase 2 must establish a fresh +LLZK Felt source ledger at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` before +certificate, checker, or Strategy A/E source claims can be trusted. + +## Fresh Review After Phase 2 Edits + +Reviewed: 2026-06-06 + +### Findings + +- The first source gate checked the accepted LLZK source and the checker comment + block, but it did not verify the Strategy A source claim, the Lean certificate + catalog, or the committed JSON snapshot that carry the Phase 2 + `constant_fold_add` assumptions. +- llzk-lean could not claim it consumed the Phase 2 VeIR registry update while + Lake still pinned the Phase 1 VeIR commit. + +### Disposition + +- Fixed the source gate by checking the Strategy A field-list claim, checker + registry comments, source ledger field list, Lean `constant_fold_add` + side-conditions, and committed JSON side-conditions. +- Fixed pin propagation by selecting + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and + refreshing `.lake/packages/VeIR` to a clean checkout of that commit. diff --git a/reviews/PHASE-02/evidence/lake-build-after.txt b/reviews/PHASE-02/evidence/lake-build-after.txt new file mode 100644 index 0000000..8afefbf --- /dev/null +++ b/reviews/PHASE-02/evidence/lake-build-after.txt @@ -0,0 +1,37 @@ +⚠ [39/287] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +✔ [1236/1240] Built Veir.Passes.Felt.InterpModel (490ms) +✔ [1237/1240] Built Veir.Passes.Felt.Combine (3.5s) +ℹ [1238/1240] Built LlzkLean.CertValidate (6.8s) +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +✔ [1239/1240] Built LlzkLean (5.4s) +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-02/evidence/llzk-felt-ops.txt b/reviews/PHASE-02/evidence/llzk-felt-ops.txt new file mode 100644 index 0000000..84ba5c7 --- /dev/null +++ b/reviews/PHASE-02/evidence/llzk-felt-ops.txt @@ -0,0 +1,261 @@ +//===-- Ops.td ---------------------------------------------*- tablegen -*-===// +// +// Part of the LLZK Project, under the Apache License v2.0. +// See LICENSE.txt for license information. +// Copyright 2025 Veridise Inc. +// SPDX-License-Identifier: Apache-2.0 +// +//===----------------------------------------------------------------------===// + +#ifndef LLZK_FELT_OPS +#define LLZK_FELT_OPS + +include "llzk/Dialect/Felt/IR/Dialect.td" +include "llzk/Dialect/Felt/IR/Types.td" +include "llzk/Dialect/Felt/IR/Attrs.td" +include "llzk/Dialect/Function/IR/OpTraits.td" +include "llzk/Dialect/Shared/OpsBase.td" +include "llzk/Dialect/Felt/IR/OpInterfaces.td" + +include "mlir/IR/OpAsmInterface.td" +include "mlir/IR/OpBase.td" +include "mlir/IR/SymbolInterfaces.td" +include "mlir/Interfaces/SideEffectInterfaces.td" + +//===------------------------------------------------------------------===// +// Op Classes +//===------------------------------------------------------------------===// + +class FeltDialectOp traits = []> + : Op; + +class FeltDialectBinaryOp traits = []> + : BinaryOpBase, + DeclareOpInterfaceMethods, + InferTypeOpAdaptorWithIsCompatible]> { + // Allow any type to avoid building default felt for the result type, we + // employ our own inference below. + let results = (outs AnyLLZKType:$result); + let hasFolder = 1; + + let extraClassDefinition = [{ + ::llvm::LogicalResult $cppClass::inferReturnTypes( + mlir::MLIRContext *context, std::optional loc, Adaptor adaptor, + llvm::SmallVectorImpl &inferred + ) { + inferred.resize(1); + auto value = adaptor.getLhs(); + inferred[0] = value ? value.getType() : FeltType::get(context, mlir::StringAttr()); + return mlir::success(); + } + + bool $cppClass::isCompatibleReturnTypes(mlir::TypeRange l, mlir::TypeRange r) { + return l == r; + } + }]; +} + +class FeltDialectUnaryOp traits = []> + : UnaryOpBase { + // Allow any type to avoid building default felt for the result type, we + // employ our own inference below. + let results = (outs AnyLLZKType:$result); + let hasFolder = 1; + + let extraClassDefinition = [{ + ::llvm::LogicalResult $cppClass::inferReturnTypes( + mlir::MLIRContext *context, std::optional loc, Adaptor adaptor, + llvm::SmallVectorImpl &inferred + ) { + inferred.resize(1); + auto value = adaptor.getOperand(); + inferred[0] = value ? value.getType() : FeltType::get(context, mlir::StringAttr()); + return mlir::success(); + } + + bool $cppClass::isCompatibleReturnTypes(mlir::TypeRange l, mlir::TypeRange r) { + return l == r; + } + }]; +} + +//===------------------------------------------------------------------===// +// Constants +//===------------------------------------------------------------------===// + +def LLZK_FeltConstantOp + : FeltDialectOp<"const", [ConstantLike, Pure, + DeclareOpInterfaceMethods< + OpAsmOpInterface, ["getAsmResultNames"]>, + TypeUnifyWithResult<"value">, + InferTypeOpAdaptorWithIsCompatible]> { + let summary = "field element constant"; + let description = [{ + This operation produces a felt-typed SSA value holding an integer constant. + + Example: + + ```llzk + %0 = felt.const 42 + %0 = felt.const 99 <"bn254"> + ``` + }]; + + let arguments = (ins LLZK_FeltConstAttr:$value); + let results = (outs AnyLLZKType:$result); + let assemblyFormat = [{ $value attr-dict }]; + let hasFolder = 1; + let extraClassDeclaration = [{ + auto getValueAPInt() -> ::llvm::APInt { return getValue().getValue(); } + + auto tryGetZExtValue() -> std::optional { return getValueAPInt().tryZExtValue(); } + }]; +} + +//===------------------------------------------------------------------===// +// Operators +//===------------------------------------------------------------------===// + +def LLZK_AddFeltOp : FeltDialectBinaryOp<"add", [Commutative]> { + let summary = "addition operator for field elements"; + let description = [{}]; +} + +def LLZK_SubFeltOp : FeltDialectBinaryOp<"sub"> { + let summary = "subtraction operator for field elements"; + let description = [{}]; +} + +def LLZK_MulFeltOp : FeltDialectBinaryOp<"mul", [Commutative]> { + let summary = "multiplication operator for field elements"; + let description = [{}]; +} + +def LLZK_PowFeltOp : FeltDialectBinaryOp<"pow", [NotFieldNative]> { + let summary = "exponentiation operator for field elements"; + let description = [{ + + Raises a field element to the power of an exponent. + + ```llzk + %result = felt.pow %base, %exponent + ``` + + }]; +} + +def LLZK_DivFeltOp : FeltDialectBinaryOp<"div"> { + let summary = "field-division operator for field elements"; + let description = [{ + Performs finite-field division by multiplying the dividend by the + multiplicative inverse of the divisor. For a non-zero divisor `b`, + `felt.div %a, %b` computes `%a * inv(%b)` modulo the field prime of the result + prime field. + + The divisor must be non-zero. + + This is not integer division. Use `felt.uintdiv` or `felt.sintdiv` when the + operands should be interpreted as integers. + }]; +} + +def LLZK_UnsignedIntDivFeltOp + : FeltDialectBinaryOp<"uintdiv", [NotFieldNative]> { + let summary = "unsigned integer division operator for field elements"; + let description = [{ + Treats the operands as if they were unsigned integers with bitwidth + equal to that of the prime modulus and performs division rounding towards zero. + }]; +} + +def LLZK_SignedIntDivFeltOp : FeltDialectBinaryOp<"sintdiv", [NotFieldNative]> { + let summary = "signed integer division operator for field elements"; + let description = [{ + Treats the operands as if they were signed integers with bitwidth + equal to that of the prime modulus (no additional sign bit is added) + and performs division rounding towards zero. + + The signed integer representation of felt `f` in prime field with modulus + `p` follows the following formula: + + signed_int(f) = f if 0 <= f < p/2 + 1 + "p/2" here is unsigned integer division rounding towards 0 + signed_int(f) = f-p if p/2 + 1 <= f < p + }]; +} + +def LLZK_UnsignedModFeltOp : FeltDialectBinaryOp<"umod", [NotFieldNative]> { + let summary = + "unsigned integer modulus/remainder operator for field elements"; + let description = [{ + Computes the remainder that would result from the division operation performed + by `felt.uintdiv`. + }]; +} + +def LLZK_SignedModFeltOp : FeltDialectBinaryOp<"smod", [NotFieldNative]> { + let summary = "signed integer modulus/remainder operator for field elements"; + let description = [{ + Computes the remainder that would result from the division operation performed + by `felt.sintdiv`. + }]; +} + +def LLZK_NegFeltOp : FeltDialectUnaryOp<"neg"> { + let summary = "negation operator for field elements"; + let description = [{}]; +} + +def LLZK_InvFeltOp : FeltDialectUnaryOp<"inv", [NotFieldNative]> { + let summary = "inverse operator for field elements"; + let description = [{}]; +} + +def LLZK_AndFeltOp + : FeltDialectBinaryOp<"bit_and", [NotFieldNative, Commutative]> { + let summary = "bitwise AND operator for field elements"; + let description = [{}]; +} + +def LLZK_OrFeltOp + : FeltDialectBinaryOp<"bit_or", [NotFieldNative, Commutative]> { + let summary = "bitwise OR operator for field elements"; + let description = [{}]; +} + +def LLZK_XorFeltOp + : FeltDialectBinaryOp<"bit_xor", [NotFieldNative, Commutative]> { + let summary = "bitwise XOR operator for field elements"; + let description = [{}]; +} + +def LLZK_NotFeltOp : FeltDialectUnaryOp<"bit_not", [NotFieldNative]> { + let summary = "integer complement (bitwise-not) operator for field elements"; + let description = [{ + Treats the operand as an integer with a bitwidth equal to the bitwidth + of the prime field's modulus and compute the one's complement of the integer. + The result is converted back to a field element by applying the prime modulus. + }]; +} + +def LLZK_ShlFeltOp : FeltDialectBinaryOp<"shl", [NotFieldNative]> { + let summary = "left shift operator for field elements"; + let description = [{ + Treats both operands as unsigned integer representatives of field elements. + `felt.shl %a, %b` computes `%a * 2^%b`, then converts the result back to a + field element by reducing modulo the field prime. + }]; +} + +def LLZK_ShrFeltOp : FeltDialectBinaryOp<"shr", [NotFieldNative]> { + let summary = "right shift operator for field elements"; + let description = [{ + Treats both operands as unsigned integer representatives of field elements. + `felt.shr %a, %b` computes `%a / 2^%b` using unsigned integer division + rounding towards zero, then converts the result back to a field element. + }]; +} + +#endif // LLZK_FELT_OPS diff --git a/reviews/PHASE-02/evidence/llzk-field-registry.txt b/reviews/PHASE-02/evidence/llzk-field-registry.txt new file mode 100644 index 0000000..5855443 --- /dev/null +++ b/reviews/PHASE-02/evidence/llzk-field-registry.txt @@ -0,0 +1,312 @@ +//===-- Field.cpp -----------------------------------------------*- C++ -*-===// +// +// Part of the LLZK Project, under the Apache License v2.0. +// See LICENSE.txt for license information. +// Copyright 2025 Veridise Inc. +// SPDX-License-Identifier: Apache-2.0 +// +//===----------------------------------------------------------------------===// + +#include "llzk/Util/Field.h" + +#include "llzk/Dialect/Array/IR/Types.h" +#include "llzk/Dialect/Felt/IR/Types.h" +#include "llzk/Dialect/POD/IR/Attrs.h" +#include "llzk/Dialect/POD/IR/Types.h" +#include "llzk/Dialect/Polymorphic/IR/Types.h" +#include "llzk/Dialect/String/IR/Types.h" +#include "llzk/Dialect/Struct/IR/Types.h" +#include "llzk/Util/Constants.h" +#include "llzk/Util/Debug.h" +#include "llzk/Util/DynamicAPIntHelper.h" + +#include +#include +#include + +#include +#include +#include +#include +#include + +#include +#include + +using namespace mlir; + +namespace llzk { + +// Having `knownFields` as a static local object ensures it is initialized when +// `getKnownFields` is called, rather than relying on non-local static initialization +// order (https://en.cppreference.com/cpp/language/initialization). +static DenseMap &getKnownFields() { + static DenseMap knownFields; + return knownFields; +} + +Field::Field(std::string_view primeStr, StringRef name) : Field(APSInt(primeStr), name) {} + +Field::Field(const APInt &prime, StringRef name) : primeName(name) { + primeMod = toDynamicAPInt(prime); + halfPrime = (primeMod + felt(1)) / felt(2); + bitwidth = prime.getBitWidth(); +} + +FailureOr> Field::tryGetField(StringRef fieldName) { + static std::once_flag fieldsInit; + std::call_once(fieldsInit, initKnownFields); + + auto &knownFields = getKnownFields(); + if (auto it = knownFields.find(fieldName); it != knownFields.end()) { + return {it->second}; + } + return failure(); +} + +LogicalResult Field::verifyFieldDefined(StringRef fieldName, EmitErrorFn errFn) { + if (failed(Field::tryGetField(fieldName))) { + return errFn().append("field '", fieldName, "' is not defined"); + } + return success(); +} + +const Field &Field::getField(StringRef fieldName, EmitErrorFn errFn) { + auto res = tryGetField(fieldName); + if (succeeded(res)) { + return res.value().get(); + } + std::string msg = "field \"" + fieldName.str() + "\" is unsupported"; + if (errFn) { + errFn().append(msg).report(); + } + llvm::report_fatal_error(msg.c_str()); +} + +void Field::addField(Field &&f, EmitErrorFn errFn) { + // Use `tryGetField()` to ensure knownFields is initialized before checking for conflicts. + auto existing = Field::tryGetField(f.name()); + if (succeeded(existing)) { + // Field exists and conflicts with existing definition. + std::string msg; + debug::Appender(msg) << "Definition of \"" << f.name() + << "\" conflicts with prior definition: prior=" + << existing.value().get().prime() << ", new=" << f.prime(); + if (errFn) { + errFn().append(msg).report(); + } else { + llvm::report_fatal_error(msg.c_str()); + } + return; + } + // Field does not exist, add it. + getKnownFields().try_emplace(f.name(), f); +} + +void Field::initKnownFields() { + static constexpr const char BN128[] = "bn128", BN254[] = "bn254", GRUMPKIN[] = "grumpkin", + BABYBEAR[] = "babybear", GOLDILOCKS[] = "goldilocks", + MERSENNE31[] = "mersenne31", KOALABEAR[] = "koalabear"; + + auto insert = [](const char *name, const char *primeStr) { + getKnownFields().try_emplace(name, Field(primeStr, name)); + }; + + // Reference: https://github.com/iden3/circom/blob/master/program_structure/src/utils/constants.rs + // bn128/254, default for circom + insert(BN128, "21888242871839275222246405745257275088548364400416034343698204186575808495617"); + insert(BN254, "21888242871839275222246405745257275088548364400416034343698204186575808495617"); + // Grumpkin scalar field + insert(GRUMPKIN, "21888242871839275222246405745257275088696311157297823662689037894645226208583"); + // 15 * 2^27 + 1, default for zirgen + insert(BABYBEAR, "2013265921"); + // 2^64 - 2^32 + 1, used for plonky2 + insert(GOLDILOCKS, "18446744069414584321"); + // 2^31 - 1, used for Plonky3 + insert(MERSENNE31, "2147483647"); + // 2^31 - 2^24 + 1, also for Plonky3 + insert(KOALABEAR, "2130706433"); +} + +DynamicAPInt Field::reduce(const DynamicAPInt &i) const { + DynamicAPInt m = i % prime(); + if (m < 0) { + return prime() + m; + } + return m; +} + +DynamicAPInt Field::reduce(const APInt &i) const { return reduce(toDynamicAPInt(i)); } + +DynamicAPInt Field::toSigned(const DynamicAPInt &i) const { return i < half() ? i : i - prime(); } + +DynamicAPInt Field::inv(const DynamicAPInt &i) const { return modInversePrime(i, prime()); } + +DynamicAPInt Field::inv(const APInt &i) const { + return modInversePrime(toDynamicAPInt(i), prime()); +} + +IntegerAttr Field::getPrimeAttr(MLIRContext *context, unsigned bitWidth) const { + return IntegerAttr::get( + IntegerType::get(context, bitWidth), toExactWidthAPInt(prime(), bitWidth) + ); +} + +// Parses Fields from the given attribute, if able. +static LogicalResult parseFields(Attribute a) { + // clang-format off + return TypeSwitch< + Attribute, FailureOr>>>(a) + .Case( + [](auto) { + return success(); + }) + .Case( + [](auto s) -> FailureOr>> { + auto fieldRes = Field::tryGetField(s); + if (failed(fieldRes)) { + return failure(); + } + return SmallVector> {fieldRes.value()}; + }) + .Case( + [](auto arr) -> FailureOr>> { + // An ArrayAttr may only contain inner StringAttr + SmallVector> res; + for (Attribute elem : arr) { + if (auto s = llvm::dyn_cast(elem)) { + auto fieldRes = Field::tryGetField(s); + if (failed(fieldRes)) { + return failure(); + } + res.push_back(fieldRes.value()); + } else { + return failure(); + } + } + return res; + }) + .Default([](auto) { return failure(); }); + // clang-format on +} + +LogicalResult addSpecifiedFields(ModuleOp modOp) { + if (Attribute a = modOp->getAttr(FIELD_ATTR_NAME)) { + return parseFields(a); + } + // Always recurse. + if (ModuleOp parentMod = modOp->getParentOfType()) { + return addSpecifiedFields(parentMod); + } + return success(); +} + +} // namespace llzk + +namespace { + +struct FieldsCtx { + llzk::FieldSet &fields; + LogicalResult &status; + mlir::Operation *scope; +}; + +} // namespace + +static void handleAttribute(mlir::Attribute, FieldsCtx &); + +static void handleType(mlir::Type type, FieldsCtx &ctx) { + TypeSwitch ts(type); + ts.Case([&ctx](llzk::felt::FeltType felt) { + if (felt.hasField()) { + ctx.fields.insert(felt.getField()); + } else { + ctx.status = failure(); + if (ctx.scope) { + ctx.scope->emitWarning() << "felt type is unspecified, which may cause some passes to fail"; + } + } + }) + .Case([&ctx](llzk::array::ArrayType array) { handleType(array.getElementType(), ctx); }) + .Case([&ctx](llzk::pod::PodType pod) { + for (auto record : pod.getRecords()) { + handleAttribute(record, ctx); + } + }).Case([&ctx](mlir::FunctionType funcType) { + for (auto i : funcType.getInputs()) { + handleType(i, ctx); + } + for (auto o : funcType.getResults()) { + handleType(o, ctx); + } + }); + // Do nothing by default for any other type + ts.Default([](auto) {}); +} + +static void handleAttribute(mlir::Attribute attr, FieldsCtx &ctx) { + TypeSwitch ts(attr); + ts.Case([&ctx](mlir::TypeAttr typeAttr) { handleType(typeAttr.getValue(), ctx); }) + .Case([&ctx](mlir::ArrayAttr arrayAttr) { + for (auto a : arrayAttr) { + handleAttribute(a, ctx); + } + }) + .Case([&ctx](mlir::DictionaryAttr dictAttr) { + for (auto a : dictAttr.getValue()) { + handleAttribute(a.getValue(), ctx); + } + }).Case([&ctx](llzk::pod::RecordAttr recordAttr) { + handleType(recordAttr.getType(), ctx); + }).Default([](auto) {}); +} + +LogicalResult llzk::collectFields(mlir::Operation *root, llzk::FieldSet &fields, bool silent) { + if (!root) { + return success(); // Nothing to do + } + LogicalResult status = success(); + root->walk([&fields, &status, silent](mlir::Operation *op) { + FieldsCtx ctx = {.fields = fields, .status = status, .scope = silent ? nullptr : op}; + // Crawl for types in the results, + for (auto result : op->getOpResults()) { + handleType(result.getType(), ctx); + } + // the attributes, + for (auto attr : op->getAttrs()) { + handleAttribute(attr.getValue(), ctx); + } + // block arguments (if any) + for (auto ®ion : op->getRegions()) { + for (auto &block : region) { + for (auto &arg : block.getArguments()) { + handleType(arg.getType(), ctx); + } + } + } + }); + + return status; +} + +std::optional> +llzk::tryDetectSpecifiedField(Operation *root) { + if (!root) { + return std::nullopt; + } + + ModuleOp modOp = dyn_cast(root); + if (!modOp) { + modOp = root->getParentOfType(); + } + + if (!modOp) { + return std::nullopt; + } + + FieldSet fields; + if (failed(collectFields(modOp, fields)) || fields.size() != 1) { + return std::nullopt; + } + return *fields.begin(); +} diff --git a/reviews/PHASE-02/evidence/llzk-lib-refs.txt b/reviews/PHASE-02/evidence/llzk-lib-refs.txt new file mode 100644 index 0000000..4aae3da --- /dev/null +++ b/reviews/PHASE-02/evidence/llzk-lib-refs.txt @@ -0,0 +1,2 @@ +30b0fa1eb77de154ff60c13fa88ef286d8b01c65 +db922857bc5a88a9107627ef6b36a8b5e57bc5c2 diff --git a/reviews/PHASE-02/evidence/verify-llzk-source-after.txt b/reviews/PHASE-02/evidence/verify-llzk-source-after.txt new file mode 100644 index 0000000..b333c98 --- /dev/null +++ b/reviews/PHASE-02/evidence/verify-llzk-source-after.txt @@ -0,0 +1,65 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records lib/Util/Field.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main) +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned-with-caveats +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned-with-caveats +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-02/evidence/verify-pins-after.txt b/reviews/PHASE-02/evidence/verify-pins-after.txt new file mode 100644 index 0000000..ad993cb --- /dev/null +++ b/reviews/PHASE-02/evidence/verify-pins-after.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json inputRev pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d4cc1bf2d31b +PASS: dependency checkout HEAD is d4cc1bf2d31b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +WARN: workspace VeIR HEAD 0c5280de5715dc0fa518e7e3782e784a5962d4d8 is a descendant of accepted pin d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3; dependency checkout remains the source of truth + +pin verification summary: 0 fail, 1 warn, mode=strict diff --git a/reviews/PHASE-02/findings.md b/reviews/PHASE-02/findings.md new file mode 100644 index 0000000..4d7e971 --- /dev/null +++ b/reviews/PHASE-02/findings.md @@ -0,0 +1,52 @@ +# Phase 2 Preflight Findings + +Repository: llzk-lean +Reviewed: 2026-06-06 + +## P2-L1 - Local llzk-lib checkout is stale relative to fetched origin/main + +Severity: Critical + +`../llzk-lib` local `main` is at +`30b0fa1eb77de154ff60c13fa88ef286d8b01c65`, while fetched `origin/main` is at +`db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. Phase 2 must use an explicitly +selected source ref, not stale local files. + +Disposition: fixed by `docs/harness/LLZK_SOURCE.md` and +`scripts/harness/verify-llzk-source.sh`, which read the accepted ref through +`git show` and warn when the worktree is stale. + +## P2-L2 - Current LLZK source adds grumpkin and corrects bn128/bn254 + +Severity: Critical + +Fetched `llzk-lib origin/main:lib/Util/Field.cpp` maps `bn128` and `bn254` to +the BN scalar field, adds `grumpkin` as a distinct built-in field, and keeps +`koalabear`. Any llzk-lean certificate or checker claim that omits this source +fact is stale. + +Disposition: fixed by updating certificate/checker source claims and the +source gate. + +## P2-L3 - Checker registry comments are not source-ledger backed + +Severity: High + +`checker/src/CertChecker.cpp` still carries TODO comments about a hardcoded +field registry. Phase 2 must make those comments and any future registry checks +match the accepted LLZK source ledger. + +Disposition: fixed by updating `checker/src/CertChecker.cpp` comments and +checking the accepted built-ins in `scripts/harness/verify-llzk-source.sh`. + +## P2-L4 - Phase 1 work is not committed in this workspace + +Severity: Medium + +Both `veir` and `llzk-lean` contain uncommitted Phase 1 implementation changes. +Phase 2 execution should either commit those changes first or explicitly carry +the dirty state as non-release local work. + +Disposition: fixed by selecting VeIR commit +`d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and +refreshing `.lake/packages/VeIR` to a clean checkout of that commit. diff --git a/reviews/PHASE-02/request.md b/reviews/PHASE-02/request.md new file mode 100644 index 0000000..dcbb451 --- /dev/null +++ b/reviews/PHASE-02/request.md @@ -0,0 +1,10 @@ +# Phase 2 Review Request + +Repository: llzk-lean +Created: 2026-06-06 + +Review the LLZK source-truth and field-registry parity work for Phase 2. + +The review must verify that llzk-lean's Felt certificate and checker claims are +grounded in a fresh `llzk-lib` source ref, not stale docs or local checkout +state. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index 2906216..e6a3954 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -4,6 +4,7 @@ set -u ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" FAIL=0 +ACCEPTED_VEIR_COMMIT="d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" fail() { echo "FAIL: $*" >&2 @@ -23,25 +24,42 @@ require_file() { fi } +require_nonempty() { + local path="$1" + if [[ -s "${ROOT}/${path}" ]]; then + ok "evidence present ${path}" + else + fail "missing or empty evidence ${path}" + fi +} + require_file docs/phases/PHASE-00-harness-reset.md +require_file docs/phases/PHASE-01-pins-and-repro.md +require_file docs/phases/PHASE-02-llzk-source-truth.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md require_file docs/harness/GATES.md +require_file docs/harness/LLZK_SOURCE.md +require_file docs/harness/PINS.md require_file docs/harness/REVIEWS.md -require_file reviews/PHASE-00/disposition.md -require_file reviews/PHASE-00/findings.md -require_file reviews/PHASE-00/request.md -require_file reviews/PHASE-00/adversarial-review.md +require_file reviews/PHASE-01/disposition.md +require_file reviews/PHASE-01/findings.md +require_file reviews/PHASE-01/request.md +require_file reviews/PHASE-01/adversarial-review.md +require_file reviews/PHASE-02/disposition.md +require_file reviews/PHASE-02/findings.md +require_file reviews/PHASE-02/request.md +require_file reviews/PHASE-02/adversarial-review.md -phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-00-harness-reset.md" | head -1)" +phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-02-llzk-source-truth.md" | head -1)" if [[ "$phase_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then ok "phase review date has ISO format" else fail "phase review date is missing or not ISO formatted" fi -for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md docs/harness/REVIEWS.md; do +for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md docs/harness/LLZK_SOURCE.md docs/harness/PINS.md docs/harness/REVIEWS.md; do doc_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/${doc}" | head -1)" if [[ "$doc_date" == "$phase_date" ]]; then ok "${doc} review date agrees with phase" @@ -50,38 +68,45 @@ for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md fi done -if grep -q "Active phase: Phase 0" "${ROOT}/docs/harness/CURRENT.md"; then +if grep -q "Active phase: Phase 2" "${ROOT}/docs/harness/CURRENT.md"; then ok "CURRENT names active phase" else - fail "CURRENT does not name Phase 0 as active" + fail "CURRENT does not name Phase 2 as active" fi -if grep -q "Stale Historical Material" "${ROOT}/docs/harness/SOURCES.md"; then - ok "SOURCES marks stale historical material" +if grep -q "Accepted VeIR pin" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records accepted VeIR pin" else - fail "SOURCES does not mark stale historical material" + fail "SOURCES does not record accepted VeIR pin" fi -if grep -q "Disposition" "${ROOT}/reviews/PHASE-00/disposition.md"; then - ok "Phase 0 disposition exists" +if grep -q "Accepted LLZK source commit" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records accepted LLZK source commit" else - fail "Phase 0 disposition is not populated" + fail "SOURCES does not record accepted LLZK source commit" +fi + +if grep -q "$ACCEPTED_VEIR_COMMIT" "${ROOT}/docs/harness/PINS.md"; then + ok "PINS records accepted VeIR commit" +else + fail "PINS does not record accepted VeIR commit" +fi + +if grep -q "Disposition" "${ROOT}/reviews/PHASE-02/disposition.md"; then + ok "Phase 2 disposition exists" +else + fail "Phase 2 disposition is not populated" fi for evidence in \ - reviews/PHASE-00/evidence/doctor-strict.txt \ - reviews/PHASE-00/evidence/doctor-exploratory.txt \ - reviews/PHASE-00/evidence/workspace-doctor-exploratory.txt \ - reviews/PHASE-00/evidence/validate-skills.txt \ - reviews/PHASE-00/evidence/diff-smoke.txt \ - reviews/PHASE-00/evidence/cert-smoke.txt \ - reviews/PHASE-00/evidence/dependency-status.txt \ - reviews/PHASE-00/evidence/adversarial-review.txt; do - if [[ -s "${ROOT}/${evidence}" ]]; then - ok "evidence present ${evidence}" - else - fail "missing or empty evidence ${evidence}" - fi + reviews/PHASE-02/evidence/llzk-lib-refs.txt \ + reviews/PHASE-02/evidence/llzk-field-registry.txt \ + reviews/PHASE-02/evidence/llzk-felt-ops.txt \ + reviews/PHASE-02/evidence/verify-llzk-source-after.txt \ + reviews/PHASE-02/evidence/verify-pins-after.txt \ + reviews/PHASE-02/evidence/lake-build-after.txt \ + reviews/PHASE-02/evidence/adversarial-review.txt; do + require_nonempty "$evidence" done echo diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh index 156457f..4fc43fd 100755 --- a/scripts/harness/doctor.sh +++ b/scripts/harness/doctor.sh @@ -7,9 +7,6 @@ MODE="strict" WORKSPACE_VEIR="" EXPECTED_LLZK_LEAN_HEAD="ea2363f87bcc" -EXPECTED_WORKSPACE_VEIR_HEAD="4b0978bddec0" -EXPECTED_VEIR_DEP="09d5f00f0d2b4a8710afbe53dfdd7cf468578a04" -EXPECTED_VEIR_DEP_SHORT="09d5f00f0d2b" FAIL=0 WARN=0 @@ -18,9 +15,9 @@ usage() { cat <<'USAGE' usage: scripts/harness/doctor.sh [--mode strict|exploratory] [--workspace-veir PATH] -Validates the Phase 0 llzk-lean harness. Strict mode fails on dirty or -mismatched .lake/packages/VeIR state. Exploratory mode reports that state but -allows the command to complete successfully. +Validates the Phase 1 llzk-lean harness. Strict mode requires a clean +.lake/packages/VeIR checkout at the accepted reproducible pin. Exploratory mode +only downgrades an optional workspace VeIR mismatch. USAGE } @@ -123,74 +120,64 @@ else warn "llzk-lean HEAD ${head_short:-} differs from bootstrap input ${EXPECTED_LLZK_LEAN_HEAD}" fi -if grep -q "$EXPECTED_VEIR_DEP" "${ROOT}/lakefile.toml" && - grep -q "$EXPECTED_VEIR_DEP" "${ROOT}/lake-manifest.json"; then - ok "Lake files pin VeIR ${EXPECTED_VEIR_DEP_SHORT}" -else - fail "Lake files do not both pin VeIR ${EXPECTED_VEIR_DEP}" -fi - -dep="${ROOT}/.lake/packages/VeIR" -if [[ -d "$dep/.git" ]]; then - dep_head="$(git -C "$dep" rev-parse --short=12 HEAD 2>/dev/null || true)" - if [[ "$dep_head" == "$EXPECTED_VEIR_DEP_SHORT" ]]; then - ok "dependency checkout is at ${EXPECTED_VEIR_DEP_SHORT}" - else - fail "dependency checkout ${dep_head:-} does not match ${EXPECTED_VEIR_DEP_SHORT}" - fi - - dep_status="$(git -C "$dep" status --short 2>/dev/null || true)" - if [[ -z "$dep_status" ]]; then - ok "dependency checkout is clean" - elif [[ "$MODE" == "exploratory" ]]; then - warn "dependency checkout is dirty in exploratory mode:" - printf '%s\n' "$dep_status" >&2 - else - fail "dependency checkout is dirty:" - printf '%s\n' "$dep_status" >&2 - fi -else - fail "dependency checkout missing at ${dep}" -fi - -if [[ -n "$WORKSPACE_VEIR" ]]; then - workspace="$(cd "$ROOT" && cd "$WORKSPACE_VEIR" 2>/dev/null && pwd || true)" - if [[ -z "$workspace" ]]; then - fail "workspace VeIR path is not readable: ${WORKSPACE_VEIR}" - else - workspace_head="$(git -C "$workspace" rev-parse --short=12 HEAD 2>/dev/null || true)" - if [[ "$workspace_head" == "$EXPECTED_WORKSPACE_VEIR_HEAD" ]]; then - ok "workspace VeIR HEAD matches bootstrap input ${EXPECTED_WORKSPACE_VEIR_HEAD}" - else - warn "workspace VeIR HEAD ${workspace_head:-} differs from bootstrap input ${EXPECTED_WORKSPACE_VEIR_HEAD}" - fi - fi -else - warn "workspace VeIR repo was not checked; pass --workspace-veir PATH" -fi - require_file AGENTS.md require_file docs/phases/PHASE-00-harness-reset.md +require_file docs/phases/PHASE-01-pins-and-repro.md +require_file docs/phases/PHASE-02-llzk-source-truth.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md require_file docs/harness/GATES.md +require_file docs/harness/LLZK_SOURCE.md +require_file docs/harness/PINS.md require_file docs/harness/REVIEWS.md require_file reviews/PHASE-00/request.md require_file reviews/PHASE-00/findings.md require_file reviews/PHASE-00/disposition.md require_file reviews/PHASE-00/adversarial-review.md +require_file reviews/PHASE-01/request.md +require_file reviews/PHASE-01/findings.md +require_file reviews/PHASE-01/disposition.md +require_file reviews/PHASE-01/adversarial-review.md +require_file reviews/PHASE-02/request.md +require_file reviews/PHASE-02/findings.md +require_file reviews/PHASE-02/disposition.md +require_file reviews/PHASE-02/adversarial-review.md require_executable scripts/harness/check-doc-freshness.sh require_executable scripts/harness/diff-smoke.sh require_executable scripts/harness/cert-smoke.sh +require_executable scripts/harness/verify-pins.sh +require_executable scripts/harness/verify-llzk-source.sh require_executable scripts/harness/validate-skills.sh +pin_args=(--mode "$MODE") +if [[ -n "$WORKSPACE_VEIR" ]]; then + pin_args+=(--workspace-veir "$WORKSPACE_VEIR") +fi +if "${ROOT}/scripts/harness/verify-pins.sh" "${pin_args[@]}"; then + ok "pin verification passed" +else + fail "pin verification failed" +fi + if [[ -d "${ROOT}/reviews/PHASE-00/evidence" ]]; then ok "found reviews/PHASE-00/evidence" else fail "missing reviews/PHASE-00/evidence" fi +if [[ -d "${ROOT}/reviews/PHASE-01/evidence" ]]; then + ok "found reviews/PHASE-01/evidence" +else + fail "missing reviews/PHASE-01/evidence" +fi + +if [[ -d "${ROOT}/reviews/PHASE-02/evidence" ]]; then + ok "found reviews/PHASE-02/evidence" +else + fail "missing reviews/PHASE-02/evidence" +fi + echo echo "doctor summary: ${FAIL} fail, ${WARN} warn, mode=${MODE}" if [[ "$FAIL" -ne 0 ]]; then diff --git a/scripts/harness/verify-llzk-source.sh b/scripts/harness/verify-llzk-source.sh new file mode 100755 index 0000000..6b8b3b1 --- /dev/null +++ b/scripts/harness/verify-llzk-source.sh @@ -0,0 +1,261 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +LLZK_LIB="${ROOT}/../llzk-lib" + +ACCEPTED_LLZK_COMMIT="db922857bc5a88a9107627ef6b36a8b5e57bc5c2" +ACCEPTED_LLZK_SHORT="${ACCEPTED_LLZK_COMMIT:0:12}" +ACCEPTED_LLZK_REF="origin/main" +FIELD_REGISTRY_PATH="lib/Util/Field.cpp" + +EXPECTED_OPS=( + const + add + sub + mul + pow + div + uintdiv + sintdiv + umod + smod + neg + inv + bit_and + bit_or + bit_xor + bit_not + shl + shr +) + +FAIL=0 +WARN=0 + +usage() { + cat <<'USAGE' +usage: scripts/harness/verify-llzk-source.sh [--llzk-lib PATH] + +Verifies the accepted Phase 2 LLZK Felt source ref, source paths, Felt op +mnemonics, and built-in field registry facts. +USAGE +} + +ok() { + echo "PASS: $*" +} + +warn() { + echo "WARN: $*" >&2 + WARN=$((WARN + 1)) +} + +fail() { + echo "FAIL: $*" >&2 + FAIL=$((FAIL + 1)) +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --llzk-lib) + LLZK_LIB="${2:-}" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + fail "unknown argument: $1" + usage + exit 2 + ;; + esac +done + +llzk="$(cd "$ROOT" && cd "$LLZK_LIB" 2>/dev/null && pwd || true)" +if [[ -z "$llzk" || ! -d "$llzk/.git" ]]; then + fail "llzk-lib path is not a readable git checkout: ${LLZK_LIB}" +else + ok "llzk-lib path is ${llzk}" +fi + +ledger="${ROOT}/docs/harness/LLZK_SOURCE.md" +if [[ -f "$ledger" ]]; then + ok "found docs/harness/LLZK_SOURCE.md" + if grep -Fq "$ACCEPTED_LLZK_COMMIT" "$ledger"; then + ok "LLZK source ledger records ${ACCEPTED_LLZK_SHORT}" + else + fail "LLZK source ledger does not record ${ACCEPTED_LLZK_COMMIT}" + fi + if grep -Fq "$FIELD_REGISTRY_PATH" "$ledger"; then + ok "LLZK source ledger records ${FIELD_REGISTRY_PATH}" + else + fail "LLZK source ledger does not record ${FIELD_REGISTRY_PATH}" + fi +else + fail "missing docs/harness/LLZK_SOURCE.md" +fi + +if [[ -n "$llzk" && -d "$llzk/.git" ]]; then + echo "accepted LLZK source: ${ACCEPTED_LLZK_COMMIT} (${ACCEPTED_LLZK_REF})" + + if git -C "$llzk" cat-file -e "${ACCEPTED_LLZK_COMMIT}^{commit}" 2>/dev/null; then + ok "accepted LLZK commit exists locally" + else + fail "accepted LLZK commit ${ACCEPTED_LLZK_COMMIT} is unavailable" + fi + + origin_head="$(git -C "$llzk" rev-parse "$ACCEPTED_LLZK_REF" 2>/dev/null || true)" + if [[ "$origin_head" == "$ACCEPTED_LLZK_COMMIT" ]]; then + ok "${ACCEPTED_LLZK_REF} equals accepted LLZK source ${ACCEPTED_LLZK_SHORT}" + else + fail "${ACCEPTED_LLZK_REF} is ${origin_head:-}, expected ${ACCEPTED_LLZK_COMMIT}" + fi + + worktree_head="$(git -C "$llzk" rev-parse HEAD 2>/dev/null || true)" + if [[ "$worktree_head" == "$ACCEPTED_LLZK_COMMIT" ]]; then + ok "llzk-lib worktree HEAD also equals accepted source" + else + warn "llzk-lib worktree HEAD ${worktree_head:-} differs; gate reads ${ACCEPTED_LLZK_COMMIT} with git show" + fi + + expect_path() { + local path="$1" + if git -C "$llzk" cat-file -e "${ACCEPTED_LLZK_COMMIT}:${path}" 2>/dev/null; then + ok "accepted source contains ${path}" + else + fail "accepted source missing ${path}" + fi + } + + reject_path() { + local path="$1" + if git -C "$llzk" cat-file -e "${ACCEPTED_LLZK_COMMIT}:${path}" 2>/dev/null; then + fail "accepted source still contains stale ${path}" + else + ok "accepted source does not contain stale ${path}" + fi + } + + get_source() { + git -C "$llzk" show "${ACCEPTED_LLZK_COMMIT}:$1" 2>/dev/null + } + + expect_path include/llzk/Dialect/Felt/IR/Ops.td + expect_path include/llzk/Dialect/Felt/IR/Types.td + expect_path include/llzk/Dialect/Felt/IR/Attrs.td + expect_path lib/Dialect/Felt/IR/Ops.cpp + expect_path "$FIELD_REGISTRY_PATH" + expect_path test/Dialect/Felt/felt_arith_pass.llzk + expect_path unittests/IR/FeltFoldTests.cpp + + actual_ops="$( + get_source include/llzk/Dialect/Felt/IR/Ops.td | + sed -n 's/.*FeltDialect[A-Za-z]*Op<"\([^"]*\)".*/\1/p' + )" + expected_ops="$(printf '%s\n' "${EXPECTED_OPS[@]}")" + if [[ "$actual_ops" == "$expected_ops" ]]; then + ok "accepted Felt op mnemonics match Phase 2 ledger" + else + fail "accepted Felt op mnemonics differ from Phase 2 ledger" + echo "expected:" >&2 + printf '%s\n' "$expected_ops" >&2 + echo "actual:" >&2 + printf '%s\n' "$actual_ops" >&2 + fi + + field_src="$(get_source "$FIELD_REGISTRY_PATH")" + check_field_text() { + local needle="$1" + local desc="$2" + if grep -Fq "$needle" <<<"$field_src"; then + ok "$desc" + else + fail "$desc missing" + fi + } + reject_field_text() { + local needle="$1" + local desc="$2" + if grep -Fq "$needle" <<<"$field_src"; then + fail "$desc present" + else + ok "$desc absent" + fi + } + + check_field_text 'BN128[] = "bn128"' "registry declares bn128" + check_field_text 'BN254[] = "bn254"' "registry declares bn254" + check_field_text 'GRUMPKIN[] = "grumpkin"' "registry declares grumpkin" + check_field_text 'BABYBEAR[] = "babybear"' "registry declares babybear" + check_field_text 'GOLDILOCKS[] = "goldilocks"' "registry declares goldilocks" + check_field_text 'MERSENNE31[] = "mersenne31"' "registry declares mersenne31" + check_field_text 'KOALABEAR[] = "koalabear"' "registry declares koalabear" + check_field_text 'insert(BN128, "21888242871839275222246405745257275088548364400416034343698204186575808495617")' "registry maps bn128 to accepted prime" + check_field_text 'insert(BN254, "21888242871839275222246405745257275088548364400416034343698204186575808495617")' "registry maps bn254 to accepted prime" + check_field_text 'insert(GRUMPKIN, "21888242871839275222246405745257275088696311157297823662689037894645226208583")' "registry maps grumpkin to accepted prime" + check_field_text 'insert(BABYBEAR, "2013265921")' "registry maps babybear to accepted prime" + check_field_text 'insert(GOLDILOCKS, "18446744069414584321")' "registry maps goldilocks to accepted prime" + check_field_text 'insert(MERSENNE31, "2147483647")' "registry maps mersenne31 to accepted prime" + check_field_text 'insert(KOALABEAR, "2130706433")' "registry maps koalabear to accepted prime" + + types_src="$(get_source include/llzk/Dialect/Felt/IR/Types.td)" + if grep -Fq 'let mnemonic = "type";' <<<"$types_src"; then + ok "Felt type source defines !felt.type" + else + fail "Felt type source does not define !felt.type" + fi + if grep -Fq 'OptionalParameter<"::mlir::StringAttr">:$fieldName' <<<"$types_src"; then + ok "Felt type source carries optional field-name parameter" + else + fail "Felt type source missing optional field-name parameter" + fi +fi + +check_local_text() { + local path="$1" + local needle="$2" + local desc="$3" + if [[ ! -f "${ROOT}/${path}" ]]; then + fail "missing ${path}" + return + fi + if grep -Fq "$needle" "${ROOT}/${path}"; then + ok "$desc" + else + fail "$desc missing" + fi +} + +check_field_list() { + local path="$1" + local desc="$2" + for expected in bn128 bn254 grumpkin babybear goldilocks mersenne31 koalabear; do + check_local_text "$path" "$expected" "${desc} mentions ${expected}" + done +} + +check_field_list checker/src/CertChecker.cpp "checker registry comment block" +check_field_list docs/strategy-a-oracle.md "Strategy A registered-field source claim" +check_field_list docs/harness/LLZK_SOURCE.md "LLZK source ledger" + +check_local_text docs/strategy-e-certificates.md '"sameAttr"' "Strategy E documents sameAttr side condition" +check_local_text docs/strategy-e-certificates.md '"attrInRegistry"' "Strategy E documents attrInRegistry side condition" +check_local_text LlzkLean/Cert.lean '(patternId := "constant_fold_add")' "Lean cert catalog contains constant_fold_add" +check_local_text LlzkLean/Cert.lean '.sameAttr "fieldName" ["lhs", "rhs"]' "Lean cert catalog requires same fieldName" +check_local_text LlzkLean/Cert.lean '.attrInRegistry "lhs" "fieldName" "field"' "Lean cert catalog requires registered fieldName" +check_local_text LlzkLean/Cert.lean '(llzkParityStatus := .alignedWithCaveats)' "Lean cert catalog marks constant_fold_add aligned-with-caveats" +check_local_text certs/felt-combine.cert.json '"patternId":"constant_fold_add"' "cert snapshot contains constant_fold_add" +check_local_text certs/felt-combine.cert.json '"llzkParityStatus":"aligned-with-caveats"' "cert snapshot records aligned-with-caveats" +check_local_text certs/felt-combine.cert.json '"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]' "cert snapshot requires same fieldName" +check_local_text certs/felt-combine.cert.json '"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"' "cert snapshot requires registered fieldName" + +echo +echo "LLZK source verification summary: ${FAIL} fail, ${WARN} warn" +if [[ "$FAIL" -ne 0 ]]; then + exit 1 +fi +exit 0 diff --git a/scripts/harness/verify-pins.sh b/scripts/harness/verify-pins.sh new file mode 100755 index 0000000..56eb66d --- /dev/null +++ b/scripts/harness/verify-pins.sh @@ -0,0 +1,236 @@ +#!/usr/bin/env bash + +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +MODE="strict" +WORKSPACE_VEIR="" + +ACCEPTED_VEIR_COMMIT="d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" +ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" +ACCEPTED_VEIR_REMOTE="https://github.com/project-llzk/veir.git" +ACCEPTED_VEIR_BRANCH="felt-review-structural-close" + +FAIL=0 +WARN=0 + +usage() { + cat <<'USAGE' +usage: scripts/harness/verify-pins.sh [--mode strict|exploratory] [--workspace-veir PATH] + +Verifies that lakefile.toml, lake-manifest.json, and .lake/packages/VeIR all +identify the accepted VeIR commit, and that the dependency checkout is clean. +Exploratory mode only downgrades an optional workspace VeIR mismatch. +USAGE +} + +ok() { + echo "PASS: $*" +} + +warn() { + echo "WARN: $*" >&2 + WARN=$((WARN + 1)) +} + +fail() { + echo "FAIL: $*" >&2 + FAIL=$((FAIL + 1)) +} + +extract_lakefile_field() { + local field="$1" + awk -v wanted="$field" ' + function emit() { + if (wanted == "rev") print rev + else if (wanted == "git") print git + else exit 1 + } + /^\[\[require\]\]/ { + if (in_req && name == "VeIR") { emit(); found = 1; exit } + in_req = 1; name = ""; rev = ""; git = ""; next + } + /^\[\[/ { + if (in_req && name == "VeIR") { emit(); found = 1; exit } + in_req = 0 + } + in_req && /^[[:space:]]*name[[:space:]]*=/ { + line = $0; sub(/^[^"]*"/, "", line); sub(/".*/, "", line); name = line + } + in_req && /^[[:space:]]*git[[:space:]]*=/ { + line = $0; sub(/^[^"]*"/, "", line); sub(/".*/, "", line); git = line + } + in_req && /^[[:space:]]*rev[[:space:]]*=/ { + line = $0; sub(/^[^"]*"/, "", line); sub(/".*/, "", line); rev = line + } + END { if (!found && in_req && name == "VeIR") emit() } + ' "${ROOT}/lakefile.toml" +} + +extract_manifest_field() { + local field="$1" + awk -v wanted="$field" ' + function json_value(line, key, value) { + value = line + sub(".*\"" key "\"[[:space:]]*:[[:space:]]*\"", "", value) + sub("\".*", "", value) + return value + } + function emit() { + if (wanted == "url") print url + else if (wanted == "type") print type + else if (wanted == "rev") print rev + else if (wanted == "inputRev") print inputRev + else exit 1 + } + /"packages"[[:space:]]*:/ { in_packages = 1 } + in_packages && /\{/ { in_obj = 1; name = ""; url = ""; type = ""; rev = ""; inputRev = "" } + in_obj && /"url"[[:space:]]*:/ { url = json_value($0, "url") } + in_obj && /"type"[[:space:]]*:/ { type = json_value($0, "type") } + in_obj && /"rev"[[:space:]]*:/ { rev = json_value($0, "rev") } + in_obj && /"inputRev"[[:space:]]*:/ { inputRev = json_value($0, "inputRev") } + in_obj && /"name"[[:space:]]*:/ { + name = json_value($0, "name") + } + in_obj && /\}/ { + if (name == "VeIR") { emit(); found = 1; exit } + in_obj = 0 + } + END { if (!found) exit 1 } + ' "${ROOT}/lake-manifest.json" +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --mode) + MODE="${2:-}" + shift 2 + ;; + --workspace-veir) + WORKSPACE_VEIR="${2:-}" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + fail "unknown argument: $1" + usage + exit 2 + ;; + esac +done + +case "$MODE" in + strict|exploratory) ;; + *) + fail "invalid mode: ${MODE}" + exit 2 + ;; +esac + +echo "accepted VeIR pin: ${ACCEPTED_VEIR_COMMIT}" +echo "accepted VeIR source: ${ACCEPTED_VEIR_REMOTE} ${ACCEPTED_VEIR_BRANCH}" + +lakefile_url="$(extract_lakefile_field git 2>/dev/null || true)" +lakefile_rev="$(extract_lakefile_field rev 2>/dev/null || true)" +manifest_url="$(extract_manifest_field url 2>/dev/null || true)" +manifest_type="$(extract_manifest_field type 2>/dev/null || true)" +manifest_rev="$(extract_manifest_field rev 2>/dev/null || true)" +manifest_input_rev="$(extract_manifest_field inputRev 2>/dev/null || true)" + +if [[ "$lakefile_url" == "$ACCEPTED_VEIR_REMOTE" ]]; then + ok "lakefile.toml uses accepted VeIR remote ${ACCEPTED_VEIR_REMOTE}" +else + fail "lakefile.toml VeIR git URL ${lakefile_url:-} does not match ${ACCEPTED_VEIR_REMOTE}" +fi + +if [[ "$lakefile_rev" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "lakefile.toml pins VeIR ${ACCEPTED_VEIR_SHORT}" +else + fail "lakefile.toml VeIR rev ${lakefile_rev:-} does not match ${ACCEPTED_VEIR_COMMIT}" +fi + +if [[ "$manifest_rev" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "lake-manifest.json pins VeIR ${ACCEPTED_VEIR_SHORT}" +else + fail "lake-manifest.json VeIR rev ${manifest_rev:-} does not match ${ACCEPTED_VEIR_COMMIT}" +fi + +if [[ "$manifest_input_rev" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "lake-manifest.json inputRev pins VeIR ${ACCEPTED_VEIR_SHORT}" +else + fail "lake-manifest.json VeIR inputRev ${manifest_input_rev:-} does not match ${ACCEPTED_VEIR_COMMIT}" +fi + +if [[ "$manifest_url" == "$ACCEPTED_VEIR_REMOTE" ]]; then + ok "lake-manifest.json uses accepted VeIR remote ${ACCEPTED_VEIR_REMOTE}" +else + fail "lake-manifest.json VeIR URL ${manifest_url:-} does not match ${ACCEPTED_VEIR_REMOTE}" +fi + +if [[ "$manifest_type" == "git" ]]; then + ok "lake-manifest.json records VeIR as a git dependency" +else + fail "lake-manifest.json VeIR type ${manifest_type:-} is not git" +fi + +if [[ -n "$lakefile_rev" && -n "$manifest_rev" && "$lakefile_rev" == "$manifest_rev" ]]; then + ok "Lake files agree on VeIR ${lakefile_rev:0:12}" +else + fail "Lake files disagree on VeIR rev: lakefile=${lakefile_rev:-} manifest=${manifest_rev:-}" +fi + +dep="${ROOT}/.lake/packages/VeIR" +if [[ -d "$dep/.git" ]]; then + dep_head="$(git -C "$dep" rev-parse HEAD 2>/dev/null || true)" + if [[ "$dep_head" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "dependency checkout HEAD is ${ACCEPTED_VEIR_SHORT}" + else + fail "dependency checkout HEAD ${dep_head:-} does not match ${ACCEPTED_VEIR_COMMIT}" + fi + + if [[ -n "$manifest_rev" && "$dep_head" == "$manifest_rev" ]]; then + ok "dependency checkout HEAD equals manifest rev" + else + fail "dependency checkout HEAD does not equal manifest rev ${manifest_rev:-}" + fi + + dep_status="$(git -C "$dep" status --short 2>/dev/null || true)" + if [[ -z "$dep_status" ]]; then + ok "dependency checkout is clean" + else + fail "dependency checkout is dirty:" + printf '%s\n' "$dep_status" >&2 + fi +else + fail "dependency checkout missing at ${dep}" +fi + +if [[ -n "$WORKSPACE_VEIR" ]]; then + workspace="$(cd "$ROOT" && cd "$WORKSPACE_VEIR" 2>/dev/null && pwd || true)" + if [[ -z "$workspace" ]]; then + fail "workspace VeIR path is not readable: ${WORKSPACE_VEIR}" + else + workspace_head="$(git -C "$workspace" rev-parse HEAD 2>/dev/null || true)" + if [[ "$workspace_head" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "workspace VeIR HEAD equals accepted pin ${ACCEPTED_VEIR_SHORT}" + elif git -C "$workspace" merge-base --is-ancestor "$ACCEPTED_VEIR_COMMIT" HEAD 2>/dev/null; then + warn "workspace VeIR HEAD ${workspace_head:-} is a descendant of accepted pin ${ACCEPTED_VEIR_COMMIT}; dependency checkout remains the source of truth" + elif [[ "$MODE" == "exploratory" ]]; then + warn "workspace VeIR HEAD ${workspace_head:-} differs from accepted pin ${ACCEPTED_VEIR_COMMIT}; exploratory layout only" + else + fail "workspace VeIR HEAD ${workspace_head:-} differs from accepted pin ${ACCEPTED_VEIR_COMMIT}" + fi +fi +else + warn "workspace VeIR repo was not checked; pass --workspace-veir PATH when recording acceptance evidence" +fi + +echo +echo "pin verification summary: ${FAIL} fail, ${WARN} warn, mode=${MODE}" +if [[ "$FAIL" -ne 0 ]]; then + exit 1 +fi +exit 0 From 3b3ae2b0cf160f2ee9798b3ba27f7fea1a2e8adb Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 15:49:59 +0100 Subject: [PATCH 07/16] Bootstrap Strategy A Phase 6 harness --- AGENTS.md | 19 +- differential/README.md | 103 ++++-- differential/corpus/README.md | 113 ++++-- .../canonical/add_neg_to_zero.llzk | 10 + .../canonical/add_sub_const_cancel.llzk | 11 + .../canonical/assoc_const_fold_add.llzk | 12 + .../canonical/assoc_const_fold_mul.llzk | 13 + .../canonical/constant_fold_mul.llzk | 11 + .../canonical/constant_fold_neg.llzk | 10 + .../canonical/constant_fold_sub.llzk | 11 + .../canonical/neg_neg_to_self.llzk | 10 + .../canonical/registered_add_fold.llzk | 13 + .../canonical/registered_add_wrap.llzk | 13 + .../canonical/right_identity_one_mul.llzk | 10 + .../canonical/right_identity_zero_add.llzk | 10 + .../canonical/right_zero_mul.llzk | 10 + .../canonical/self_subtraction_to_zero.llzk | 9 + .../canonical/sub_add_const_cancel.llzk | 11 + .../canonical/unspecified_add_fold.llzk | 12 + .../named_field_const.mlir | 10 +- .../expected-divergence/types_smoke.llzk | 33 -- differential/corpus/felt/add_const_swap.llzk | 10 + .../corpus/felt/arithmetic_no_fold.llzk | 26 ++ .../corpus/felt/const_identities.mlir | 22 +- differential/corpus/felt/types_smoke.llzk | 10 + differential/run-differential.sh | 195 +++++++++-- docs/REVIEW.md | 14 +- docs/harness/CURRENT.md | 56 ++- docs/harness/FELT_OP_GAPS.md | 62 ++++ docs/harness/GATES.md | 99 +++++- docs/harness/LLZK_SOURCE.md | 14 +- docs/harness/PINS.md | 19 +- docs/harness/REVIEWS.md | 2 +- docs/harness/SOURCES.md | 29 +- docs/phases/PHASE-02-llzk-source-truth.md | 14 +- docs/phases/PHASE-03-felt-op-gap-ledger.md | 96 ++++++ .../PHASE-04-strategy-a-differential.md | 121 +++++++ .../PHASE-05-strategy-a-pin-and-corpus.md | 115 +++++++ ...PHASE-06-strategy-a-divergence-burndown.md | 101 ++++++ docs/strategy-a-oracle.md | 83 +++-- lake-manifest.json | 4 +- lakefile.toml | 2 +- reviews/PHASE-02/disposition.md | 6 + reviews/PHASE-02/evidence/llzk-lib-refs.txt | 1 + reviews/PHASE-02/findings.md | 39 +++ reviews/PHASE-03/adversarial-review.md | 56 +++ reviews/PHASE-03/disposition.md | 13 + reviews/PHASE-03/evidence/README.md | 16 + .../PHASE-03/evidence/adversarial-review.txt | 101 ++++++ .../PHASE-03/evidence/check-doc-freshness.txt | 115 +++++++ .../PHASE-03/evidence/doctor-workspace.txt | 63 ++++ reviews/PHASE-03/evidence/lake-build.txt | 34 ++ reviews/PHASE-03/evidence/validate-skills.txt | 22 ++ .../PHASE-03/evidence/verify-llzk-source.txt | 119 +++++++ reviews/PHASE-03/evidence/verify-pins.txt | 15 + reviews/PHASE-03/findings.md | 39 +++ reviews/PHASE-03/request.md | 16 + reviews/PHASE-04/adversarial-review.md | 76 +++++ reviews/PHASE-04/disposition.md | 14 + reviews/PHASE-04/evidence/README.md | 22 ++ .../evidence/adversarial-review-fresh.txt | 12 + .../PHASE-04/evidence/adversarial-review.txt | 23 ++ .../PHASE-04/evidence/check-doc-freshness.txt | 142 ++++++++ .../evidence/corpus-classification.txt | 10 + .../evidence/differential-bootstrap.txt | 11 + .../evidence/differential-canonicalize.txt | 11 + .../PHASE-04/evidence/doctor-workspace.txt | 69 ++++ reviews/PHASE-04/evidence/lake-build.txt | 34 ++ reviews/PHASE-04/evidence/validate-skills.txt | 22 ++ .../PHASE-04/evidence/verify-llzk-source.txt | 119 +++++++ reviews/PHASE-04/evidence/verify-pins.txt | 15 + reviews/PHASE-04/findings.md | 34 ++ reviews/PHASE-04/request.md | 17 + reviews/PHASE-05/adversarial-review.md | 80 +++++ reviews/PHASE-05/disposition.md | 26 ++ reviews/PHASE-05/evidence/README.md | 18 + .../PHASE-05/evidence/adversarial-review.txt | 18 + .../PHASE-05/evidence/check-doc-freshness.txt | 199 +++++++++++ .../differential-clean-pin-canonicalize.txt | 24 ++ .../PHASE-05/evidence/doctor-workspace.txt | 75 ++++ reviews/PHASE-05/evidence/lake-build.txt | 34 ++ reviews/PHASE-05/evidence/polarity-guard.txt | 12 + reviews/PHASE-05/evidence/skip-guard.txt | 8 + reviews/PHASE-05/evidence/validate-skills.txt | 22 ++ .../PHASE-05/evidence/verify-llzk-source.txt | 119 +++++++ reviews/PHASE-05/evidence/verify-pins.txt | 15 + reviews/PHASE-05/findings.md | 99 ++++++ reviews/PHASE-05/request.md | 17 + reviews/PHASE-06/adversarial-review.md | 24 ++ reviews/PHASE-06/disposition.md | 6 + reviews/PHASE-06/evidence/README.md | 14 + .../PHASE-06/evidence/adversarial-review.txt | 9 + .../PHASE-06/evidence/check-doc-freshness.txt | 226 ++++++++++++ .../differential-clean-pin-canonicalize.txt | 24 ++ .../PHASE-06/evidence/doctor-workspace.txt | 81 +++++ reviews/PHASE-06/evidence/lake-build.txt | 34 ++ reviews/PHASE-06/evidence/validate-skills.txt | 22 ++ .../PHASE-06/evidence/verify-llzk-source.txt | 119 +++++++ reviews/PHASE-06/evidence/verify-pins.txt | 15 + reviews/PHASE-06/findings.md | 6 + reviews/PHASE-06/request.md | 13 + scripts/harness/check-doc-freshness.sh | 322 +++++++++++++++++- scripts/harness/doctor.sh | 49 ++- scripts/harness/verify-llzk-source.sh | 142 +++++++- scripts/harness/verify-pins.sh | 2 +- skills/cert-checker-review/SKILL.md | 3 +- skills/lean-axiom-audit/SKILL.md | 6 +- skills/llzk-lean-dependency-audit/SKILL.md | 13 +- skills/mlir-differential/SKILL.md | 3 +- skills/phase-bootstrap/SKILL.md | 5 +- 110 files changed, 4468 insertions(+), 270 deletions(-) create mode 100644 differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk create mode 100644 differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk create mode 100644 differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk create mode 100644 differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk create mode 100644 differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk create mode 100644 differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk create mode 100644 differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk create mode 100644 differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk create mode 100644 differential/corpus/expected-divergence/canonical/registered_add_fold.llzk create mode 100644 differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk create mode 100644 differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk create mode 100644 differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk create mode 100644 differential/corpus/expected-divergence/canonical/right_zero_mul.llzk create mode 100644 differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk create mode 100644 differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk create mode 100644 differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk delete mode 100644 differential/corpus/expected-divergence/types_smoke.llzk create mode 100644 differential/corpus/felt/add_const_swap.llzk create mode 100644 differential/corpus/felt/arithmetic_no_fold.llzk create mode 100644 differential/corpus/felt/types_smoke.llzk create mode 100644 docs/harness/FELT_OP_GAPS.md create mode 100644 docs/phases/PHASE-03-felt-op-gap-ledger.md create mode 100644 docs/phases/PHASE-04-strategy-a-differential.md create mode 100644 docs/phases/PHASE-05-strategy-a-pin-and-corpus.md create mode 100644 docs/phases/PHASE-06-strategy-a-divergence-burndown.md create mode 100644 reviews/PHASE-03/adversarial-review.md create mode 100644 reviews/PHASE-03/disposition.md create mode 100644 reviews/PHASE-03/evidence/README.md create mode 100644 reviews/PHASE-03/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-03/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-03/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-03/evidence/lake-build.txt create mode 100644 reviews/PHASE-03/evidence/validate-skills.txt create mode 100644 reviews/PHASE-03/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-03/evidence/verify-pins.txt create mode 100644 reviews/PHASE-03/findings.md create mode 100644 reviews/PHASE-03/request.md create mode 100644 reviews/PHASE-04/adversarial-review.md create mode 100644 reviews/PHASE-04/disposition.md create mode 100644 reviews/PHASE-04/evidence/README.md create mode 100644 reviews/PHASE-04/evidence/adversarial-review-fresh.txt create mode 100644 reviews/PHASE-04/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-04/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-04/evidence/corpus-classification.txt create mode 100644 reviews/PHASE-04/evidence/differential-bootstrap.txt create mode 100644 reviews/PHASE-04/evidence/differential-canonicalize.txt create mode 100644 reviews/PHASE-04/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-04/evidence/lake-build.txt create mode 100644 reviews/PHASE-04/evidence/validate-skills.txt create mode 100644 reviews/PHASE-04/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-04/evidence/verify-pins.txt create mode 100644 reviews/PHASE-04/findings.md create mode 100644 reviews/PHASE-04/request.md create mode 100644 reviews/PHASE-05/adversarial-review.md create mode 100644 reviews/PHASE-05/disposition.md create mode 100644 reviews/PHASE-05/evidence/README.md create mode 100644 reviews/PHASE-05/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-05/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt create mode 100644 reviews/PHASE-05/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-05/evidence/lake-build.txt create mode 100644 reviews/PHASE-05/evidence/polarity-guard.txt create mode 100644 reviews/PHASE-05/evidence/skip-guard.txt create mode 100644 reviews/PHASE-05/evidence/validate-skills.txt create mode 100644 reviews/PHASE-05/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-05/evidence/verify-pins.txt create mode 100644 reviews/PHASE-05/findings.md create mode 100644 reviews/PHASE-05/request.md create mode 100644 reviews/PHASE-06/adversarial-review.md create mode 100644 reviews/PHASE-06/disposition.md create mode 100644 reviews/PHASE-06/evidence/README.md create mode 100644 reviews/PHASE-06/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-06/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt create mode 100644 reviews/PHASE-06/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-06/evidence/lake-build.txt create mode 100644 reviews/PHASE-06/evidence/validate-skills.txt create mode 100644 reviews/PHASE-06/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-06/evidence/verify-pins.txt create mode 100644 reviews/PHASE-06/findings.md create mode 100644 reviews/PHASE-06/request.md diff --git a/AGENTS.md b/AGENTS.md index c7ef77e..1de064d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,15 +6,22 @@ dependency, differential, or certificate work in this repository. Required first checks: - Read `docs/harness/CURRENT.md`, `docs/harness/GATES.md`, and - `docs/harness/SOURCES.md`. -- Run `scripts/harness/doctor.sh` from the repository root. -- If the known dirty `.lake/packages/VeIR` checkout is being used for local - investigation, rerun with `--mode exploratory` and report that mode. + `docs/harness/SOURCES.md`; read `docs/harness/PINS.md` before touching + Lake metadata or `.lake/packages/VeIR`. +- Run `scripts/harness/doctor.sh --workspace-veir ../veir` from the repository + root when the companion checkout exists. If `../veir` is unavailable, run the + strict doctor without the workspace argument and report that the result is not + full acceptance evidence. +- Run `scripts/harness/verify-pins.sh --workspace-veir ../veir` for any + dependency, review, or phase-close work. Policy: - Do not rely on `.lake/packages/VeIR` as hidden proof state. +- Dirty dependency state is never acceptance evidence. Use `--mode exploratory` + only to investigate a mismatch, and report that mode explicitly. - Do not treat a missing `llzk-opt`, missing MLIR headers, or CI skip as Strategy A or Strategy E coverage. -- Keep phase evidence under `reviews/PHASE-00/evidence/` when changing - canonical harness docs or gates. +- Keep phase evidence under the active phase directory + (`reviews/PHASE-01/evidence/` for the current pin phase) when changing + canonical harness docs, pins, or gates. diff --git a/differential/README.md b/differential/README.md index ae82cbc..955bd4c 100644 --- a/differential/README.md +++ b/differential/README.md @@ -12,25 +12,37 @@ specific corpus and reporting. ## Status -**Wired but minimal.** `run-differential.sh` works as a thin wrapper -over VEIR's script. The corpus starts small (a handful of Felt -identities); it grows as the strategy matures. +**Canonicalization-aware, clean-pin expanded corpus.** +`run-differential.sh` wraps VEIR's script, supports parse/print mode +and canonicalization mode, and classifies output divergence, LLZK +failure, VEIR failure, missing tools, and mode-skipped corpus entries +separately. The Phase 5 clean-pin corpus covers all 15 current VeIR +Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, but it is +not full Strategy A acceptance coverage. ## Running locally ```bash # From the repo root: -lake update # Fetches the VEIR dependency (incl. Mathlib via VEIR) +scripts/harness/verify-pins.sh --workspace-veir ../veir lake build # Builds llzk-lean's own Lean code export LLZK_OPT=/path/to/llzk-opt ./differential/run-differential.sh + +# Phase 5 clean-pin canonical evidence path: +./differential/run-differential.sh --canonicalize differential/corpus + +# Historical Phase 4 workspace implementation run: +VEIR_DIFF=../veir/scripts/llzk-diff.sh \ + ./differential/run-differential.sh --canonicalize ``` -**First-run cost.** The differential script invokes -`lake exec veir-opt` inside `.lake/packages/VeIR/`, which on a cold -checkout builds VEIR (the Felt port + the IR machinery) and its -Mathlib dependency. Expect ~10 minutes the first time on a typical -laptop; subsequent runs hit the build cache and finish in seconds. +**First-run cost.** The differential script prefers +`.lake/packages/VeIR/.lake/build/bin/veir-opt` when that executable is +present. On a cold checkout it falls back to `lake exec veir-opt` inside +`.lake/packages/VeIR/`, which builds VEIR (the Felt port + the IR machinery) +and its Mathlib dependency. Expect a multi-minute build the first time; +subsequent runs use the built executable and finish in seconds. If you already have VEIR built elsewhere on the filesystem (say, `~/veir`), you can skip the wait by reusing the existing build: @@ -41,31 +53,41 @@ ln -sf ~/veir/.lake/build .lake/packages/VeIR/.lake/build ``` The symlink must point at a `.lake/build` directory produced by a -VEIR checkout at the same SHA we've pinned (see `lakefile.toml`) +VEIR checkout at the same SHA we've pinned (see `docs/harness/PINS.md`) **and the same Lean toolchain** (see `lean-toolchain`). If your VEIR clone's `lean-toolchain` differs (e.g., the pinned SHA carries `v4.30.0-rc2` but your local VEIR checkout has advanced to `v4.30.0`), the symlinked oleans will be kernel-incompatible and lake will rebuild from scratch — which is the path the symlink is -trying to avoid. When that happens, the cleanest fix is to run -`lake update` from inside llzk-lean (drops the symlink, populates -.lake/packages/VeIR from scratch at the pinned SHA). Mismatches -otherwise silently produce a build that diverges from the pinned -proof basis. +trying to avoid. When that happens, refresh the dependency to the +accepted pin and rerun `scripts/harness/verify-pins.sh +--workspace-veir ../veir`. Mismatches otherwise produce a build that +diverges from the pinned proof basis. -The script prints PASS / DIVERGE per input. Exit code is 0 if all -inputs pass, non-zero if any diverge. +The script prints PASS / DIVERGE / tool-failure classification per +input. Exit code is 0 if all inputs satisfy their declared polarity, +non-zero if any input lands in the FAIL column. ## Corpus expansion targets -Initial bar (this scaffold): -- `corpus/felt/const_identities.mlir` — minimal proof-of-life. - -Strategy A v1 deliverable bar: +Current Phase 5 bar: +- `corpus/felt/const_identities.mlir` — live const proof-of-life. +- `corpus/felt/types_smoke.llzk` — custom-asm lowering smoke. +- `corpus/felt/arithmetic_no_fold.llzk` — canonical no-fire arithmetic. +- `corpus/felt/add_const_swap.llzk` — positive coverage for the current + rewrite pattern that both tools normalize the same way. +- `corpus/expected-divergence/canonical/*` — classified clean-pin + canonicalization gaps for DCE, modular reduction, field-registry + preconditions, and VeIR-only algebraic rewrites. +- `corpus/README.md` — the current 21-input inventory and 15-pattern + rewrite coverage matrix. + +Remaining Strategy A work: - Mirror every input in `llzk-lib/test/Dialect/Felt/` (custom-asm - form; pass through `LOWER_FIRST=1`). -- Cover every fold in VEIR's `Veir.Passes.Felt.Combine` against a - representative LLZK input. + form; `.llzk` inputs are lowered automatically). +- Keep every VeIR Felt rewrite-pattern definition mapped to a corpus + file as VEIR changes. +- Reduce expected divergences and move closed gaps into `corpus/felt/`. - Failing-case corpus: programs LLZK rejects but VEIR accepts, or vice versa, placed under `corpus/expected-divergence/` (the directory location flips the assertion polarity — see @@ -76,24 +98,40 @@ The expansion plan is tracked in ## Exit-code semantics -The wrapper distinguishes four outcomes per input, derived from +The wrapper distinguishes these outcomes per input, derived from `llzk-diff.sh`'s exit code: | Exit | Wrapper label | Polarity inverted under `expected-divergence/`? | Counted as | |---|---|---|---| | 0 | `PASS` | yes → `UNEXPECTED-PASS` | pass / fail (inverted) | -| 1 | `DIVERGE` | yes → `EXPECTED-DIVERGE` | fail / pass (inverted) | +| 1 | `DIVERGE` | only with an `EXPECTED-DIVERGE` file header | fail / pass when declared | | 2 | `ERROR` | **no** | fail (always) | -| 77 | `SKIP` | no | skip (separate bucket) | +| 3 | `VEIR-FAIL` | only with an `EXPECTED-VEIR-FAIL` file header | fail / pass when declared | +| 4 | `LLZK-FAIL` | only with an `EXPECTED-LLZK-FAIL` file header | fail / pass when declared | +| 77 | `SKIP` | no | skip, then wrapper failure | + +Every input under `expected-divergence/` must declare one exact accepted +outcome in its header: `EXPECTED-DIVERGE`, `EXPECTED-VEIR-FAIL`, or +`EXPECTED-LLZK-FAIL`. The directory is not a wildcard. For example, a +canonical output-divergence test marked `EXPECTED-DIVERGE` fails if either +tool starts failing before comparable output exists. ERROR (exit 2) is always-fail because it means the input is broken (unreadable, malformed CLI args, etc.) — that's not a documented -alignment gap, it's a broken test. SKIP (exit 77) means `llzk-opt` -or `lake` isn't available; counted separately so the summary -distinguishes "nothing ran" from "everything passed". +alignment gap, it's a broken test. SKIP (exit 77) means a required +differential tool is unavailable; counted separately in the summary and then +treated as a wrapper failure so missing tools cannot produce acceptance +evidence. + +Files under `expected-divergence/canonical/` are canonicalization-only. +Parse/print mode reports MODE-SKIP for them; canonicalization mode runs +and classifies them normally. A run that selects only mode-skipped inputs +exits non-zero because it produced no evidence in the selected mode. The wrapper's overall exit code is non-zero iff any input ended up -in the FAIL column. +in the FAIL column, any input was skipped because required tools were +unavailable, or no input executed because every selected input was +mode-skipped. ## Interpreting divergences @@ -110,8 +148,7 @@ and either: 1. A canonical-form mismatch (e.g., VEIR emits `42` where LLZK emits `42 mod p` because VEIR's folds don't apply modular reduction — - tracked as Felt parity gap #1 in VEIR's - [`FELT_PARITY_ASSESSMENT_2026-05-28.md`](https://github.com/alexanderlhicks/veir/blob/llzkfelt_test1/FELT_PARITY_ASSESSMENT_2026-05-28.md)) + tracked in `../../veir/REVIEW.md` VH3) — fix on the VEIR side. 2. An LLZK bug — file against `llzk-lib`. 3. A spec disagreement — escalate to the strategy doc. diff --git a/differential/corpus/README.md b/differential/corpus/README.md index 1ecb7fd..09e9ac5 100644 --- a/differential/corpus/README.md +++ b/differential/corpus/README.md @@ -7,22 +7,31 @@ Inputs the differential harness runs LLZK and VEIR against. - `felt/` — inputs that should produce *identical* normalized output from both tools. PASS = the implementations agree on this case. - `expected-divergence/` — inputs that document *known* alignment - gaps. EXPECTED-DIVERGE = the harness sees a difference (which is - the expected outcome — the file exists to track the gap until - it's closed). UNEXPECTED-PASS = a gap was closed; move the file - to `felt/` and update the docs. + gaps. Each file must declare the accepted outcome in a header comment: + `EXPECTED-DIVERGE`, `EXPECTED-LLZK-FAIL`, or `EXPECTED-VEIR-FAIL`. + `UNEXPECTED-PASS` means a gap was closed; move the file to `felt/` + and update the docs. +- `expected-divergence/canonical/` — canonicalization-only gaps. + Parse/print runs report MODE-SKIP for these files; canonical runs + classify them normally. ## Polarity by location The harness (`differential/run-differential.sh`) treats inputs by their path: -| Path pattern | PASS outcome | DIVERGE outcome | -|---|---|---| -| `corpus/felt/*` | counted PASS | counted FAIL | -| `corpus/expected-divergence/*` | counted FAIL (gap closed!) | counted PASS | +| Path pattern | PASS outcome | DIVERGE outcome | Tool-failure outcome | +|---|---|---|---| +| `corpus/felt/*` | counted PASS | counted FAIL | counted FAIL | +| `corpus/expected-divergence/*` with `EXPECTED-DIVERGE` marker | counted FAIL (gap closed!) | counted PASS | counted FAIL | +| `corpus/expected-divergence/*` with `EXPECTED-LLZK-FAIL` marker | counted FAIL | counted FAIL | counted PASS only for LLZK failure | +| `corpus/expected-divergence/*` with `EXPECTED-VEIR-FAIL` marker | counted FAIL | counted FAIL | counted PASS only for VEIR failure | +| `corpus/expected-divergence/canonical/*` in parse/print mode | MODE-SKIP | MODE-SKIP | MODE-SKIP | -A FAIL in either column blocks the script's exit-0 return. +A FAIL in either column blocks the script's exit-0 return. SKIP also exits +non-zero because missing required differential tools are not acceptance +evidence. Selecting only mode-skipped inputs exits non-zero because the run +produced no parse/print or canonicalization evidence. ## Adding a positive-case input @@ -31,24 +40,33 @@ A FAIL in either column blocks the script's exit-0 return. form. For LLZK native custom-asm (`%c = felt.add %a, %b : !felt.type`), the `.llzk` extension is conventional but not required — the harness picks up both extensions. -2. If the input is in LLZK custom-asm, set `LOWER_FIRST=1` so the - diff script first lowers through - `llzk-opt --mlir-print-op-generic`: +2. If the input is in LLZK custom-asm, use the `.llzk` extension. The + wrapper automatically passes `--lower-first` for `.llzk` inputs so + the diff script first lowers through `llzk-opt --mlir-print-op-generic`: + ```bash + ./differential/run-differential.sh differential/corpus/felt/your-file.llzk + ``` +3. Confirm parse/print mode and, when relevant, canonicalization mode + report the new file as PASS: ```bash - LOWER_FIRST=1 ./differential/run-differential.sh \ + ./differential/run-differential.sh differential/corpus/felt/your-file.llzk + ./differential/run-differential.sh --canonicalize \ differential/corpus/felt/your-file.llzk ``` -3. Confirm `./differential/run-differential.sh` reports the new - file as PASS; commit. ## Documenting an alignment gap 1. Author the input under `expected-divergence/.{mlir,llzk}`. -2. Add a file-header comment explaining *why* this input diverges - and citing the relevant code/docs (e.g., the parser - incompatibility, the field-registry guard, etc.). -3. Confirm the harness reports `EXPECTED-DIVERGE` for the new file - (or `UNEXPECTED-PASS` if the gap turned out to not exist). + Use `expected-divergence/canonical/` for gaps that only appear when + `--canonicalize` is enabled. +2. Add a file-header comment with the exact accepted label: + `EXPECTED-DIVERGE`, `EXPECTED-LLZK-FAIL`, or `EXPECTED-VEIR-FAIL`. + Explain *why* this input diverges or fails on one side, citing the + relevant code/docs (e.g., field-registry parity, modular reduction, + parser/verifier mismatch, normalizer gaps, etc.). +3. Confirm the harness reports the declared inverted outcome. A different + nonzero result is a failure; for example, a file marked + `EXPECTED-DIVERGE` must not pass just because one tool starts failing. 4. When the gap is closed upstream, the harness will report `UNEXPECTED-PASS` — move the file to `felt/` and update the doc that referenced the gap. @@ -57,6 +75,55 @@ A FAIL in either column blocks the script's exit-0 return. | File | Status | What it tests | |---|---|---| -| `felt/const_identities.mlir` | PASS | Generic-form FeltConstAttr round-trip with unnamed `!felt.type` | -| `expected-divergence/named_field_const.mlir` | EXPECTED-DIVERGE | VEIR's outer-annotated `#felt : !felt.type<"name">` vs LLZK's inner-annotated `#felt>` parser incompatibility | -| `expected-divergence/types_smoke.llzk` | EXPECTED-DIVERGE | `LOWER_FIRST=1` smoke test against an LLZK custom-asm input. Surfaces two normalizer gaps in `scripts/llzk-diff.sh`: discardable-attribute key quoting (`{sym_visibility = ...}` vs `{"sym_visibility" = ...}`) and empty-region-body whitespace formatting. Both are cosmetic VEIR-side gaps. | +| `felt/add_const_swap.llzk` | PASS | Canonical positive for `add_const_swap`; both tools rewrite constant-on-left add to constant-on-right add | +| `felt/const_identities.mlir` | PASS | Generic-form live FeltConstAttr round-trip with unnamed `!felt.type`; passes parse/print and canonicalization | +| `felt/types_smoke.llzk` | PASS | LLZK custom-asm function type smoke; reclassified from expected divergence after normalizer fixes | +| `felt/arithmetic_no_fold.llzk` | PASS | Canonical no-fire coverage for live add/sub/mul/neg over non-constant inputs | +| `expected-divergence/named_field_const.mlir` | EXPECTED-LLZK-FAIL | Generic named-field FeltConstAttr still fails on LLZK's parser/verifier path | +| `expected-divergence/canonical/add_neg_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + (-x)` to zero; LLZK leaves the non-constant add/neg pair in place | +| `expected-divergence/canonical/add_sub_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c) - c` to `x`; LLZK leaves the add/sub pair in place | +| `expected-divergence/canonical/assoc_const_fold_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c1) + c2` to `x + (c1 + c2)`; LLZK leaves the nested add chain in place | +| `expected-divergence/canonical/assoc_const_fold_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x * c1) * c2` to `x * (c1 * c2)`; LLZK leaves the nested multiplication chain in place | +| `expected-divergence/canonical/constant_fold_mul.llzk` | EXPECTED-DIVERGE | Both tools fold registered multiplication, but LLZK also erases now-dead input constants while VeIR `felt-combine` does not run DCE | +| `expected-divergence/canonical/constant_fold_neg.llzk` | EXPECTED-DIVERGE | LLZK reduces registered negation modulo babybear; VeIR currently emits the raw integer | +| `expected-divergence/canonical/constant_fold_sub.llzk` | EXPECTED-DIVERGE | Both tools fold registered subtraction, but LLZK also erases now-dead input constants while VeIR `felt-combine` does not run DCE | +| `expected-divergence/canonical/neg_neg_to_self.llzk` | EXPECTED-DIVERGE | VeIR rewrites double negation to `x`; LLZK leaves the outer negation chain in place | +| `expected-divergence/canonical/registered_add_fold.llzk` | EXPECTED-DIVERGE | Both tools fold registered add, but LLZK also erases now-dead input constants while VEIR `felt-combine` does not run DCE | +| `expected-divergence/canonical/registered_add_wrap.llzk` | EXPECTED-DIVERGE | LLZK reduces registered-field fold results modulo babybear; VEIR currently emits the raw integer | +| `expected-divergence/canonical/right_identity_one_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 1` to `x`; LLZK leaves the non-constant multiplication in place | +| `expected-divergence/canonical/right_identity_zero_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + 0` to `x`; LLZK leaves the non-constant add in place | +| `expected-divergence/canonical/right_zero_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 0` to zero; LLZK leaves the non-constant multiplication in place | +| `expected-divergence/canonical/self_subtraction_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x - x` to zero; LLZK leaves the non-constant subtraction in place | +| `expected-divergence/canonical/sub_add_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x - c) + c` to `x`; LLZK leaves the sub/add pair in place | +| `expected-divergence/canonical/unspecified_add_fold.llzk` | EXPECTED-DIVERGE | LLZK skips bare `!felt.type` binary folds; VEIR currently folds them | + +The current clean-pin canonical run reports: + +```text +Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) +``` + +## Phase 5 rewrite-pattern coverage + +This matrix tracks coverage against the 15 `Veir.FeltPass` rewrite-pattern +definitions. It is not a Strategy A acceptance claim: `EXPECTED-DIVERGE` means +the corpus now records the gap explicitly under the canonicalized clean-pin +gate. + +| VeIR pattern | Corpus status | Corpus file | +|---|---|---| +| `right_identity_zero_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_zero_add.llzk` | +| `constant_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/registered_add_fold.llzk` | +| `self_subtraction_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/self_subtraction_to_zero.llzk` | +| `assoc_const_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/assoc_const_fold_add.llzk` | +| `right_identity_one_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_one_mul.llzk` | +| `right_zero_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_zero_mul.llzk` | +| `constant_fold_sub` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_sub.llzk` | +| `constant_fold_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_mul.llzk` | +| `constant_fold_neg` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_neg.llzk` | +| `add_neg_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/add_neg_to_zero.llzk` | +| `neg_neg_to_self` | EXPECTED-DIVERGE | `expected-divergence/canonical/neg_neg_to_self.llzk` | +| `add_const_swap` | PASS | `felt/add_const_swap.llzk` | +| `add_sub_const_cancel` | EXPECTED-DIVERGE | `expected-divergence/canonical/add_sub_const_cancel.llzk` | +| `sub_add_const_cancel` | EXPECTED-DIVERGE | `expected-divergence/canonical/sub_add_const_cancel.llzk` | +| `assoc_const_fold_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/assoc_const_fold_mul.llzk` | diff --git a/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk b/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk new file mode 100644 index 0000000..6d65a6f --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `add_neg_to_zero` rewrites `felt.add x (felt.neg x)` to zero. +// LLZK currently leaves this non-constant add/neg pair in place. + +function.def @add_neg(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %neg = felt.neg %x : !felt.type<"babybear"> + %y = felt.add %x, %neg : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk b/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk new file mode 100644 index 0000000..fa9d5f6 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk @@ -0,0 +1,11 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `add_sub_const_cancel` rewrites `(x + c) - c` to `x`. +// LLZK currently leaves the add/sub pair in place. + +function.def @add_sub_cancel(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.const 5 : !felt.type<"babybear"> + %inner = felt.add %x, %c : !felt.type<"babybear">, !felt.type<"babybear"> + %outer = felt.sub %inner, %c : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %outer : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk b/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk new file mode 100644 index 0000000..42712a9 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk @@ -0,0 +1,12 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `assoc_const_fold_add` rewrites `(x + c1) + c2` to +// `x + (c1 + c2)`. LLZK currently leaves the nested add chain in place. + +function.def @assoc_add(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c1 = felt.const 2 : !felt.type<"babybear"> + %c2 = felt.const 3 : !felt.type<"babybear"> + %inner = felt.add %x, %c1 : !felt.type<"babybear">, !felt.type<"babybear"> + %outer = felt.add %inner, %c2 : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %outer : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk b/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk new file mode 100644 index 0000000..a80867f --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk @@ -0,0 +1,13 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `assoc_const_fold_mul` rewrites `(x * c1) * c2` to +// `x * (c1 * c2)`. LLZK currently leaves the nested multiplication chain in +// place. + +function.def @assoc_mul(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c1 = felt.const 2 : !felt.type<"babybear"> + %c2 = felt.const 3 : !felt.type<"babybear"> + %inner = felt.mul %x, %c1 : !felt.type<"babybear">, !felt.type<"babybear"> + %outer = felt.mul %inner, %c2 : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %outer : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk b/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk new file mode 100644 index 0000000..e81231e --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk @@ -0,0 +1,11 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// Both tools fold the multiplication to 42, but LLZK also erases the now-dead +// input constants while VeIR `felt-combine` does not run DCE. + +function.def @fold_mul() -> !felt.type<"babybear"> { + %a = felt.const 6 : !felt.type<"babybear"> + %b = felt.const 7 : !felt.type<"babybear"> + %c = felt.mul %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk b/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk new file mode 100644 index 0000000..ad1dbdc --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// LLZK reduces the folded registered-field negation modulo babybear +// (`-5` becomes `2013265916`), while VeIR currently emits the raw integer. + +function.def @fold_neg() -> !felt.type<"babybear"> { + %a = felt.const 5 : !felt.type<"babybear"> + %c = felt.neg %a : !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk b/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk new file mode 100644 index 0000000..e7dd5bc --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk @@ -0,0 +1,11 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// Both tools fold the subtraction to 5, but LLZK also erases the now-dead +// input constants while VeIR `felt-combine` does not run DCE. + +function.def @fold_sub() -> !felt.type<"babybear"> { + %a = felt.const 9 : !felt.type<"babybear"> + %b = felt.const 4 : !felt.type<"babybear"> + %c = felt.sub %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk b/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk new file mode 100644 index 0000000..5c41e14 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `neg_neg_to_self` rewrites `felt.neg (felt.neg x)` to `x`. +// LLZK currently leaves the outer negation chain in place. + +function.def @neg_neg(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %n1 = felt.neg %x : !felt.type<"babybear"> + %n2 = felt.neg %n1 : !felt.type<"babybear"> + function.return %n2 : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk b/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk new file mode 100644 index 0000000..1eed4e0 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk @@ -0,0 +1,13 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// Both tools fold the registered-field add to 12, but their pipelines are not +// observationally aligned yet: LLZK's canonicalizer removes the now-dead input +// constants, while VEIR's `felt-combine` does not run DCE. This is a Phase 4 +// Strategy A pipeline gap, not a parser failure. + +function.def @fold_add() -> !felt.type<"babybear"> { + %a = felt.const 5 : !felt.type<"babybear"> + %b = felt.const 7 : !felt.type<"babybear"> + %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk b/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk new file mode 100644 index 0000000..2aec97a --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk @@ -0,0 +1,13 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// LLZK folds registered-field arithmetic through Field::reduce. For babybear, +// (p - 1) + 2 reduces to 1. VEIR's current constant fold records the raw +// integer result and therefore emits 2013265922. This documents the modular +// reduction gap tracked by Strategy A. + +function.def @fold_add_wrap() -> !felt.type<"babybear"> { + %a = felt.const 2013265920 : !felt.type<"babybear"> + %b = felt.const 2 : !felt.type<"babybear"> + %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk b/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk new file mode 100644 index 0000000..feda391 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `right_identity_one_mul` rewrites `felt.mul x 1` to `x`. +// LLZK currently leaves this non-constant multiplication in place. + +function.def @mul_identity(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %one = felt.const 1 : !felt.type<"babybear"> + %y = felt.mul %x, %one : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk b/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk new file mode 100644 index 0000000..3b64dcd --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `right_identity_zero_add` rewrites `felt.add x 0` to `x`. +// LLZK currently leaves this non-constant add in place under `--canonicalize`. + +function.def @add_zero(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %zero = felt.const 0 : !felt.type<"babybear"> + %y = felt.add %x, %zero : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk b/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk new file mode 100644 index 0000000..d03cc4b --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk @@ -0,0 +1,10 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `right_zero_mul` rewrites `felt.mul x 0` to a new zero constant. +// LLZK currently leaves this non-constant multiplication in place. + +function.def @mul_zero(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %zero = felt.const 0 : !felt.type<"babybear"> + %y = felt.mul %x, %zero : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk b/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk new file mode 100644 index 0000000..0e94c3c --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk @@ -0,0 +1,9 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `self_subtraction_to_zero` rewrites `felt.sub x x` to zero. +// LLZK currently leaves this non-constant subtraction in place. + +function.def @sub_self(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %y = felt.sub %x, %x : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk b/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk new file mode 100644 index 0000000..760ce90 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk @@ -0,0 +1,11 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// VeIR's `sub_add_const_cancel` rewrites `(x - c) + c` to `x`. +// LLZK currently leaves the sub/add pair in place. + +function.def @sub_add_cancel(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.const 5 : !felt.type<"babybear"> + %inner = felt.sub %x, %c : !felt.type<"babybear">, !felt.type<"babybear"> + %outer = felt.add %inner, %c : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %outer : !felt.type<"babybear"> +} diff --git a/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk b/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk new file mode 100644 index 0000000..5a90139 --- /dev/null +++ b/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk @@ -0,0 +1,12 @@ +// EXPECTED-DIVERGE in canonicalization mode. +// +// LLZK intentionally skips binary Felt folds when either operand has no +// registered field name. VEIR currently folds bare `!felt.type` constants. +// This records the field-registry precondition gap. + +function.def @no_fold_unspecified_add() -> !felt.type { + %a = felt.const 5 + %b = felt.const 7 + %c = felt.add %a, %b + function.return %c : !felt.type +} diff --git a/differential/corpus/expected-divergence/named_field_const.mlir b/differential/corpus/expected-divergence/named_field_const.mlir index 5630270..133ec37 100644 --- a/differential/corpus/expected-divergence/named_field_const.mlir +++ b/differential/corpus/expected-divergence/named_field_const.mlir @@ -1,7 +1,9 @@ -// EXPECT: DIVERGE — named-field FeltConstAttr is parser-incompatible. -// VEIR's parser doesn't accept LLZK's inner `#felt>` -// syntax; LLZK's parser silently strips VEIR's outer field annotation, -// which then fails the result-type-matches-value-type verifier. +// EXPECTED-LLZK-FAIL — generic named-field FeltConstAttr remains +// parser/verifier-incompatible on the LLZK side. +// +// VEIR accepts this outer-typed generic form, but LLZK's parser/verifier path +// rejects it before a comparable output is produced. LLZK custom assembly +// named-field cases should use .llzk plus --lower-first instead. // Tracked as a documented alignment gap; see docs/strategy-a-oracle.md. "builtin.module"() ({ diff --git a/differential/corpus/expected-divergence/types_smoke.llzk b/differential/corpus/expected-divergence/types_smoke.llzk deleted file mode 100644 index 57d467b..0000000 --- a/differential/corpus/expected-divergence/types_smoke.llzk +++ /dev/null @@ -1,33 +0,0 @@ -// LOWER_FIRST=1 smoke test, expected-divergence form. Adapted from -// llzk-lib/test/Dialect/Felt/types_pass.llzk first section. -// -// Lowered through `llzk-opt --mlir-print-op-generic` (i.e. LOWER_FIRST=1) -// and round-tripped through veir-opt, this file surfaces two cosmetic -// normalizer gaps that must be closed before the same input can move -// to corpus/felt/ as a positive test: -// -// 1. Discardable-attribute key quoting. LLZK emits -// `{sym_visibility = "private"}`; VEIR emits -// `{"sym_visibility" = "private"}`. The normalizer in -// `scripts/llzk-diff.sh` already strips the quotes for *property* -// attributes inside `<{...}>`, but not for *discardable* -// attributes inside `{...}` after the region body. -// -// 2. Empty-region-body whitespace. LLZK emits: -// ({ -// }) {sym_visibility = ...} -// VEIR emits the body inline: -// ({ }) {"sym_visibility" = ...} -// Functionally identical; cosmetically divergent. -// -// Both are normalizer gaps, not soundness issues. Close them by -// extending the Python normalizer in -// `.lake/packages/VeIR/scripts/llzk-diff.sh` (upstream that change -// to VEIR and bump the SHA pin here when it lands). -// -// Run via: -// LOWER_FIRST=1 ./differential/run-differential.sh corpus/expected-divergence/types_smoke.llzk -// Expected: EXPECTED-DIVERGE. - -function.def private @f(!felt.type) -> i1 -function.def private @g() -> !felt.type diff --git a/differential/corpus/felt/add_const_swap.llzk b/differential/corpus/felt/add_const_swap.llzk new file mode 100644 index 0000000..7aa7e3d --- /dev/null +++ b/differential/corpus/felt/add_const_swap.llzk @@ -0,0 +1,10 @@ +// Canonical positive for VeIR `add_const_swap`. +// +// Both LLZK canonicalization and VeIR `felt-combine` normalize +// `felt.add (felt.const c) x` to `felt.add x (felt.const c)`. + +function.def @add_const_swap(%x: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.const 3 : !felt.type<"babybear"> + %y = felt.add %c, %x : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %y : !felt.type<"babybear"> +} diff --git a/differential/corpus/felt/arithmetic_no_fold.llzk b/differential/corpus/felt/arithmetic_no_fold.llzk new file mode 100644 index 0000000..39cdc36 --- /dev/null +++ b/differential/corpus/felt/arithmetic_no_fold.llzk @@ -0,0 +1,26 @@ +// Canonical positive no-fire Felt arithmetic. +// +// These operations use non-constant function arguments, so neither LLZK's +// canonicalizer nor VEIR's felt-combine pass should rewrite them. This gives +// Phase 4 a canonicalization-mode PASS that exercises live add/sub/mul/neg +// syntax without relying on constant-fold parity. + +function.def @add_no_fold(%a: !felt.type<"babybear">, %b: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} + +function.def @sub_no_fold(%a: !felt.type<"babybear">, %b: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.sub %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} + +function.def @mul_no_fold(%a: !felt.type<"babybear">, %b: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.mul %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} + +function.def @neg_no_fold(%a: !felt.type<"babybear">) -> !felt.type<"babybear"> { + %c = felt.neg %a : !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/felt/const_identities.mlir b/differential/corpus/felt/const_identities.mlir index 6dbf0a9..7c07a5d 100644 --- a/differential/corpus/felt/const_identities.mlir +++ b/differential/corpus/felt/const_identities.mlir @@ -1,16 +1,20 @@ // Minimal Felt proof-of-life for the differential harness. // -// Two `felt.const` ops at module level. Exercises: +// Two live `felt.const` ops returned from a function. Exercises: // - Round-trip of `!felt.type` (unparameterized) // - Round-trip of `#felt : !felt.type` (structured attr) +// - Canonicalization mode without letting LLZK erase unused module-level +// constants before VEIR sees them. // -// Both `llzk-opt --mlir-print-op-generic` and `veir-opt` should -// produce textually-identical output after the normalizer in -// VEIR's scripts/llzk-diff.sh handles known cosmetic divergences -// (empty block headers, block-arg spacing, scope-local block -// numbering). +// Both parse/print mode and canonicalization mode should produce +// textually-identical output after the normalizer in VEIR's +// scripts/llzk-diff.sh handles known cosmetic divergences (empty block +// headers, block-arg spacing, scope-local block numbering). "builtin.module"() ({ - %c1 = "felt.const"() <{value = #felt : !felt.type}> : () -> !felt.type - %c2 = "felt.const"() <{value = #felt : !felt.type}> : () -> !felt.type -}) : () -> () + "function.def"() <{sym_name = "const_identities", function_type = () -> (!felt.type, !felt.type)}> ({ + %c1 = "felt.const"() <{value = #felt : !felt.type}> : () -> !felt.type + %c2 = "felt.const"() <{value = #felt : !felt.type}> : () -> !felt.type + "function.return"(%c1, %c2) : (!felt.type, !felt.type) -> () + }) : () -> () +}) {llzk.lang} : () -> () diff --git a/differential/corpus/felt/types_smoke.llzk b/differential/corpus/felt/types_smoke.llzk new file mode 100644 index 0000000..561909b --- /dev/null +++ b/differential/corpus/felt/types_smoke.llzk @@ -0,0 +1,10 @@ +// LOWER_FIRST smoke test. Adapted from +// llzk-lib/test/Dialect/Felt/types_pass.llzk first section. +// +// Phase 4 reclassification: this used to be expected-divergence while the +// normalizer still missed discardable-attribute key quoting and empty-region +// whitespace. The current VEIR normalizer handles those cosmetic differences, +// so the input is a positive parse/print and canonicalization smoke. + +function.def private @f(!felt.type) -> i1 +function.def private @g() -> !felt.type diff --git a/differential/run-differential.sh b/differential/run-differential.sh index a8d6f9d..6bc1cad 100755 --- a/differential/run-differential.sh +++ b/differential/run-differential.sh @@ -1,12 +1,13 @@ #!/usr/bin/env bash # Thin wrapper around VEIR's scripts/llzk-diff.sh, applied to the -# corpus under differential/corpus/. Reports PASS/DIVERGE per file -# and exits non-zero on any divergence. +# corpus under differential/corpus/. Reports a classified outcome per file +# and exits non-zero on any FAIL outcome. # # Usage: # ./differential/run-differential.sh # all corpus files # ./differential/run-differential.sh path/to/file.mlir # one file -# ./differential/run-differential.sh path/to/dir/ # all .mlir under dir +# ./differential/run-differential.sh path/to/dir/ # all .mlir/.llzk under dir +# ./differential/run-differential.sh --canonicalize # canonical Phase 4 mode # # Requires: # - VEIR built (via `lake build`); used through `lake exec veir-opt`. @@ -17,12 +18,15 @@ # - llzk-opt on $PATH or via $LLZK_OPT. # # Environment toggles: -# LOWER_FIRST=1 pass --lower-first to llzk-diff.sh so .llzk custom-asm -# inputs are normalized to generic-MLIR before comparison. -# Required for any input in LLZK's native textual form. +# VEIR_DIFF=/path use an explicit VEIR scripts/llzk-diff.sh. By default +# the clean pinned Lake dependency is used. +# CANONICALIZE=1 pass --canonicalize to llzk-diff.sh so it compares +# `llzk-opt --canonicalize` with `veir-opt -p=felt-combine`. +# LOWER_FIRST=1 force --lower-first for every input. The wrapper already +# applies --lower-first automatically to .llzk inputs. # # See differential/README.md for the protocol and docs/harness/GATES.md for the -# current Phase 0 smoke boundary. +# current smoke classification boundary. This is not Phase 1 acceptance evidence. set -uo pipefail @@ -32,7 +36,7 @@ CORPUS="${ROOT}/differential/corpus" # Locate VEIR's diff script in the Lake-managed dependency tree. After # `lake update`, the VEIR source lives under `.lake/packages/VeIR/`. VEIR_PACKAGE="${ROOT}/.lake/packages/VeIR" -DIFF="${VEIR_PACKAGE}/scripts/llzk-diff.sh" +DIFF="${VEIR_DIFF:-${VEIR_PACKAGE}/scripts/llzk-diff.sh}" if [[ ! -x "${DIFF}" ]]; then echo "ERROR: VEIR diff script not found at ${DIFF}" >&2 @@ -53,49 +57,95 @@ fi # Expand args into a list of .mlir files. Each arg may be a file (used as-is) # or a directory (recursed into for *.mlir). With no args, scan the corpus dir. TARGETS=() +ARGS=() + +abs_path() { + local p="$1" + local d b + d="$(cd "$(dirname "$p")" && pwd)" || return 1 + b="$(basename "$p")" + printf '%s/%s\n' "$d" "$b" +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --canonicalize) CANONICALIZE=1; shift ;; + --lower-first) LOWER_FIRST=1; shift ;; + -h|--help) + sed -n '1,25p' "$0" >&2 + exit 2 + ;; + --) + shift + while [[ $# -gt 0 ]]; do + ARGS+=("$1") + shift + done + ;; + *) + ARGS+=("$1") + shift + ;; + esac +done + +if [[ "${CANONICALIZE:-0}" == "1" ]] && ! grep -Fq -- "--canonicalize" "${DIFF}"; then + echo "ERROR: selected VEIR diff script does not support --canonicalize: ${DIFF}" >&2 + echo "For the Phase 4 workspace run, set:" >&2 + echo " VEIR_DIFF=../veir/scripts/llzk-diff.sh" >&2 + echo "or bump llzk-lean's clean VeIR dependency pin to a commit containing this flag." >&2 + exit 2 +fi + expand_arg() { local a="$1" if [[ -f "$a" ]]; then - TARGETS+=("$a") + TARGETS+=("$(abs_path "$a")") elif [[ -d "$a" ]]; then # Pick up both .mlir (generic-form) and .llzk (LLZK custom-asm) - # inputs. The latter generally require `LOWER_FIRST=1` to be lowered - # through `llzk-opt --mlir-print-op-generic` before the diff stage. + # inputs. The latter are lowered automatically through + # `llzk-opt --mlir-print-op-generic` before the diff stage. while IFS= read -r f; do - TARGETS+=("$f") + TARGETS+=("$(abs_path "$f")") done < <(find "$a" \( -name '*.mlir' -o -name '*.llzk' \) -type f | sort) else echo "WARN: $a is neither a file nor a directory; skipping" >&2 fi } -if [[ $# -gt 0 ]]; then - for a in "$@"; do expand_arg "$a"; done +if (( ${#ARGS[@]} > 0 )); then + for a in "${ARGS[@]}"; do expand_arg "$a"; done else expand_arg "${CORPUS}" fi if (( ${#TARGETS[@]} == 0 )); then - echo "ERROR: no .mlir inputs to compare (looked under ${CORPUS} or args)." >&2 + echo "ERROR: no .mlir/.llzk inputs to compare (looked under ${CORPUS} or args)." >&2 echo "Add inputs under differential/corpus/, or pass a file/directory arg." >&2 exit 2 fi -# Plumb LOWER_FIRST=1 through to the diff script as the --lower-first flag. +# Common flags for every input. Per-file flags are added in the loop below. DIFF_ARGS=() -if [[ "${LOWER_FIRST:-0}" == "1" ]]; then - DIFF_ARGS+=(--lower-first) +if [[ "${CANONICALIZE:-0}" == "1" ]]; then + DIFF_ARGS+=(--canonicalize) fi PASS=0 FAIL=0 SKIP=0 +MODE_SKIP=0 FAILED_FILES=() -# A file under `expected-divergence/` is a *negative* test: we expect -# DIVERGE (exit 1) and treat PASS (exit 0) as a regression (the gap -# closed; update the doc and move the file). This lets the corpus -# document known alignment gaps without making CI red. +# A file under `expected-divergence/` is a *negative* test. Its file header must +# declare exactly which inverted outcome is accepted: +# +# EXPECTED-DIVERGE +# EXPECTED-VEIR-FAIL +# EXPECTED-LLZK-FAIL +# +# Treating the whole directory as a wildcard would let a compiler/parser crash +# pass as an expected output divergence, which is not acceptance evidence. # # llzk-diff.sh's exit-code contract (see scripts/llzk-diff.sh header): # 0 identical (modulo normalization + allowlist) @@ -103,8 +153,10 @@ FAILED_FILES=() # 2 bad invocation / unreadable input (treat as ERROR; fail loud # regardless of directory polarity — an unreadable test is not # a documented divergence, it's a broken test) -# 77 llzk-opt or lake missing (SKIP — counted separately, neither -# PASS nor FAIL; surfaces as a warning) +# 3 veir-opt failed on the input or selected pipeline +# 4 llzk-opt failed on the input or selected pipeline +# 77 a required differential tool is unavailable (SKIP — counted +# separately, neither PASS nor FAIL; surfaces as a warning) # # The previous wrapper conflated all non-zero exits as "DIVERGE", # which silently passed real ERRORs under expected-divergence/. @@ -115,13 +167,60 @@ is_expected_divergence() { esac } +expected_marker() { + local path="$1" + grep -Eo 'EXPECTED-(DIVERGE|VEIR-FAIL|LLZK-FAIL)' "$path" | head -1 +} + +is_canonical_only() { + case "$1" in + */canonical/*) return 0 ;; + *) return 1 ;; + esac +} + +is_parse_print_only() { + case "$1" in + */parse-print/*) return 0 ;; + *) return 1 ;; + esac +} + for t in "${TARGETS[@]}"; do - "${DIFF}" "$t" "${DIFF_ARGS[@]}" >/dev/null 2>&1 + if [[ "${CANONICALIZE:-0}" == "1" ]]; then + if is_parse_print_only "$t"; then + echo "MODE-SKIP: $t (parse/print-only input)" + MODE_SKIP=$((MODE_SKIP+1)) + continue + fi + elif is_canonical_only "$t"; then + echo "MODE-SKIP: $t (canonicalization-only input)" + MODE_SKIP=$((MODE_SKIP+1)) + continue + fi + + expected="" + if is_expected_divergence "$t"; then + expected="$(expected_marker "$t")" + if [[ -z "$expected" ]]; then + echo "ERROR: $t (expected-divergence input lacks EXPECTED-DIVERGE, EXPECTED-VEIR-FAIL, or EXPECTED-LLZK-FAIL marker)" + FAIL=$((FAIL+1)) + FAILED_FILES+=("$t") + continue + fi + fi + + target_args=("${DIFF_ARGS[@]}") + if [[ "${LOWER_FIRST:-0}" == "1" || "$t" == *.llzk ]]; then + target_args+=(--lower-first) + fi + + "${DIFF}" "$t" "${target_args[@]}" >/dev/null 2>&1 rc=$? case "$rc" in 0) - if is_expected_divergence "$t"; then - echo "UNEXPECTED-PASS: $t (expected divergence, got agreement — gap may be closed)" + if [[ -n "$expected" ]]; then + echo "UNEXPECTED-PASS: $t (declared ${expected}, got agreement — gap may be closed)" FAIL=$((FAIL+1)) FAILED_FILES+=("$t") else @@ -130,7 +229,7 @@ for t in "${TARGETS[@]}"; do fi ;; 1) - if is_expected_divergence "$t"; then + if [[ "$expected" == "EXPECTED-DIVERGE" ]]; then echo "EXPECTED-DIVERGE: $t" PASS=$((PASS+1)) else @@ -139,7 +238,7 @@ for t in "${TARGETS[@]}"; do FAILED_FILES+=("$t") # Re-run with verbose to surface the diff inline. We rerun the whole # pipeline; on a large corpus consider extracting just the diff stage. - VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${DIFF_ARGS[@]}" 2>&1 | sed 's/^/ /' + VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${target_args[@]}" 2>&1 | sed 's/^/ /' fi ;; 2) @@ -148,10 +247,26 @@ for t in "${TARGETS[@]}"; do echo "ERROR: $t (llzk-diff.sh exit 2 — bad invocation or unreadable input)" FAIL=$((FAIL+1)) FAILED_FILES+=("$t") - VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${DIFF_ARGS[@]}" 2>&1 | sed 's/^/ /' + VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${target_args[@]}" 2>&1 | sed 's/^/ /' + ;; + 3|4) + if [[ "$rc" == "3" ]]; then + label="VEIR-FAIL" + else + label="LLZK-FAIL" + fi + if [[ "$expected" == "EXPECTED-${label}" ]]; then + echo "EXPECTED-${label}: $t" + PASS=$((PASS+1)) + else + echo "${label}: $t" + FAIL=$((FAIL+1)) + FAILED_FILES+=("$t") + VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${target_args[@]}" 2>&1 | sed 's/^/ /' + fi ;; 77) - echo "SKIP: $t (llzk-diff.sh exit 77 — llzk-opt or lake missing)" + echo "SKIP: $t (llzk-diff.sh exit 77 — required differential tool unavailable)" SKIP=$((SKIP+1)) ;; *) @@ -159,18 +274,30 @@ for t in "${TARGETS[@]}"; do echo "ERROR: $t (llzk-diff.sh exit $rc — unexpected)" FAIL=$((FAIL+1)) FAILED_FILES+=("$t") - VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${DIFF_ARGS[@]}" 2>&1 | sed 's/^/ /' + VEIR_DIFF_VERBOSE=1 "${DIFF}" "$t" "${target_args[@]}" 2>&1 | sed 's/^/ /' ;; esac done echo -if (( SKIP > 0 )); then - echo "Summary: ${PASS} pass (incl. expected-diverge), ${FAIL} fail, ${SKIP} skip (over ${#TARGETS[@]} inputs)" +if (( SKIP > 0 || MODE_SKIP > 0 )); then + echo "Summary: ${PASS} pass (incl. expected-diverge), ${FAIL} fail, ${SKIP} skip, ${MODE_SKIP} mode-skip (over ${#TARGETS[@]} inputs)" else echo "Summary: ${PASS} pass (incl. expected-diverge), ${FAIL} fail (over ${#TARGETS[@]} inputs)" fi +if (( PASS == 0 && FAIL == 0 && SKIP == 0 && MODE_SKIP > 0 )); then + echo + echo "ERROR: no inputs executed in the selected mode; rerun with --canonicalize or choose a parse/print corpus path." + exit 2 +fi + +if (( SKIP > 0 )); then + echo + echo "ERROR: ${SKIP} input(s) skipped because required tools were unavailable; this is not acceptance evidence." + exit 2 +fi + if (( FAIL > 0 )); then echo echo "Failed inputs (re-run with the specific path for the full diff;" diff --git a/docs/REVIEW.md b/docs/REVIEW.md index f33ab89..e5e7cb7 100644 --- a/docs/REVIEW.md +++ b/docs/REVIEW.md @@ -72,7 +72,7 @@ normalizer. See §8. | Interpreter link | partially started — VEIR now has a value-level `add x 0 → x` interpreter bridge, but no whole-program rewrite soundness theorem and no full 18-op Felt interpreter | `veir/FOLLOWUP.md` §F2 | | Catalog | 2 of 15 patterns; `#assertCatalogCoverage` lists the 13 uncovered | build output | | C++ matcher | fail-closed stub ("MLIR not found"); the "26 tests" are internal `EXPECT`s across 2 ctest exes driven by a **mock** matcher — no real-IR matching is built or tested | cmake log + ctest | -| Strategy A | one positive corpus file, parse-print only (no canonicalization) | inspection | +| Strategy A | seed corpus now covers parse/print and canonicalization mode, with positives plus classified expected divergences; still not complete coverage | inspection + Phase 4 differential runs | --- @@ -88,7 +88,7 @@ Veir.FeltPass.Combine (the pass)→ [propext, Classical.choice, Quot.sound ``` **Update (F1, 2026-06-02):** joint 2 below is now CLOSED. The executable -rewriter that `veir-opt -p felt-combine` actually runs no longer depends on +rewriter that `veir-opt -p=felt-combine` actually runs no longer depends on `sorryAx` — all 15 patterns and the pass are axiom-clean (no `sorryAx`, no `WfIRContext.Dom`), verified by a full `lake build` of the veir source + `#print axioms` on each. Joints **1 and 3 remain open** (the theorem↔pattern @@ -146,11 +146,11 @@ Two framing caveats worth stating to non-Lean readers: (one-sided). Harmless today (it's `veir-only`) but a real instance of the C2 risk that nothing catches. - **H2** `#certThmExists` is a weak invariant (name-resolution only). -- **H3** Strategy A demonstrates little yet: 1 file, parse-print only; LLZK has - zero Felt canonicalizers and its folds no-op on unnamed fields. Named-field - parser parity is now empirically resolved for the generic output path, so the - next blockers are meaningful canonicalization plus field-registry/modular - reduction parity. +- **H3** Strategy A is still seed coverage: Phase 4 now runs a + canonicalization-aware differential over a reviewed small corpus, but the + corpus is not close to full `llzk-lib/test/Dialect/Felt/` coverage. The next + blockers are clean-pin consumption, field-registry/modular-reduction parity, + and broader fold/no-fire cases. - **H4** Stale `lake-manifest.json` (see §2) — **resolved by Phase 1 gates**. **Medium:** M1 no CI axiom-gate (the `warn.sorry false` admits are gone as of diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index f9e298a..1314130 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -1,18 +1,18 @@ # Current Harness State -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Active Phase -- Active phase: Phase 2, LLZK source truth and field registry parity. -- Phase bootstrap file: `docs/phases/PHASE-02-llzk-source-truth.md`. +- Active phase: Phase 6, Strategy A divergence burn-down bootstrap. +- Phase bootstrap file: `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. - Companion repository: `../veir`. -- Companion phase file: `../veir/docs/phases/PHASE-02-llzk-source-truth.md`. +- Companion phase file: `../veir/docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. ## Accepted VeIR Pin - Accepted VeIR commit: - `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. - Accepted source branch: `felt-review-structural-close`. - Accepted source remote: `https://github.com/project-llzk/veir.git`. - Pin mode: remote commit, consumed through Lake metadata and a clean @@ -25,6 +25,19 @@ Last reviewed: 2026-06-06 - Accepted source ref: `origin/main`. - Accepted source checkout: `../llzk-lib`. - Source ledger: `docs/harness/LLZK_SOURCE.md`. +- Operation gap ledger: `docs/harness/FELT_OP_GAPS.md`. + +## Strategy A Test Infrastructure + +- Accepted local `llzk-opt` binary: + `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt`. +- Local LLVM/MLIR checkout: `/home/alh/llvm-project`. +- LLVM checkout commit: + `49f12af164138123589263fe75ea5f1d356e8780`. +- LLVM tools available: + `/home/alh/llvm-project/build/bin/mlir-opt` and + `/home/alh/llvm-project/build/bin/llvm-config`, both reporting + `23.0.0git`. ## Refs @@ -57,20 +70,43 @@ the clean dependency checkout remains the source of truth. partial Felt proof cleanup. That state is preserved under `reviews/PHASE-01/evidence/` and must not be relied on after the pin is refreshed. -- Strategy A and Strategy E smoke gates still classify their own tool status, - but Phase 1 does not make new semantic, differential, or certificate - acceptance claims. +- Strategy A and Strategy E smoke gates still classify their own tool status. + Phase 4 reviewed workspace canonicalization evidence for the seed corpus. + Phase 5 consumed the canonicalization-aware VeIR driver through the clean + dependency pin and recorded the expanded 21-input canonical corpus on that + path. Phase 6 starts from that exact-polarity baseline. The corpus covers all + 15 current VeIR Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, + plus one EXPECTED-LLZK-FAIL parser/verifier gap, but this is not full + Strategy A acceptance. - The local `../llzk-lib` worktree is behind fetched `origin/main`. Current - Phase 2 source claims use `git show origin/main:...` at + source claims use `git show origin/main:...` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`, not stale worktree files. +- Phase 3 closed the operation-gap ledger. Phase 4 added seed canonical + differential coverage through a workspace `VEIR_DIFF` override. Phase 5 pinned + the canonicalization-aware VeIR driver, recorded expanded corpus evidence on + the clean dependency path, and fixed expected-divergence polarity to exact + file-header markers. Phase 6 is the divergence burn-down bootstrap for that + baseline. ## Acceptance Rule -Phase 2 is current only when: +Phase 6 bootstrap is current only when: +- `docs/harness/FELT_OP_GAPS.md` records every accepted LLZK Felt mnemonic and + explicitly marks unsupported Strategy A/E coverage as gaps. +- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` exists and + `docs/harness/CURRENT.md` names Phase 6 as active. +- `docs/harness/SOURCES.md` records `differential/run-differential.sh`, the + Phase 6 phase file, Phase 5 exact-polarity guard evidence, the accepted + `llzk-opt` binary path, and `/home/alh/llvm-project`. - `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` passes. - `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes. - `scripts/harness/doctor.sh --workspace-veir ../veir` passes in strict mode. - `lake build` succeeds against the clean dependency checkout. - `scripts/harness/check-doc-freshness.sh` passes. - `scripts/harness/validate-skills.sh` passes. + +Phase 6 implementation evidence additionally requires reducing or reclassifying +expected divergences without weakening the clean-pin canonical baseline. Until a +Phase 6 implementation deliberately changes that matrix, the current clean-pin +canonical run remains `21 pass (incl. expected-diverge), 0 fail`. diff --git a/docs/harness/FELT_OP_GAPS.md b/docs/harness/FELT_OP_GAPS.md new file mode 100644 index 0000000..7fe9132 --- /dev/null +++ b/docs/harness/FELT_OP_GAPS.md @@ -0,0 +1,62 @@ +# Felt Operation Gap Ledger + +Last reviewed: 2026-06-10 + +## Source Basis + +- Accepted LLZK source ledger: `docs/harness/LLZK_SOURCE.md`. +- Accepted LLZK source commit: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Accepted LLZK source remote: + `git@github.com:project-llzk/llzk-lib.git`. +- Consumed VeIR dependency: + `.lake/packages/VeIR` at + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. +- Current certificate catalog: + `LlzkLean/Cert.lean` and `certs/felt-combine.cert.json`. +- Current differential corpus: + `differential/corpus/`. + +## Phase 3 Rule + +This ledger is not a Strategy A or Strategy E acceptance claim. It is the +current gap map that a future implementation phase must use before adding +corpus inputs, certificates, or checker behavior. + +Any row that moves from `gap` to `covered` must have source evidence, a build, +and an adversarial review disposition. + +## Current Operation Coverage + +| LLZK mnemonic | Consumed VeIR semantic status | Strategy A differential status | Strategy E certificate status | Phase 3 status | +|---|---|---|---|---| +| `const` | Covered baseline in `Data.Felt.const` and `InterpModel.interpretConst` | Smoke corpus only; no acceptance claim | Used by existing cert shapes | Covered baseline | +| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus only; no acceptance claim | `right_identity_zero_add` and `constant_fold_add` certs exist | Covered with known LLZK modular-reduction caveat | +| `sub` | Covered baseline in `Data.Felt.sub` and `InterpModel.interpretSub` | No complete accepted corpus coverage | No committed cert yet for existing VeIR sub rewrites | Gap in Strategy A/E coverage | +| `mul` | Covered baseline in `Data.Felt.mul` and `InterpModel.interpretMul` | No complete accepted corpus coverage | No committed cert yet for existing VeIR mul rewrites | Gap in Strategy A/E coverage | +| `neg` | Covered baseline in `Data.Felt.neg` and `InterpModel.interpretNeg` | No complete accepted corpus coverage | No committed cert yet for existing VeIR neg rewrites | Gap in Strategy A/E coverage | +| `pow` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `div` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `uintdiv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `sintdiv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `umod` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `smod` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `inv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_and` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_or` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_xor` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_not` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `shl` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `shr` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | + +## Known Constraints + +- `lake build` reports 15 VeIR Felt rewrite patterns, with 2 covered by the + current certificate catalog and 13 intentionally uncovered today. +- `scripts/harness/diff-smoke.sh` classifies missing `llzk-opt` as exit 77 in + this environment. That is not differential acceptance. +- The Strategy E checker still lacks the runtime MLIR matcher, so existing + certificates prove schema/catalog consistency, not end-to-end LLZK rewrite + acceptance. +- Phase 3 may refine this ledger and its gates, but must not mark a gap covered + without source evidence and review disposition. diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index bd455b8..a1fab45 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -1,40 +1,106 @@ # Harness Gates -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Gate Inventory | Gate | Command | Expected behavior | What it proves | |---|---|---|---| -| LLZK source truth | `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` | Passes only when the accepted LLZK source commit is available, `origin/main` equals the accepted commit, the source ledger records the accepted commit, the accepted Felt op set matches the ledger, and checker registry comments enumerate the accepted built-ins | Phase 2 source facts are exact-ref based and certificate/checker comments match the LLZK source registry | +| Strategy A Phase 6 bootstrap | `scripts/harness/check-doc-freshness.sh` | Passes only when Phase 6 is active, the Phase 6 review workspace exists, Phase 5 is marked completed, exact-polarity guard evidence remains present, and the source ledger records the Phase 6 phase file plus local test infrastructure | Phase 6 starts from the clean-pin exact-polarity corpus without claiming full Strategy A acceptance | +| Felt operation gap ledger | `scripts/harness/check-doc-freshness.sh` | Passes only when the Phase 3 review workspace exists, `docs/harness/FELT_OP_GAPS.md` is present, exactly 18 accepted LLZK Felt mnemonic rows appear, and every unsupported or incomplete Strategy A/E row is still marked as a gap | Phase 5 continues from the complete documented operation-gap map instead of implicit Strategy A/E coverage claims | +| LLZK source truth | `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` | Passes only when the accepted LLZK source remote, commit, and `origin/main` match, the source ledger records every gated source file, the accepted Felt op set and representative syntax/fold facts match the ledger, the pinned VeIR dependency's `feltPrime` matches the accepted field registry, and checker/certificate artifacts enumerate the accepted built-ins | Phase 2 source facts are exact-ref and exact-remote based, the consumed VeIR pin mirrors the LLZK registry, and certificate/checker comments match the LLZK source registry | | Pin verification | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | Passes only when Lake file URLs/revs, manifest `type`/`inputRev`, and dependency HEAD agree on the accepted commit, the dependency is clean, and workspace VeIR is either the accepted commit or a descendant used only for metadata context | llzk-lean is not relying on hidden `.lake/packages/VeIR` edits or a spoofed source | -| Strict doctor | `scripts/harness/doctor.sh --workspace-veir ../veir` | Passes after the pin gate and layout checks pass | Phase 1 harness state is complete and strict | +| Strict doctor | `scripts/harness/doctor.sh --workspace-veir ../veir` | Passes after the pin gate and layout checks pass | Current strict harness state is complete | | Local doctor | `scripts/harness/doctor.sh` | Passes with a warning that workspace VeIR was not checked | Local layout is valid, but the run is not full acceptance evidence | | Lake build | `lake build` | Builds against the clean accepted VeIR dependency | The selected pin is buildable by llzk-lean | -| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when Phase 1 docs and review evidence are present | Canonical phase metadata and evidence are current | -| Differential smoke | `scripts/harness/diff-smoke.sh` | Keeps smoke status classification behavior | Strategy A status remains classified without becoming a Phase 1 acceptance claim | -| Certificate smoke | `scripts/harness/cert-smoke.sh` | Keeps smoke status classification behavior | Strategy E status remains classified without becoming a Phase 1 acceptance claim | +| Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when current phase docs, Phase 3 review workspace, required Phase 3 evidence outputs, Phase 2 source evidence, dated harness docs, and expected success markers in the evidence are present | Canonical phase metadata, review state, and closeout evidence are current | +| Differential smoke | `scripts/harness/diff-smoke.sh` | Keeps smoke status classification behavior | Strategy A status remains classified without becoming an acceptance claim | +| Certificate smoke | `scripts/harness/cert-smoke.sh` | Keeps smoke status classification behavior | Strategy E status remains classified without becoming an acceptance claim | | Skill validation | `scripts/harness/validate-skills.sh` | Passes when repo-local skills have required sections | Repo-local skills remain auditable | +| Phase 4 workspace differential gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus` | Runs workspace VeIR's canonicalization-aware diff script over the reviewed seed corpus | Initial Phase 4 evidence exists, but remains workspace evidence until the clean VeIR dependency pin consumes the updated script | +| Phase 5 clean-pin implementation gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` override | The canonicalization-aware diff script has been consumed through a clean dependency pin and supports the Phase 6 divergence burn-down baseline | +| Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Remains `21 pass (incl. expected-diverge), 0 fail` until a reviewed Phase 6 change reduces or reclassifies a divergence | Prevents Phase 6 from starting on a weakened Strategy A baseline | ## Reproducible-Pin Failures ## LLZK Source-Truth Failures +`scripts/harness/check-doc-freshness.sh` must fail if: + +- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` is missing. +- `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md` is not marked completed + and superseded by Phase 6. +- `docs/phases/PHASE-04-strategy-a-differential.md` is missing. +- `docs/phases/PHASE-03-felt-op-gap-ledger.md` is missing. +- `docs/harness/CURRENT.md` does not name Phase 6 as active. +- `docs/harness/SOURCES.md` does not record `differential/run-differential.sh`, + `differential/corpus/`, + `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`, Phase 5 + exact-polarity guard evidence, + `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt`, + and `/home/alh/llvm-project`. +- `docs/harness/FELT_OP_GAPS.md` is missing. +- `docs/harness/FELT_OP_GAPS.md` has anything other than exactly 18 operation + rows, or omits or duplicates any accepted LLZK Felt mnemonic: + `const`, `add`, `sub`, `mul`, `pow`, `div`, `uintdiv`, `sintdiv`, `umod`, + `smod`, `neg`, `inv`, `bit_and`, `bit_or`, `bit_xor`, `bit_not`, `shl`, + `shr`. +- `docs/harness/FELT_OP_GAPS.md` stops marking `sub`, `mul`, or `neg` as gaps + in Strategy A/E coverage. +- `docs/harness/FELT_OP_GAPS.md` stops marking `pow`, `div`, `uintdiv`, + `sintdiv`, `umod`, `smod`, `inv`, `bit_and`, `bit_or`, `bit_xor`, + `bit_not`, `shl`, or `shr` as missing from the consumed VeIR + `Data.Felt`/`InterpModel` and as `Gap`. +- `reviews/PHASE-03` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. +- `reviews/PHASE-04` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. +- `reviews/PHASE-05` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. +- `reviews/PHASE-06` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. +- `reviews/PHASE-03/evidence` lacks nonempty Phase 3 outputs for doc + freshness, LLZK source truth, pin verification, strict doctor, skill + validation, lake build, or adversarial review. +- Phase 3 evidence files are nonempty but omit their expected success markers, + including `0 fail` summaries, `Build completed successfully`, the expected + 2-of-15 certificate catalog coverage line, and adversarial proof that no + missing-operation semantics or Strategy A/E implementation changes were + introduced. +- Phase 4 bootstrap docs claim Strategy A pass-pipeline acceptance before the + reviewed canonicalization command and corpus evidence exist. +- Canonicalization evidence omits the accepted `LLZK_OPT` path, omits the + reviewed `VEIR_DIFF` override or clean pin bump, or leaves divergences + unclassified. +- Phase 5 bootstrap docs claim clean-pin Strategy A acceptance before the + default dependency canonicalization command and corpus evidence exist. +- Phase 6 bootstrap docs claim full Strategy A acceptance, omit the Phase 5 + exact-polarity baseline, or fail to mark Phase 5 completed. + `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` must fail if: - `../llzk-lib` is missing or not a git checkout. +- `../llzk-lib origin` is not + `git@github.com:project-llzk/llzk-lib.git`. - The accepted source commit `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` is unavailable. - `../llzk-lib origin/main` differs from the accepted source commit. -- `docs/harness/LLZK_SOURCE.md` does not record the accepted source commit or - `lib/Util/Field.cpp`. +- `docs/harness/LLZK_SOURCE.md` does not record the accepted source remote, + accepted source commit, or every ledgered source file. - `include/llzk/Dialect/Felt/IR/Ops.td` does not define the accepted 18-op Felt ledger: `const`, `add`, `sub`, `mul`, `pow`, `div`, `uintdiv`, `sintdiv`, `umod`, `smod`, `neg`, `inv`, `bit_and`, `bit_or`, `bit_xor`, `bit_not`, `shl`, `shr`. +- Any ledgered Felt source file is missing from the accepted commit. +- The ledgered attribute, interface, folder, lit, or unit-test source facts + checked by the gate disappear or stop matching the accepted source. - `lib/Util/Field.cpp::initKnownFields` does not define `bn128`, `bn254`, `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and `koalabear` as recorded in `docs/harness/LLZK_SOURCE.md`. +- `.lake/packages/VeIR` is missing, not at + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`, or its + `Veir/Passes/Felt/InterpModel.lean` `feltPrime` mirror disagrees with the + accepted LLZK field registry. - Checker registry comments omit an accepted built-in field. `scripts/harness/verify-pins.sh` must fail if: @@ -44,9 +110,9 @@ Last reviewed: 2026-06-06 `https://github.com/project-llzk/veir.git`. - `lake-manifest.json` does not record VeIR as a `git` dependency. - Either Lake file names a commit other than - `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. - `lake-manifest.json` records a VeIR `inputRev` other than - `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. - `.lake/packages/VeIR` HEAD differs from the manifest rev. - `.lake/packages/VeIR` has any modified, deleted, staged, or untracked file. - A supplied workspace VeIR path neither equals nor descends from the accepted @@ -54,12 +120,17 @@ Last reviewed: 2026-06-06 ## Non-Claims -Phase 1 does not prove: +The current harness does not prove: - Felt semantic parity. -- Complete differential corpus coverage. +- Complete differential corpus coverage beyond the current 15-pattern Felt + rewrite matrix. - Runtime LLZK rewrite verification. - Full Lean proof audit beyond buildability of the selected pin. - CI coverage when external tooling is missing. -- Missing Felt operation semantics beyond the registry source facts. Phase 2 - does not port additional Felt operations. +- Missing Felt operation semantics beyond the registry source facts. +- Phase 6 divergence burn-down has not yet reduced expected divergences. Phase 5 + clean-pin corpus evidence expands the Felt rewrite-pattern matrix but does not + expand certificates, complete all Strategy A corpus coverage, or port missing + operations. Phase 4 workspace evidence remains historical seed evidence; Phase + 6 implementation evidence must preserve the clean dependency baseline. diff --git a/docs/harness/LLZK_SOURCE.md b/docs/harness/LLZK_SOURCE.md index b8c2729..d1caf72 100644 --- a/docs/harness/LLZK_SOURCE.md +++ b/docs/harness/LLZK_SOURCE.md @@ -1,13 +1,13 @@ # LLZK Felt Source Ledger -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Accepted Source | Item | Value | |---|---| | Repository | `../llzk-lib` | -| Remote | `git@github.com:Veridise/llzk-lib.git` | +| Remote | `git@github.com:project-llzk/llzk-lib.git` | | Accepted ref | `origin/main` | | Accepted commit | `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | | Retrieval form | `git -C ../llzk-lib show db922857bc5a88a9107627ef6b36a8b5e57bc5c2:` | @@ -86,7 +86,9 @@ Run: scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib ``` -The gate reads source through `git show` at the accepted commit, checks -`origin/main`, verifies the Felt op mnemonic list above, verifies the field -registry, and checks llzk-lean's checker comments for the full built-in field -list. +The gate reads source through `git show` at the accepted commit, checks the +`origin` remote URL and `origin/main`, verifies every ledgered source file is +present, checks representative syntax and fold facts from the ledgered files, +verifies the Felt op mnemonic list above, verifies the field registry, checks +the pinned VeIR dependency's `feltPrime` mirror, and checks llzk-lean's checker +comments for the full built-in field list. diff --git a/docs/harness/PINS.md b/docs/harness/PINS.md index aca0faa..0920081 100644 --- a/docs/harness/PINS.md +++ b/docs/harness/PINS.md @@ -1,21 +1,24 @@ # Dependency Pins -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Accepted VeIR Pin -- Commit: `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3` -- Short ref: `d4cc1bf2d31b` +- Commit: `220cd215579b435c3c22ce86b34a3f4ce2ca276e` +- Short ref: `220cd215579b` - Remote: `https://github.com/project-llzk/veir.git` - Branch at selection time: `felt-review-structural-close` - Mode: remote commit pinned through Lake metadata and a clean Lake package checkout -This commit is a descendant of the Phase 1 accepted pin -`d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`, which was itself a descendant of -the previous Lake pin `09d5f00f0d2b4a8710afbe53dfdd7cf468578a04`. +This commit is a descendant of the Phase 2 accepted pin +`d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, which was itself a descendant of +the Phase 1 accepted pin `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. -This pin includes the Phase 2 VeIR field-registry update and source-truth gate. +This pin preserves the Phase 2 VeIR field-registry update and source-truth +gate, and adds the Phase 5 canonicalization-aware `scripts/llzk-diff.sh` +driver consumed by the default llzk-lean dependency checkout. The script uses a +built `.lake/build/bin/veir-opt` when present and falls back to `lake exec`. ## Required State @@ -38,7 +41,7 @@ The following must all identify the accepted commit: acceptance evidence. - Exploratory workspace: `scripts/harness/verify-pins.sh --mode exploratory --workspace-veir PATH` may warn about a workspace mismatch. This output must - not be used to close Phase 2. + not be used to close Phase 5. ## Forbidden Hidden State diff --git a/docs/harness/REVIEWS.md b/docs/harness/REVIEWS.md index 425f9ea..81c9d21 100644 --- a/docs/harness/REVIEWS.md +++ b/docs/harness/REVIEWS.md @@ -1,6 +1,6 @@ # Review Protocol -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Scope diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md index 626326e..97ab7a3 100644 --- a/docs/harness/SOURCES.md +++ b/docs/harness/SOURCES.md @@ -1,13 +1,13 @@ # Source Ledger -Last reviewed: 2026-06-06 +Last reviewed: 2026-06-10 ## Trusted Local Sources | Source | Ref or retrieval | Use | |---|---:|---| | `docs/phases/PHASE-01-pins-and-repro.md` | local file, 2026-06-05 | Phase 1 objective, artifacts, gates, done criteria | -| Accepted VeIR pin | `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3` | Dependency commit consumed by llzk-lean | +| Accepted VeIR pin | `220cd215579b435c3c22ce86b34a3f4ce2ca276e` | Dependency commit consumed by llzk-lean | | Accepted VeIR branch | `felt-review-structural-close` | Remote branch containing the accepted commit | | Accepted VeIR remote | `https://github.com/project-llzk/veir.git` | Canonical source repository for the accepted pin | | `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | @@ -18,10 +18,29 @@ Last reviewed: 2026-06-06 | `docs/phases/PHASE-02-llzk-source-truth.md` | local file, 2026-06-06 | Phase 2 source-truth objective, artifacts, gates, and done criteria | | `docs/harness/LLZK_SOURCE.md` | local file, 2026-06-06 | Accepted LLZK Felt source ledger | | Accepted LLZK source commit | `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Exact `llzk-lib` source commit for Phase 2 Felt source facts | +| Accepted LLZK source remote | `git@github.com:project-llzk/llzk-lib.git` | Canonical local source remote for the accepted LLZK source ref | | Accepted LLZK source ref | `../llzk-lib origin/main` | Fetched source ref selected for Phase 2 | | Accepted LLZK field registry | `lib/Util/Field.cpp` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Built-in field registry facts | | Accepted LLZK Felt ops | `include/llzk/Dialect/Felt/IR/Ops.td` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` | Felt op mnemonic ledger | | `scripts/harness/verify-llzk-source.sh` | local file, 2026-06-06 | Phase 2 LLZK source-truth gate | +| `docs/phases/PHASE-03-felt-op-gap-ledger.md` | local file, 2026-06-06 | Phase 3 operation-gap objective, artifacts, gates, and done criteria | +| `docs/harness/FELT_OP_GAPS.md` | local file, 2026-06-06 | Phase 3 accepted Felt operation coverage and gap ledger | +| `docs/phases/PHASE-04-strategy-a-differential.md` | local file, 2026-06-09 | Phase 4 Strategy A differential objective, artifacts, gates, and done criteria | +| `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md` | local file, 2026-06-10 | Completed Phase 5 clean-pin consumption and corpus-expansion objective, artifacts, gates, and done criteria | +| `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` | local file, 2026-06-10 | Phase 6 divergence burn-down objective, artifacts, gates, and done criteria | +| `differential/run-differential.sh` | local file, 2026-06-09 | llzk-lean corpus wrapper around the consumed VeIR diff script | +| `differential/corpus/` | local files, 2026-06-09 | Current Strategy A corpus and expected-divergence classification | +| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support | +| Workspace VeIR `scripts/llzk-diff.sh` | `../veir/scripts/llzk-diff.sh`, local file, 2026-06-09 | Phase 4 canonicalization-aware driver used explicitly through `VEIR_DIFF=../veir/scripts/llzk-diff.sh` | +| Phase 4 canonical differential evidence | `reviews/PHASE-04/evidence/differential-canonicalize.txt` | Reviewed workspace Strategy A seed evidence; not clean-pin acceptance | +| Phase 4 fresh adversarial review evidence | `reviews/PHASE-04/evidence/adversarial-review-fresh.txt` | Confirms Phase 4 wrapper findings were resolved before Phase 5 | +| Phase 5 clean-pin canonical differential evidence | `reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt` | Expanded corpus canonical run through the default clean dependency driver | +| Phase 5 exact-polarity guard evidence | `reviews/PHASE-05/evidence/polarity-guard.txt` | Proves a canonical `EXPECTED-DIVERGE` input fails on the wrong LLZK failure mode | +| Phase 6 bootstrap review workspace | `reviews/PHASE-06/` | Active Phase 6 request, findings, disposition, adversarial review, and evidence | +| Accepted local `llzk-opt` binary | `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt` | LLZK executable for Strategy A differential testing | +| Local LLVM/MLIR checkout | `/home/alh/llvm-project` at `49f12af164138123589263fe75ea5f1d356e8780` | Source and build tree for local MLIR/LLVM testing support | +| Local `mlir-opt` | `/home/alh/llvm-project/build/bin/mlir-opt`, version `23.0.0git` | Local MLIR tool available for Strategy A testing | +| Local `llvm-config` | `/home/alh/llvm-project/build/bin/llvm-config`, version `23.0.0git` | Local LLVM configuration tool available for Strategy A testing | Evidence for the dirty bootstrap state and the refreshed clean state is captured under `reviews/PHASE-01/evidence/`. @@ -34,7 +53,11 @@ under `../veir/reviews/PHASE-01/evidence/accepted-remote-branch.txt`. No web page, issue, or mutable branch name is trusted without the exact commit hash above. For LLZK source facts, `origin/main` is accepted only through the -exact commit `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +exact commit `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` and the recorded +`project-llzk/llzk-lib` origin remote. + +The local LLVM checkout is used as test infrastructure, not as source truth for +LLZK or VeIR semantics. ## Contextual Non-Canonical Material diff --git a/docs/phases/PHASE-02-llzk-source-truth.md b/docs/phases/PHASE-02-llzk-source-truth.md index 6752e78..1e6c34a 100644 --- a/docs/phases/PHASE-02-llzk-source-truth.md +++ b/docs/phases/PHASE-02-llzk-source-truth.md @@ -23,6 +23,7 @@ source facts those strategies depend on are current and mechanically checked. - llzk-lean currently pins VeIR to: `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. - Local `llzk-lib` checkout after fetch: + - origin remote: `git@github.com:project-llzk/llzk-lib.git` - local `main`: `30b0fa1eb77de154ff60c13fa88ef286d8b01c65` - fetched `origin/main`: `db922857bc5a88a9107627ef6b36a8b5e57bc5c2` - local checkout is behind `origin/main` and must not be treated as current @@ -87,7 +88,9 @@ The initial accepted LLZK source ref defines these built-in fields: ## Gates To Implement - `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` fails if the - accepted source ref is unavailable or unrecorded. + `../llzk-lib origin` remote is not + `git@github.com:project-llzk/llzk-lib.git`, or if the accepted source ref is + unavailable or unrecorded. - The source gate checks the 18 Felt op mnemonics: `const`, `add`, `sub`, `mul`, `pow`, `div`, `uintdiv`, `sintdiv`, `umod`, `smod`, `neg`, `inv`, `bit_and`, `bit_or`, `bit_xor`, `bit_not`, `shl`, @@ -100,8 +103,9 @@ The initial accepted LLZK source ref defines these built-in fields: ## Review Requirements - Every LLZK source claim must cite an exact `llzk-lib` commit and file path. -- Review evidence must include `git -C ../llzk-lib rev-parse HEAD origin/main` - and source extraction output. +- Review evidence must include `git -C ../llzk-lib remote get-url origin`, + `git -C ../llzk-lib rev-parse HEAD origin/main`, and source extraction + output. - The reviewer must explicitly reject stale local `llzk-lib` checkout facts unless they match the accepted source ref. - The reviewer must confirm llzk-lean docs and checker comments include @@ -111,8 +115,10 @@ The initial accepted LLZK source ref defines these built-in fields: ## Done Criteria - `docs/harness/LLZK_SOURCE.md` records the accepted LLZK Felt source ref and - files. + files, including the accepted `llzk-lib` remote URL. - llzk-lean docs and checker assumptions match the accepted source ledger. +- The source-truth gate checks the consumed `.lake/packages/VeIR` + `feltPrime` mirror against the accepted LLZK field registry. - A source-truth gate catches missing `grumpkin`, missing `koalabear`, or stale `bn128`/`bn254` registry facts. - `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes. diff --git a/docs/phases/PHASE-03-felt-op-gap-ledger.md b/docs/phases/PHASE-03-felt-op-gap-ledger.md new file mode 100644 index 0000000..5c4566e --- /dev/null +++ b/docs/phases/PHASE-03-felt-op-gap-ledger.md @@ -0,0 +1,96 @@ +# Phase 3: Felt Operation Semantics Gap Ledger + +Status: active +Last reviewed: 2026-06-06 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-03-felt-op-gap-ledger.md + +## Objective + +Create a source-grounded ledger that maps every accepted LLZK Felt operation to +the consumed VeIR pin, Strategy A differential status, Strategy E certificate +status, and known gaps. + +This phase is a documentation and gate phase. It prepares the next independent +implementation phase by making operation coverage explicit and mechanically +fresh without expanding the certificate catalog or differential corpus yet. + +## Starting State + +- llzk-lean HEAD at Phase 3 bootstrap: + `617702beadfbad6be784945e2bd98e8a788d357c`. +- Workspace VeIR HEAD at Phase 3 bootstrap: + `0c5280de5715dc0fa518e7e3782e784a5962d4d8`. +- Consumed VeIR dependency pin: + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- Accepted LLZK source remote: + `git@github.com:project-llzk/llzk-lib.git`. +- Accepted LLZK source commit: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Local `../llzk-lib` checkout remains stale at + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65`; Phase 3 source facts must use + the accepted commit through `git show`. +- Phase 2 gates prove the accepted 18-op LLZK Felt source set, accepted field + registry, and consumed VeIR `feltPrime` mirror. +- Current certificate catalog covers 2 of 15 VeIR Felt rewrite patterns and + reports 13 uncovered at build time. +- Current Strategy A smoke classifies missing `llzk-opt` as exit 77 in this + environment and does not prove differential acceptance. +- Current worktree is dirty from Phase 2 close-out documentation/harness fixes + and separate pre-existing root/differential/skill documentation edits. These + are not Phase 3 semantic implementation evidence. + +## Non-Goals + +- Do not expand the certificate catalog in this phase. +- Do not implement the Strategy E runtime MLIR matcher in this phase. +- Do not add differential corpus inputs in this phase. +- Do not port missing VeIR Felt operations in this phase. +- Do not change the accepted VeIR dependency pin. +- Do not claim Strategy A or Strategy E acceptance. + +## Artifacts To Create Or Update + +- `docs/harness/FELT_OP_GAPS.md`: canonical operation coverage and gap ledger. +- `docs/harness/CURRENT.md`: move the active phase to Phase 3. +- `docs/harness/SOURCES.md`: record the Phase 3 ledger as trusted local source. +- `docs/harness/GATES.md`: document the Phase 3 documentation gate. +- `scripts/harness/check-doc-freshness.sh`: require the Phase 3 phase file, + review workspace, and operation-gap ledger. +- `reviews/PHASE-03/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + adversarial review workspace. + +## Gates To Implement + +- `scripts/harness/check-doc-freshness.sh` fails if Phase 3 is not active, if + `docs/harness/FELT_OP_GAPS.md` is missing, or if the ledger omits any accepted + LLZK Felt mnemonic. +- `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to + pass, proving the operation ledger is grounded in the accepted LLZK source + and the consumed VeIR dependency. +- `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass. +- `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- `lake build` succeeds after documentation changes. + +## Review Requirements + +- Every operation-coverage claim must cite an exact local source file or the + accepted LLZK source ledger. +- The reviewer must verify that the 18 LLZK Felt op mnemonics are all present + in `docs/harness/FELT_OP_GAPS.md`. +- The reviewer must verify that Strategy A and Strategy E status is described + as current coverage or a gap, not as acceptance. +- The reviewer must verify that Phase 3 does not smuggle in certificate, + differential, or semantic implementation changes. +- Disposition every finding before closing the phase. + +## Done Criteria + +- `docs/harness/FELT_OP_GAPS.md` records all 18 accepted LLZK Felt operations. +- The ledger distinguishes consumed VeIR semantic coverage from missing or + unclassified operations. +- The ledger records current certificate and differential coverage without + claiming acceptance for incomplete paths. +- `check-doc-freshness.sh`, `verify-llzk-source.sh`, pin checks, and + `lake build` pass. +- Phase 3 review artifacts contain fresh adversarial evidence. diff --git a/docs/phases/PHASE-04-strategy-a-differential.md b/docs/phases/PHASE-04-strategy-a-differential.md new file mode 100644 index 0000000..6fb532e --- /dev/null +++ b/docs/phases/PHASE-04-strategy-a-differential.md @@ -0,0 +1,121 @@ +# Phase 4: Strategy A Differential Harness Bootstrap + +Status: completed; superseded by Phase 5 +Last reviewed: 2026-06-09 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-04-strategy-a-differential.md + +## Objective + +Bootstrap Strategy A as the active phase: make the llzk-lean differential +corpus and wrapper the canonical next workstream, record available test +infrastructure, and set the acceptance target for canonicalization-enabled +LLZK/VeIR differential runs. + +This phase starts from the Phase 3 operation-gap ledger. It does not expand the +certificate catalog or claim differential acceptance. It prepares the concrete +implementation work: run `llzk-opt --canonicalize` and +`veir-opt -p=felt-combine` over a reviewed Felt corpus and classify every +divergence. + +## Starting State + +- llzk-lean HEAD at Phase 4 bootstrap: + `617702beadfbad6be784945e2bd98e8a788d357c`. +- Workspace VeIR HEAD at Phase 4 bootstrap: + `0c5280de5715dc0fa518e7e3782e784a5962d4d8`. +- Consumed VeIR dependency pin remains: + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- Accepted LLZK source commit remains: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Local `../llzk-lib` worktree remains stale at + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65`; source facts still use the + accepted commit through `git show`. +- `llzk-opt` is not on `PATH`, but the accepted local binary is available at + `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt`. +- LLVM/MLIR test infrastructure is available at `~/llvm-project`, a clean + checkout of `https://github.com/llvm/llvm-project.git` at + `49f12af164138123589263fe75ea5f1d356e8780`, with + `/home/alh/llvm-project/build/bin/mlir-opt` and + `/home/alh/llvm-project/build/bin/llvm-config` reporting `23.0.0git`. +- `differential/run-differential.sh` wraps the consumed VeIR + `scripts/llzk-diff.sh` by default and can explicitly consume the workspace + VeIR script through `VEIR_DIFF=../veir/scripts/llzk-diff.sh`. +- Phase 4 workspace implementation adds canonicalization mode: + `llzk-opt --canonicalize --mlir-print-op-generic` compared with + `veir-opt -p=felt-combine`. +- `differential/corpus/` now contains parse/print and canonical positives plus + classified expected divergences for generic named-field LLZK failure, DCE + mismatch, modular reduction, and field-registry preconditions. +- Current worktree is dirty from Phase 2/3 harness documentation and Phase 4 + bootstrap edits. These are not Strategy A acceptance evidence. + +## Non-Goals + +- Do not implement missing VeIR Felt operations in this phase bootstrap. +- Do not expand Strategy E certificates or implement the runtime MLIR matcher. +- Do not change the accepted VeIR dependency pin. +- Do not treat parse/print agreement as canonicalization acceptance. +- Do not let missing `llzk-opt`, skipped runs, or expected-divergence polarity + count as a passing Strategy A implementation gate. + +## Artifacts To Create Or Update + +- `docs/phases/PHASE-04-strategy-a-differential.md`: Phase 4 bootstrap. +- `docs/harness/CURRENT.md`: move the active phase to Phase 4. +- `docs/harness/SOURCES.md`: record the differential wrapper, corpus, + `llzk-opt`, and `~/llvm-project` test infrastructure. +- `docs/harness/GATES.md`: document Phase 4 bootstrap and future Strategy A + acceptance gates. +- `scripts/harness/check-doc-freshness.sh`: require Phase 4 to be active while + preserving Phase 2 source-truth and Phase 3 operation-gap checks. +- `scripts/harness/doctor.sh`: require Phase 4 docs and review workspace. +- `reviews/PHASE-04/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + Phase 4 review workspace. + +## Gates To Implement + +- Bootstrap freshness: + `scripts/harness/check-doc-freshness.sh` passes only when Phase 4 is active, + the Phase 4 review workspace exists, the Phase 3 gap ledger remains intact, + and the source ledger records the differential wrapper, corpus, and local test + tools. +- Source truth: + `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to + pass. +- Pin verification: + `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass. +- Strict doctor: + `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- Build: + `lake build` succeeds against the clean dependency checkout. +- Implementation gate: + Strategy A acceptance requires a reviewed command that sets `LLZK_OPT` to the + accepted binary and runs canonicalization on both tools over the accepted + corpus. The workspace command is: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus`. + Bootstrap does not satisfy this gate; the workspace implementation is seed + evidence until the clean VeIR pin consumes the updated script. + +## Review Requirements + +- The reviewer must verify that Phase 4 is clearly scoped to Strategy A. +- The reviewer must verify that the docs do not claim differential acceptance + before canonicalization and corpus evidence exist. +- The reviewer must verify that `~/llvm-project` and the Nix `llzk-opt` path are + recorded as test infrastructure, not as proof state. +- The reviewer must verify that Phase 2 source-truth gates, Phase 3 gap-ledger + evidence, and dependency pin gates still pass. +- Disposition every finding before closing the phase. + +## Done Criteria + +- Phase 4 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- `docs/harness/CURRENT.md` names Phase 4 as active. +- `docs/harness/SOURCES.md` records the differential wrapper, corpus, accepted + `llzk-opt` path, and `~/llvm-project` build path. +- `check-doc-freshness.sh`, `verify-llzk-source.sh`, `verify-pins.sh`, + `doctor.sh`, `validate-skills.sh`, and `lake build` pass after the bootstrap. +- The canonicalization-aware workspace execution path exists and the seed corpus + is reclassified. The next task is to bump/consume a clean VeIR pin for this + script and broaden the corpus toward the full Strategy A v1 bar. diff --git a/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md b/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md new file mode 100644 index 0000000..b404f76 --- /dev/null +++ b/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md @@ -0,0 +1,115 @@ +# Phase 5: Strategy A Pin and Corpus + +Status: completed; superseded by Phase 6 +Last reviewed: 2026-06-10 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md + +## Objective + +Bootstrap the next Strategy A workstream after the Phase 4 workspace +differential: consume the canonicalization-aware VeIR diff script through a +clean llzk-lean dependency pin, then expand the reviewed corpus toward the +Strategy A v1 bar. + +This phase starts from Phase 4's seed evidence. Bootstrap did not change the +accepted VeIR pin or claim full Strategy A acceptance. Phase 5 execution now +selects a clean VeIR pin that contains the canonicalization-aware diff driver; +the clean-pin corpus now covers all 15 VeIR Felt rewrite-pattern definitions as +either positives or expected divergences. + +## Starting State + +- llzk-lean HEAD at Phase 5 bootstrap: + `617702beadfbad6be784945e2bd98e8a788d357c`. +- Workspace VeIR HEAD at Phase 5 bootstrap: + `0c5280de5715dc0fa518e7e3782e784a5962d4d8`. +- Consumed VeIR dependency pin at bootstrap: + `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`. +- Phase 5 clean-pin target: + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. +- Accepted LLZK source commit remains: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Local `../llzk-lib` worktree remains stale at + `30b0fa1eb77de154ff60c13fa88ef286d8b01c65`; source facts still use the + accepted commit through `git show`. +- Phase 4 produced reviewed workspace evidence for: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus`. +- The default clean pinned VeIR dependency script now supports canonicalization, + so `./differential/run-differential.sh --canonicalize ...` must run without a + `VEIR_DIFF` workspace override. +- Current worktree is dirty from Phase 2/3 harness documentation, Phase 4 + differential implementation, and Phase 5 bootstrap docs. These are not pin + acceptance evidence. + +## Non-Goals + +- Do not silently treat `VEIR_DIFF=../veir/scripts/llzk-diff.sh` as clean pin + acceptance. +- Do not broaden the corpus by moving expected divergences to positives without + a passing canonical run and review disposition. +- Do not implement missing VeIR Felt operations or Strategy E certificates in + this phase bootstrap. +- Do not change the accepted LLZK source commit or field registry facts. + +## Artifacts To Create Or Update + +- `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md`: Phase 5 bootstrap. +- `docs/harness/CURRENT.md`: move the active phase to Phase 5. +- `docs/harness/SOURCES.md`: record Phase 5, Phase 4 evidence, the default + clean VeIR diff-script state, and local test infrastructure. +- `docs/harness/GATES.md`: document Phase 5 bootstrap and clean-pin Strategy A + implementation gates. +- `lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR`: pin and + consume the clean VeIR commit that carries canonical diff support. +- `scripts/harness/check-doc-freshness.sh`: require Phase 5 to be active while + preserving Phase 2, Phase 3, and Phase 4 evidence checks. +- `scripts/harness/doctor.sh`: require Phase 5 docs and review workspace. +- `reviews/PHASE-05/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + Phase 5 review workspace. + +## Gates To Implement + +- Bootstrap freshness: + `scripts/harness/check-doc-freshness.sh` passes only when Phase 5 is active, + the Phase 5 review workspace exists, Phase 4 evidence remains present, and + source ledgers record the Phase 5 target. +- Pin verification: + `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes with the + clean dependency pin at `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. +- Strict doctor: + `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- Build: + `lake build` succeeds against the clean dependency checkout. +- Phase 5 implementation gate: + after the pin bump, canonicalization must run through the default dependency + path with no workspace override: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus`. + Clean-pin expanded corpus evidence covers the 15 VeIR Felt rewrite-pattern + definitions and still separates passing cases from expected divergences. + Reducing expected divergences and any future reclassification remain open + Phase 5 work. + +## Review Requirements + +- The reviewer must verify that Phase 5 is scoped to clean pin consumption and + corpus expansion, not general Strategy A acceptance. +- The reviewer must verify that docs distinguish workspace evidence from clean + dependency evidence. +- The reviewer must verify that Phase 4 adversarial findings are closed before + Phase 5 implementation work starts. +- The reviewer must verify that existing source-truth, pin, doctor, skill, and + build gates still pass. +- Disposition every finding before closing the phase. + +## Done Criteria + +- Phase 5 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- `docs/harness/CURRENT.md` names Phase 5 as active. +- `docs/harness/SOURCES.md` records the Phase 5 phase file and Phase 4 + canonical differential evidence. +- `check-doc-freshness.sh`, `verify-llzk-source.sh`, `verify-pins.sh`, + `doctor.sh`, `validate-skills.sh`, and `lake build` pass after the bootstrap. +- The clean VeIR pin consumes the canonicalization-aware diff script, and the + clean-pin corpus matrix covers all 15 VeIR Felt rewrite-pattern definitions + as either PASS or EXPECTED-DIVERGE under the canonicalized gate. diff --git a/docs/phases/PHASE-06-strategy-a-divergence-burndown.md b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md new file mode 100644 index 0000000..6280ef9 --- /dev/null +++ b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md @@ -0,0 +1,101 @@ +# Phase 6: Strategy A Divergence Burn-Down + +Status: active +Last reviewed: 2026-06-10 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-06-strategy-a-divergence-burndown.md + +## Objective + +Bootstrap the next Strategy A workstream after the Phase 5 clean-pin corpus: +turn the exact-polarity 21-input corpus into a reviewed divergence burn-down +track by reducing or reclassifying expected divergences without weakening the +clean-pin, source-truth, or expected-failure gates. + +This phase starts from Phase 5's accepted clean dependency pin and exact +`EXPECTED-*` polarity checks. Phase 6 must preserve that baseline while making +the next implementation target explicit. + +## Starting State + +- llzk-lean HEAD at Phase 6 bootstrap: + `617702beadfbad6be784945e2bd98e8a788d357c`. +- Workspace VeIR HEAD at Phase 6 bootstrap: + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. +- Consumed VeIR dependency pin remains: + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. +- Accepted LLZK source commit remains: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Phase 5 clean-pin canonical corpus evidence records 21 inputs: + 4 positive PASS cases, 16 `EXPECTED-DIVERGE` canonical cases, and + 1 `EXPECTED-LLZK-FAIL` named-field parser/verifier gap. +- Phase 5 final review fixed exact expected-divergence polarity so a canonical + output-divergence test no longer passes on a wrong LLZK/VEIR failure mode. + +## Non-Goals + +- Do not change the accepted LLZK source commit or field-registry facts. +- Do not change the accepted VeIR pin unless a reviewed Phase 6 implementation + needs a new clean dependency commit. +- Do not claim full Strategy A acceptance from the current 21-input corpus. +- Do not implement Strategy E certificates or the runtime MLIR matcher in this + phase bootstrap. +- Do not port missing Felt operations as part of bootstrap paperwork. + +## Artifacts To Create Or Update + +- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`: Phase 6 bootstrap. +- `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md`: mark Phase 5 completed. +- `docs/harness/CURRENT.md`: move the active phase to Phase 6 and record the + Phase 5 closeout baseline. +- `docs/harness/SOURCES.md`: record the Phase 6 phase file and Phase 5 + exact-polarity closeout evidence. +- `docs/harness/GATES.md`: document Phase 6 bootstrap and divergence burn-down + gates. +- `scripts/harness/check-doc-freshness.sh`: require Phase 6 to be active while + preserving Phase 2 through Phase 5 evidence checks. +- `scripts/harness/doctor.sh`: require Phase 6 docs and review workspace. +- `reviews/PHASE-06/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + Phase 6 review workspace. + +## Gates To Implement + +- Bootstrap freshness: + `scripts/harness/check-doc-freshness.sh` passes only when Phase 6 is active, + the Phase 6 review workspace exists, Phase 5 is marked complete, and Phase 5 + clean-pin plus exact-polarity evidence remains present. +- Source truth: + `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to + pass with only the known stale-worktree warning. +- Pin verification: + `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass + against the clean accepted VeIR dependency pin. +- Strict doctor: + `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- Build: + `lake build` succeeds. +- Strategy A baseline: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` + remains `21 pass (incl. expected-diverge), 0 fail` until Phase 6 deliberately + reduces or reclassifies a divergence. + +## Review Requirements + +- The reviewer must verify that Phase 5 findings are closed before Phase 6 + implementation work starts. +- The reviewer must verify that expected-divergence polarity remains exact and + marker-driven. +- The reviewer must verify that Phase 6 docs do not claim full Strategy A + acceptance. +- Every Phase 6 finding must be dispositioned before the phase closes. + +## Done Criteria + +- Phase 6 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- `docs/harness/CURRENT.md` names Phase 6 as active. +- `docs/harness/SOURCES.md` records Phase 6 and the Phase 5 exact-polarity + closeout evidence. +- Freshness, source truth, pin verification, strict doctor, skill validation, + `lake build`, and the clean-pin canonical differential baseline pass. +- The first Phase 6 implementation target is explicit: reduce or reclassify at + least one expected divergence without broadening unproved Strategy A claims. diff --git a/docs/strategy-a-oracle.md b/docs/strategy-a-oracle.md index 26a47dc..3cf55f9 100644 --- a/docs/strategy-a-oracle.md +++ b/docs/strategy-a-oracle.md @@ -9,17 +9,16 @@ and `veir-opt`, normalizes the outputs through `scripts/llzk-diff.sh`), and asserts they are textually identical modulo documented cosmetic differences. -**Today (v0)** the harness is a *parse-and-print round-trip -differential*: both tools parse the input and emit generic-MLIR, -which is then normalized and compared. This catches dialect-port -divergences but does not (yet) exercise either tool's -canonicalization pipeline. - -**v1** will enable canonicalization on both sides -(`llzk-opt --canonicalize` and `veir-opt -p felt-combine`) so the -differential covers each tool's verified Felt-rewrite catalog. The -script today does *not* pass these flags — see "What this v1 needs" -below. +The harness supports two modes: + +- parse/print mode: both tools parse the input and emit generic MLIR, + which is then normalized and compared. +- canonicalization mode: `llzk-opt --canonicalize` is compared against + `veir-opt -p=felt-combine`. + +The workspace VeIR script now implements canonicalization mode. Until +llzk-lean bumps its clean VeIR pin, llzk-lean runs this implementation +with an explicit `VEIR_DIFF=../veir/scripts/llzk-diff.sh` override. ### Known alignment caveats (read before adding to the corpus) @@ -44,13 +43,11 @@ claims to `llzk-lib` commit Bare `!felt.type` inputs short-circuit to a no-op, and the parse-print round-trip is what the differential actually catches. -3. **Named-field FeltConstAttr parser parity is resolved on the - generic-MLIR path.** VEIR accepts the generic form emitted by - `llzk-opt --mlir-print-op-generic`, and the outer - `!felt.type<"name">` retains the field. The remaining difference - is cosmetic printer style: LLZK prints a redundant inner - annotation, while VEIR relies on the outer type annotation; the - normalizer strips only that redundant inner form. +3. **Named-field generic MLIR still has an LLZK parser/verifier edge.** + LLZK custom assembly lowered through `llzk-opt --mlir-print-op-generic` + is the preferred named-field corpus path. A hand-authored generic + outer-typed named-field `FeltConstAttr` remains classified as + EXPECTED-LLZK-FAIL. 4. **VEIR's folds don't apply modular reduction.** LLZK's `Field::reduce` in `lib/Util/Field.cpp` normalizes constants @@ -58,13 +55,14 @@ claims to `llzk-lib` commit integer. For named-field inputs, this modular-reduction difference is the expected arithmetic divergence to classify. -The right v1 ordering, given these gaps: - - First **re-test the named-field corpus** under the Phase 1 pin and - reclassify stale expected-divergence inputs. - - Then add a Field registry on VEIR's side so its folds - short-circuit-or-reduce consistent with LLZK. - - Then enable canonicalization in the diff script and start - mirroring `llzk-lib/test/Dialect/Felt/`. +The Phase 4 ordering is now: + - Re-test the named-field corpus and keep the generic parser edge + classified as EXPECTED-LLZK-FAIL. + - Enable canonicalization in the diff script and classify the first + canonical divergences. + - Add field-registry and modular-reduction parity on VEIR's side so + constant-fold corpus cases can move from expected-divergence to + positive coverage. Without that ordering, named-field corpus additions will mostly document the known modular-reduction gap rather than demonstrate alignment. @@ -108,31 +106,32 @@ No user-visible change to `llzk-opt`. ## What this v1 needs -Current state (2026-06-05): +Current state (2026-06-09): - ✅ `differential/run-differential.sh` wraps VEIR's diff script; - recurses into directory args; plumbs `LOWER_FIRST=1` through to - `--lower-first` for LLZK custom-asm inputs. -- 🌱 Seed input: `corpus/felt/const_identities.mlir` (one file). - Corpus expansion is the headline v1 work item. + recurses into directory args; resolves targets to absolute paths; applies + `--lower-first` automatically to `.llzk` inputs; and supports + `--canonicalize`. +- 🌱 Seed corpus: live const/type positives, canonical no-fire arithmetic, + and canonical-only expected divergences for DCE, modular reduction, and + field-registry preconditions. - ✅ VEIR has 15 Felt rewrite patterns whose structural preconditions are sorry-free and axiom-clean under the accepted Phase 1 pin. This still does not close the theorem↔pattern or IR-semantics joints; see `docs/REVIEW.md`. -- 🚧 Harness is a **parse-print round-trip differential**, not a - pass-pipeline differential. v1 adds `--canonicalize` / - `-p felt-combine` invocations (see #1 below). +- ✅ Workspace harness has a canonicalization mode. llzk-lean acceptance still + needs either an explicit reviewed `VEIR_DIFF=../veir/scripts/llzk-diff.sh` + run or a clean VeIR pin bump. - 🚧 CI workflow stubbed in `.github/workflows/differential.yml`. Skips green if `llzk-opt` not provisioned — CI provisioning is v1 work. Outstanding work to reach v1: -1. **Enable canonicalization in the diff script.** Today's harness - compares parse-print outputs. v1 invokes both tools with their - canonicalize pipelines (`llzk-opt --canonicalize` and `veir-opt - -p felt-combine`) so the differential covers each tool's verified - Felt-rewrite catalog. Lands as an upstream PR to VEIR's - `scripts/llzk-diff.sh`; this repo bumps the SHA pin to pull it. +1. **Land the canonicalization script in the consumed pin.** The + workspace script invokes both tools with their canonicalize pipelines + (`llzk-opt --canonicalize` and `veir-opt -p=felt-combine`). llzk-lean + still needs a clean pin bump before the default wrapper consumes that + implementation without `VEIR_DIFF=...`. 2. **Corpus expansion.** Hand-author a Felt corpus that exercises every pattern in VEIR's `Combine.lean` against an equivalent LLZK input. @@ -144,9 +143,7 @@ Outstanding work to reach v1: format (`%c = felt.add %a, %b : !felt.type`). Options: (a) Author corpus inputs in generic form (current approach). (b) Pipe LLZK inputs through `llzk-opt --mlir-print-op-generic` - before comparison — supported via `LOWER_FIRST=1` - (`run-differential.sh` plumbs it through to the diff script's - `--lower-first` flag). + before comparison — automatic for `.llzk` corpus inputs. (b) is cheaper to scale; (a) gives us VEIR-native authoring. Either way we can mirror `llzk-lib/test/Dialect/Felt/` quickly. @@ -195,7 +192,7 @@ not a code change. ## Acceptance criteria for v1 - Diff script invokes both tools with canonicalization enabled - (`llzk-opt --canonicalize`, `veir-opt -p felt-combine`). + (`llzk-opt --canonicalize`, `veir-opt -p=felt-combine`). - Every input under `llzk-lib/test/Dialect/Felt/` (or its generic-form equivalent) passes the differential. - Every pattern in VEIR's `Veir.Passes.Felt.Combine` is exercised by diff --git a/lake-manifest.json b/lake-manifest.json index c80a4d5..2491b03 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -5,10 +5,10 @@ "type": "git", "subDir": null, "scope": "", - "rev": "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3", + "rev": "220cd215579b435c3c22ce86b34a3f4ce2ca276e", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3", + "inputRev": "220cd215579b435c3c22ce86b34a3f4ce2ca276e", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", diff --git a/lakefile.toml b/lakefile.toml index dccdad6..d831d95 100644 --- a/lakefile.toml +++ b/lakefile.toml @@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] [[require]] name = "VeIR" git = "https://github.com/project-llzk/veir.git" -rev = "d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" +rev = "220cd215579b435c3c22ce86b34a3f4ce2ca276e" [[lean_lib]] name = "LlzkLean" diff --git a/reviews/PHASE-02/disposition.md b/reviews/PHASE-02/disposition.md index 9cff5cf..2f31bd7 100644 --- a/reviews/PHASE-02/disposition.md +++ b/reviews/PHASE-02/disposition.md @@ -13,3 +13,9 @@ Findings in `findings.md` are dispositioned as follows: - P2-L4: fixed by selecting `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and refreshing `.lake/packages/VeIR` to a clean checkout of that commit. +- P2-L5: fixed by recording and gating the accepted + `git@github.com:project-llzk/llzk-lib.git` origin remote. +- P2-L6: fixed by checking the consumed `.lake/packages/VeIR` + `feltPrime` field-to-prime mirror against the accepted LLZK source registry. +- P2-L7: fixed by requiring every ledgered source path and representative + source facts from attrs, interfaces, folder source, lit tests, and unit tests. diff --git a/reviews/PHASE-02/evidence/llzk-lib-refs.txt b/reviews/PHASE-02/evidence/llzk-lib-refs.txt index 4aae3da..5768c92 100644 --- a/reviews/PHASE-02/evidence/llzk-lib-refs.txt +++ b/reviews/PHASE-02/evidence/llzk-lib-refs.txt @@ -1,2 +1,3 @@ +git@github.com:project-llzk/llzk-lib.git 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 db922857bc5a88a9107627ef6b36a8b5e57bc5c2 diff --git a/reviews/PHASE-02/findings.md b/reviews/PHASE-02/findings.md index 4d7e971..07c30f8 100644 --- a/reviews/PHASE-02/findings.md +++ b/reviews/PHASE-02/findings.md @@ -50,3 +50,42 @@ the dirty state as non-release local work. Disposition: fixed by selecting VeIR commit `d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`, updating Lake metadata, and refreshing `.lake/packages/VeIR` to a clean checkout of that commit. + +## P2-L5 - Accepted LLZK source remote is stale and ungated + +Severity: High + +`docs/harness/LLZK_SOURCE.md` recorded +`git@github.com:Veridise/llzk-lib.git`, but the checked and fetched source +repository uses `git@github.com:project-llzk/llzk-lib.git`. The source gate +checked only the commit and `origin/main`, so it could not catch a remote +provenance mismatch. + +Disposition: fixed by recording +`git@github.com:project-llzk/llzk-lib.git` in the source ledger and requiring +that exact `origin` URL in `scripts/harness/verify-llzk-source.sh` and doc +freshness evidence. + +## P2-L6 - Consumed VeIR field registry was not directly source-checked + +Severity: Medium + +The pin gate proved `.lake/packages/VeIR` was clean and at the accepted commit, +but the llzk-lean source gate did not directly check the consumed dependency's +`Veir/Passes/Felt/InterpModel.lean` field registry mirror against the accepted +LLZK source. + +Disposition: fixed by making `scripts/harness/verify-llzk-source.sh` check the +pinned dependency HEAD and its exact `feltPrime` field-to-prime branches. + +## P2-L7 - Source ledger files were listed but not all gated + +Severity: Medium + +The source ledger listed `OpInterfaces.td`, Felt lit tests, and unit tests, but +the source gate only checked a subset of paths and parsed only ops/types/field +registry facts deeply. That made the ledger broader than the mechanical gate. + +Disposition: fixed by checking every ledgered source path at the accepted +commit and adding representative checks for Felt attrs, op interfaces, folder +source, lit tests, and unit tests. diff --git a/reviews/PHASE-03/adversarial-review.md b/reviews/PHASE-03/adversarial-review.md new file mode 100644 index 0000000..4e43b1d --- /dev/null +++ b/reviews/PHASE-03/adversarial-review.md @@ -0,0 +1,56 @@ +# Phase 3 Bootstrap Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-06 + +## Scope + +This bootstrap review covers only the Phase 3 documentation and harness +freshness setup. It does not review certificate expansion, differential corpus +changes, or runtime matcher work. + +## Required Checks + +- Confirm `docs/harness/FELT_OP_GAPS.md` lists the accepted 18 LLZK Felt + mnemonics from the Phase 2 source ledger. +- Confirm the ledger marks missing Strategy A/E coverage as gaps, not as + acceptance. +- Confirm the consumed `.lake/packages/VeIR` pin remains the source of truth. +- Confirm Phase 2 source-truth and pin gates still pass. + +## Initial Result + +Bootstrap documentation is ready for review once the Phase 3 freshness gate and +baseline build/check commands pass. + +## Final Result + +Accepted after fixed findings P3-L1, P3-L2, and P3-L3. + +- `reviews/PHASE-03/evidence/check-doc-freshness.txt`: doc freshness summary is + `0 fail`; the gate now requires exactly 18 operation rows, exact-once + mnemonic coverage, explicit gap status for incomplete Strategy A/E and + unmodeled consumed-VeIR operations, and expected evidence success markers. +- `reviews/PHASE-03/evidence/verify-llzk-source.txt`: LLZK source verification + summary is `0 fail, 1 warn`; the warning is the known stale `../llzk-lib` + worktree HEAD while the gate reads the accepted commit with `git show`. +- `reviews/PHASE-03/evidence/verify-pins.txt`: pin verification summary is + `0 fail, 1 warn`; the warning records that workspace VeIR is a descendant of + the accepted pin while `.lake/packages/VeIR` remains the source of truth. +- `reviews/PHASE-03/evidence/doctor-workspace.txt`: strict doctor summary is + `0 fail, 2 warn`; the warnings are missing optional `cmake`/`ctest` tools and + the same workspace VeIR descendant context. +- `reviews/PHASE-03/evidence/validate-skills.txt`: skill validation summary is + `0 fail over 5 skills`. +- `reviews/PHASE-03/evidence/lake-build.txt`: `lake build` completed + successfully and reports the expected 2-of-15 certificate catalog coverage + with 13 intentionally uncovered patterns. +- `reviews/PHASE-03/evidence/adversarial-review.txt`: confirms all accepted + Felt operation rows, Strategy A/E gaps, no missing-op semantic definitions in + the consumed VeIR pin, and no modified, staged, or untracked files under Lean + cert/catalog/corpus implementation paths. + +The ledger remains documentation-only. It records the accepted 18 LLZK Felt +mnemonics, describes Strategy A and Strategy E status as current coverage or +gaps, and does not expand certificates, differential corpus inputs, or runtime +checker behavior. diff --git a/reviews/PHASE-03/disposition.md b/reviews/PHASE-03/disposition.md new file mode 100644 index 0000000..ce3fe23 --- /dev/null +++ b/reviews/PHASE-03/disposition.md @@ -0,0 +1,13 @@ +# Phase 3 Disposition + +Repository: llzk-lean +Created: 2026-06-06 +Updated: 2026-06-06 + +| Finding | Status | Disposition | +|---|---|---| +| P3-L1 | fixed | The freshness gate now requires all named Phase 3 evidence files, not only the evidence README. | +| P3-L2 | fixed | The evidence README now lists strict doctor, skill-validation, lake-build, and adversarial-review outputs; all files are captured. | +| P3-L3 | fixed | The freshness gate now rejects duplicate or extra operation rows, softened Strategy A/E gap rows, and Phase 3 evidence files that lack expected success markers. | + +No Phase 3 findings remain open. diff --git a/reviews/PHASE-03/evidence/README.md b/reviews/PHASE-03/evidence/README.md new file mode 100644 index 0000000..b76392e --- /dev/null +++ b/reviews/PHASE-03/evidence/README.md @@ -0,0 +1,16 @@ +# Phase 3 Evidence + +Populate this directory with exact command output during Phase 3. + +Expected bootstrap evidence: + +- `check-doc-freshness.txt` +- `verify-llzk-source.txt` +- `verify-pins.txt` +- `doctor-workspace.txt` +- `validate-skills.txt` +- `lake-build.txt` +- `adversarial-review.txt` + +`scripts/harness/check-doc-freshness.sh` validates the presence of these files +and the expected success markers in the captured outputs. diff --git a/reviews/PHASE-03/evidence/adversarial-review.txt b/reviews/PHASE-03/evidence/adversarial-review.txt new file mode 100644 index 0000000..6235aae --- /dev/null +++ b/reviews/PHASE-03/evidence/adversarial-review.txt @@ -0,0 +1,101 @@ +$ operation-row count in docs/harness/FELT_OP_GAPS.md +18 + +$ exact-once operation rows +const 1 +add 1 +sub 1 +mul 1 +pow 1 +div 1 +uintdiv 1 +sintdiv 1 +umod 1 +smod 1 +neg 1 +inv 1 +bit_and 1 +bit_or 1 +bit_xor 1 +bit_not 1 +shl 1 +shr 1 + +$ required Strategy A/E and consumed-VeIR gap rows +| `sub` | Covered baseline in `Data.Felt.sub` and `InterpModel.interpretSub` | No complete accepted corpus coverage | No committed cert yet for existing VeIR sub rewrites | Gap in Strategy A/E coverage | +| `mul` | Covered baseline in `Data.Felt.mul` and `InterpModel.interpretMul` | No complete accepted corpus coverage | No committed cert yet for existing VeIR mul rewrites | Gap in Strategy A/E coverage | +| `neg` | Covered baseline in `Data.Felt.neg` and `InterpModel.interpretNeg` | No complete accepted corpus coverage | No committed cert yet for existing VeIR neg rewrites | Gap in Strategy A/E coverage | +| `pow` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `div` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `uintdiv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `sintdiv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `umod` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `smod` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `inv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_and` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_or` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_xor` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `bit_not` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `shl` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | +| `shr` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | + +$ freshness gate hardening hooks +48:require_op_once() { +59:require_op_row_contains() { +151:op_rows="$(grep -Ec '^\| `[^`]+` \|' "${ROOT}/docs/harness/FELT_OP_GAPS.md")" +152:if [[ "$op_rows" == "18" ]]; then +155: fail "FELT_OP_GAPS has ${op_rows} operation rows, expected 18" +161: require_op_once "$mnemonic" +165: require_op_row_contains "$mnemonic" "Gap in Strategy A/E coverage" "FELT_OP_GAPS marks ${mnemonic} Strategy A/E coverage gap" +169: require_op_row_contains "$mnemonic" 'Missing from consumed VeIR `Data.Felt` and `InterpModel`' "FELT_OP_GAPS marks ${mnemonic} consumed VeIR semantic model missing" +170: require_op_row_contains "$mnemonic" "| Gap |" "FELT_OP_GAPS marks ${mnemonic} as a gap" +208:require_contains reviews/PHASE-03/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "verify-llzk-source evidence reports no failures" +209:require_contains reviews/PHASE-03/evidence/verify-pins.txt "pin verification summary: 0 fail" "pin evidence reports no failures" +210:require_contains reviews/PHASE-03/evidence/doctor-workspace.txt "doctor summary: 0 fail" "strict doctor evidence reports no failures" +211:require_contains reviews/PHASE-03/evidence/validate-skills.txt "skill validation summary: 0 fail" "skill evidence reports no failures" +212:require_contains reviews/PHASE-03/evidence/lake-build.txt "Build completed successfully" "lake build evidence reports success" +213:require_contains reviews/PHASE-03/evidence/lake-build.txt "catalog covers 2 of them; 13 uncovered" "lake build evidence records expected certificate coverage gap" +214:require_contains reviews/PHASE-03/evidence/adversarial-review.txt "PASS: no missing-op semantic definitions found in consumed VeIR Felt semantics" "adversarial evidence confirms missing-op semantics were not added" +215:require_contains reviews/PHASE-03/evidence/adversarial-review.txt "PASS: no modified, staged, or untracked files under Lean cert/catalog/corpus implementation paths" "adversarial evidence confirms no Strategy E/A implementation changes" + +$ consumed VeIR Felt semantic definitions +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:85:def interpretConst (a : FeltConstAttr) : Option FeltVal := +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:91:def interpretAdd : FeltVal → FeltVal → Option FeltVal +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:95:def interpretSub : FeltVal → FeltVal → Option FeltVal +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:99:def interpretMul : FeltVal → FeltVal → Option FeltVal +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:103:def interpretNeg : FeltVal → Option FeltVal +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:118:theorem interpretAdd_const_zero +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:122: (interpretConst cst).bind (interpretAdd (.felt p a)) = some (.felt p a) := by +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:123: simp only [interpretConst, hp, hval, reduce, Int.zero_emod, Int.toNat_zero, +.lake/packages/VeIR/Veir/Passes/Felt/InterpModel.lean:124: Option.bind_some, interpretAdd, ↓reduceIte, Nat.add_zero, Nat.mod_eq_of_lt ha] +.lake/packages/VeIR/Veir/Data/Felt/Basic.lean:42:def const (p : Nat) (n : Int) : Felt p := (n : ZMod p) +.lake/packages/VeIR/Veir/Data/Felt/Basic.lean:45:def add {p : Nat} (a b : Felt p) : Felt p := a + b +.lake/packages/VeIR/Veir/Data/Felt/Basic.lean:48:def sub {p : Nat} (a b : Felt p) : Felt p := a - b +.lake/packages/VeIR/Veir/Data/Felt/Basic.lean:51:def mul {p : Nat} (a b : Felt p) : Felt p := a * b +.lake/packages/VeIR/Veir/Data/Felt/Basic.lean:54:def neg {p : Nat} (a : Felt p) : Felt p := -a + +$ no missing-op semantic definitions are present in consumed VeIR pin +PASS: no missing-op semantic definitions found in consumed VeIR Felt semantics + +$ certificate coverage and smoke-classification facts +docs/harness/FELT_OP_GAPS.md:34:| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus only; no acceptance claim | `right_identity_zero_add` and `constant_fold_add` certs exist | Covered with known LLZK modular-reduction caveat | +docs/harness/FELT_OP_GAPS.md:56:- `scripts/harness/diff-smoke.sh` classifies missing `llzk-opt` as exit 77 in +docs/harness/FELT_OP_GAPS.md:58:- The Strategy E checker still lacks the runtime MLIR matcher, so existing +scripts/harness/diff-smoke.sh:27: exit 77 +scripts/harness/diff-smoke.sh:32: exit 77 +scripts/harness/diff-smoke.sh:68: exit 77 +certs/felt-combine.cert.json:7: {"patternId":"right_identity_zero_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"any"},{"kind":"const","opKind":"felt.const","value":0}],"commutative":true},"rhs":{"kind":"any"},"conditions":[],"theoremName":"Veir.Data.Felt.right_identity_zero_add","llzkParityStatus":"veir-only","description":"felt.add x (felt.const 0) → x. Sound over any ZMod p."}, +certs/felt-combine.cert.json:8: {"patternId":"constant_fold_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"const","opKind":"felt.const"},{"kind":"const","opKind":"felt.const"}],"commutative":true},"rhs":{"kind":"const","opKind":"felt.const"},"conditions":[{"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]},{"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"}],"theoremName":"Veir.Data.Felt.constant_fold_add","llzkParityStatus":"aligned-with-caveats","description":"felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (Field::reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned."} +LlzkLean/Cert.lean:175: `"right_identity_zero_add"`. -/ +LlzkLean/Cert.lean:188: `Veir.Data.Felt.right_identity_zero_add`) that proves LHS = RHS +LlzkLean/Cert.lean:235: **Status**: 2-of-15 stub. The remaining 13 verified VEIR patterns +LlzkLean/Cert.lean:271: (patternId := "right_identity_zero_add") +LlzkLean/Cert.lean:292: (patternId := "constant_fold_add") +LlzkLean/CertValidate.lean:24: because the catalog is intentionally a 2-of-15 stub. When the +LlzkLean/CertValidate.lean:63: catalog is intentionally a 2-of-15 stub) and `throwError` for +LlzkLean/CertValidate.lean:114: logInfo s!"[#assertCatalogCoverage] {veirPatternIds.length} VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers {catalogIds.length} of them; {uncovered.length} uncovered (stub status; expected 13 today). Uncovered: {uncovered}" +LlzkLean/CertValidate.lean:121:#certThmExists "Veir.Data.Felt.right_identity_zero_add" +LlzkLean/CertValidate.lean:122:#certThmExists "Veir.Data.Felt.constant_fold_add" + +$ no Phase 3 cert/corpus/Lean implementation diff +PASS: no modified, staged, or untracked files under Lean cert/catalog/corpus implementation paths diff --git a/reviews/PHASE-03/evidence/check-doc-freshness.txt b/reviews/PHASE-03/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..d08834d --- /dev/null +++ b/reviews/PHASE-03/evidence/check-doc-freshness.txt @@ -0,0 +1,115 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-03/evidence/doctor-workspace.txt b/reviews/PHASE-03/evidence/doctor-workspace.txt new file mode 100644 index 0000000..89b07ca --- /dev/null +++ b/reviews/PHASE-03/evidence/doctor-workspace.txt @@ -0,0 +1,63 @@ +PASS: tool git is available +PASS: tool lake is available +WARN: optional tool cmake is not available +WARN: optional tool ctest is not available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json inputRev pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d4cc1bf2d31b +PASS: dependency checkout HEAD is d4cc1bf2d31b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +WARN: workspace VeIR HEAD 0c5280de5715dc0fa518e7e3782e784a5962d4d8 is a descendant of accepted pin d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3; dependency checkout remains the source of truth + +pin verification summary: 0 fail, 1 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence + +doctor summary: 0 fail, 2 warn, mode=strict diff --git a/reviews/PHASE-03/evidence/lake-build.txt b/reviews/PHASE-03/evidence/lake-build.txt new file mode 100644 index 0000000..6479210 --- /dev/null +++ b/reviews/PHASE-03/evidence/lake-build.txt @@ -0,0 +1,34 @@ +⚠ [39/408] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1234/1240] Replayed LlzkLean.CertValidate +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-03/evidence/validate-skills.txt b/reviews/PHASE-03/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-03/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-03/evidence/verify-llzk-source.txt b/reviews/PHASE-03/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..b152cdf --- /dev/null +++ b/reviews/PHASE-03/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is d4cc1bf2d31b +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned-with-caveats +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned-with-caveats +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-03/evidence/verify-pins.txt b/reviews/PHASE-03/evidence/verify-pins.txt new file mode 100644 index 0000000..ad993cb --- /dev/null +++ b/reviews/PHASE-03/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json inputRev pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d4cc1bf2d31b +PASS: dependency checkout HEAD is d4cc1bf2d31b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +WARN: workspace VeIR HEAD 0c5280de5715dc0fa518e7e3782e784a5962d4d8 is a descendant of accepted pin d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3; dependency checkout remains the source of truth + +pin verification summary: 0 fail, 1 warn, mode=strict diff --git a/reviews/PHASE-03/findings.md b/reviews/PHASE-03/findings.md new file mode 100644 index 0000000..467cbd4 --- /dev/null +++ b/reviews/PHASE-03/findings.md @@ -0,0 +1,39 @@ +# Phase 3 Findings + +Repository: llzk-lean +Reviewed: 2026-06-06 + +## P3-L1: Freshness gate accepted README-only Phase 3 evidence + +- Severity: medium +- Evidence: `scripts/harness/check-doc-freshness.sh` required only + `reviews/PHASE-03/evidence/README.md`, while the Phase 3 done criteria require + fresh adversarial evidence. +- Status: fixed +- Disposition: `check-doc-freshness.sh` now requires nonempty Phase 3 evidence + outputs for doc freshness, LLZK source truth, pin verification, strict doctor, + skill validation, lake build, and adversarial review. + +## P3-L2: Evidence README omitted declared closeout gates + +- Severity: low +- Evidence: `reviews/PHASE-03/evidence/README.md` did not list strict doctor or + skill-validation evidence even though those gates are part of the Phase 3 + acceptance path. +- Status: fixed +- Disposition: the README now lists every required bootstrap evidence file, and + each file has been captured under `reviews/PHASE-03/evidence/`. + +## P3-L3: Freshness checks allowed weak evidence and ledger false positives + +- Severity: medium +- Evidence: the freshness gate required accepted operation mnemonics to appear, + but did not require exactly 18 operation rows, did not reject duplicate rows, + did not enforce that unsupported or incomplete Strategy A/E rows still ended + as gaps, and treated arbitrary nonempty evidence files as sufficient. +- Status: fixed +- Disposition: `check-doc-freshness.sh` now requires exactly one row for each + accepted Felt mnemonic, exactly 18 operation rows, explicit Strategy A/E + coverage gaps for `sub`, `mul`, and `neg`, explicit missing consumed-VeIR + semantic model plus `Gap` status for the 13 unmodeled operations, and expected + success markers in the captured Phase 3 evidence files. diff --git a/reviews/PHASE-03/request.md b/reviews/PHASE-03/request.md new file mode 100644 index 0000000..5652af0 --- /dev/null +++ b/reviews/PHASE-03/request.md @@ -0,0 +1,16 @@ +# Phase 3 Review Request + +Repository: llzk-lean +Created: 2026-06-06 + +Review the Phase 3 Felt operation gap-ledger bootstrap. + +The review must verify that: + +- Phase 3 is documentation-only at bootstrap. +- `docs/harness/FELT_OP_GAPS.md` lists all 18 accepted LLZK Felt mnemonics. +- Strategy A and Strategy E gaps are not overstated as acceptance. +- The active harness docs point at Phase 3 without dropping Phase 2 source-truth + or pin gates. +- Review evidence cites exact local files, accepted source commits, and the + consumed VeIR dependency pin. diff --git a/reviews/PHASE-04/adversarial-review.md b/reviews/PHASE-04/adversarial-review.md new file mode 100644 index 0000000..13e74e8 --- /dev/null +++ b/reviews/PHASE-04/adversarial-review.md @@ -0,0 +1,76 @@ +# Phase 4 Bootstrap and Implementation Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-09 + +## Scope + +This review first covered the Phase 4 documentation and harness freshness +bootstrap. It now also records the follow-on workspace implementation of the +canonicalization-aware differential wrapper and seed corpus. + +## Required Checks + +- Confirm `docs/harness/CURRENT.md` names Phase 4 as active. +- Confirm `docs/phases/PHASE-04-strategy-a-differential.md` records the + accepted `llzk-opt` path and local `~/llvm-project` test infrastructure. +- Confirm the bootstrap preserves Phase 2 LLZK source-truth checks, Phase 3 + Felt operation gap-ledger checks, and strict dependency pin checks. +- Confirm no Strategy A pass-pipeline acceptance is claimed before corpus and + command evidence exist. + +## Initial Result + +Bootstrap documentation is ready for review once freshness, source, pin, doctor, +skill, and build gates pass. + +## Final Bootstrap Result + +Accepted as a Phase 4 bootstrap. + +- `reviews/PHASE-04/evidence/check-doc-freshness.txt`: doc freshness summary is + `0 fail`; the gate now requires Phase 4 to be active, the Phase 4 review + workspace to exist, Phase 3 evidence to remain present, and the source ledger + to record Strategy A test infrastructure. +- `reviews/PHASE-04/evidence/verify-llzk-source.txt`: LLZK source verification + summary is `0 fail, 1 warn`; the warning is the known stale `../llzk-lib` + worktree HEAD while the gate reads the accepted commit with `git show`. +- `reviews/PHASE-04/evidence/verify-pins.txt`: pin verification summary is + `0 fail, 1 warn`; the warning records that workspace VeIR is a descendant of + the accepted pin while `.lake/packages/VeIR` remains the source of truth. +- `reviews/PHASE-04/evidence/doctor-workspace.txt`: strict doctor summary is + `0 fail, 0 warn`. +- `reviews/PHASE-04/evidence/validate-skills.txt`: skill validation summary is + `0 fail over 5 skills`. +- `reviews/PHASE-04/evidence/lake-build.txt`: `lake build` completed + successfully. +- `reviews/PHASE-04/evidence/adversarial-review.txt`: confirms the accepted + `llzk-opt` binary is executable and `/home/alh/llvm-project` is clean at the + recorded commit. It also records that the canonicalization-aware wrapper and + corpus edits are dispositioned under this Phase 4 review workspace. + +The bootstrap records Strategy A as the next active workstream and the local +test infrastructure now available. It does not claim pass-pipeline differential +acceptance. + +## Implementation Result + +The workspace implementation adds parse/print and canonicalization differential +evidence, automatic `.llzk` lowering, explicit workspace `VEIR_DIFF` support, +typed tool-failure classification, and canonical-only expected-divergence corpus +entries. It remains workspace evidence until llzk-lean consumes a clean VeIR pin +with the updated diff script. + +## Fresh Adversarial Review Result + +A fresh review of the Phase 4 implementation found two low-severity wrapper +issues, both dispositioned in `reviews/PHASE-04/findings.md` and +`reviews/PHASE-04/disposition.md`: + +- Canonical mode with the default clean pinned VeIR script failed unclearly + before the pin bump. +- Parse/print runs over only canonical-only files returned success despite + executing no inputs. + +Both issues are resolved. The normal parse/print and canonicalization corpus +runs still pass with the reviewed workspace `VEIR_DIFF` override. diff --git a/reviews/PHASE-04/disposition.md b/reviews/PHASE-04/disposition.md new file mode 100644 index 0000000..2d9757b --- /dev/null +++ b/reviews/PHASE-04/disposition.md @@ -0,0 +1,14 @@ +# Phase 4 Disposition + +Repository: llzk-lean +Created: 2026-06-09 +Updated: 2026-06-09 + +## Dispositioned Findings + +- F4-LLZK-01 resolved by adding an early canonicalization-support check for the + selected VeIR diff script. +- F4-LLZK-02 resolved by making mode-skip-only invocations fail because they + execute no inputs in the selected mode. + +No Phase 4 findings remain open. diff --git a/reviews/PHASE-04/evidence/README.md b/reviews/PHASE-04/evidence/README.md new file mode 100644 index 0000000..6a760fb --- /dev/null +++ b/reviews/PHASE-04/evidence/README.md @@ -0,0 +1,22 @@ +# Phase 4 Evidence + +Populate this directory with exact command output during Phase 4. + +Expected bootstrap evidence: + +- `check-doc-freshness.txt` +- `verify-llzk-source.txt` +- `verify-pins.txt` +- `doctor-workspace.txt` +- `validate-skills.txt` +- `lake-build.txt` +- `adversarial-review.txt` + +Expected implementation evidence, once Strategy A is changed: + +- `differential-bootstrap.txt` +- `differential-canonicalize.txt` +- `corpus-classification.txt` +- `adversarial-review-fresh.txt` + +Bootstrap evidence must not be treated as Strategy A acceptance evidence. diff --git a/reviews/PHASE-04/evidence/adversarial-review-fresh.txt b/reviews/PHASE-04/evidence/adversarial-review-fresh.txt new file mode 100644 index 0000000..4eca84c --- /dev/null +++ b/reviews/PHASE-04/evidence/adversarial-review-fresh.txt @@ -0,0 +1,12 @@ +$ fresh adversarial review probes, 2026-06-09 + +PASS: direct VeIR canonical diff accepts flags before the input. +PASS: direct VeIR canonical diff accepts flags after the input. +PASS: direct VeIR canonical diff reports registered_add_wrap as a real divergence. +PASS: llzk-lean canonical run over canonical-only expected-divergence corpus reports 3 expected divergences. +PASS: llzk-lean parse/print run over only canonical-only inputs now exits non-zero with "no inputs executed". +PASS: llzk-lean canonical run without VEIR_DIFF now exits early with an actionable clean-pin/override message. +PASS: full llzk-lean parse/print corpus remains 4 pass, 0 fail, 3 mode-skip. +PASS: full llzk-lean canonical corpus remains 7 pass, 0 fail. +PASS: llzk-lean and VeIR check-doc-freshness.sh both report 0 fail after fixes. +PASS: llzk-lean and VeIR strict doctors both report 0 fail, 0 warn after fixes. diff --git a/reviews/PHASE-04/evidence/adversarial-review.txt b/reviews/PHASE-04/evidence/adversarial-review.txt new file mode 100644 index 0000000..8f34911 --- /dev/null +++ b/reviews/PHASE-04/evidence/adversarial-review.txt @@ -0,0 +1,23 @@ +$ current phase +7:- Active phase: Phase 4, Strategy A differential harness bootstrap. + +$ phase acceptance wording +91: corpus. Bootstrap does not satisfy this gate. + +$ accepted llzk-opt binary +PASS: llzk-opt binary is executable + +$ llvm-project checkout +49f12af164138123589263fe75ea5f1d356e8780 +PASS: llvm-project status command completed; empty status means clean +23.0.0git +LLVM (http://llvm.org/): + LLVM version 23.0.0git + Optimized build with assertions. + +$ Strategy A implementation state + M differential/README.md + M differential/corpus/README.md + M differential/run-differential.sh +PASS: canonicalization-aware differential wrapper and corpus are dispositioned under reviews/PHASE-04 +NOTE: this follow-on implementation is workspace Strategy A evidence, not a clean VeIR dependency pin bump. diff --git a/reviews/PHASE-04/evidence/check-doc-freshness.txt b/reviews/PHASE-04/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..451c496 --- /dev/null +++ b/reviews/PHASE-04/evidence/check-doc-freshness.txt @@ -0,0 +1,142 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-04/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES records Phase 4 phase file +PASS: SOURCES records Strategy A differential wrapper and corpus +PASS: SOURCES records accepted local llzk-opt binary +PASS: SOURCES records local llvm-project test infrastructure +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: Phase 4 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/README.md +PASS: evidence present reviews/PHASE-04/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-04/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-04/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-04/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 4 source evidence reports no failures +PASS: Phase 4 pin evidence reports no failures +PASS: Phase 4 strict doctor evidence reports no failures +PASS: Phase 4 skill evidence reports no failures +PASS: Phase 4 lake build evidence reports success +PASS: Phase 4 adversarial evidence confirms llzk-opt is executable +PASS: Phase 4 adversarial evidence separates dirty paths from acceptance +PASS: Phase 4 docs distinguish bootstrap from Strategy A acceptance +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-04/evidence/corpus-classification.txt b/reviews/PHASE-04/evidence/corpus-classification.txt new file mode 100644 index 0000000..a29f20a --- /dev/null +++ b/reviews/PHASE-04/evidence/corpus-classification.txt @@ -0,0 +1,10 @@ +$ find differential/corpus -type f | sort + +differential/corpus/README.md +differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk +differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +differential/corpus/expected-divergence/named_field_const.mlir +differential/corpus/felt/arithmetic_no_fold.llzk +differential/corpus/felt/const_identities.mlir +differential/corpus/felt/types_smoke.llzk diff --git a/reviews/PHASE-04/evidence/differential-bootstrap.txt b/reviews/PHASE-04/evidence/differential-bootstrap.txt new file mode 100644 index 0000000..d0a77c7 --- /dev/null +++ b/reviews/PHASE-04/evidence/differential-bootstrap.txt @@ -0,0 +1,11 @@ +$ env LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=/home/alh/LLZK/veir/scripts/llzk-diff.sh ./differential/run-differential.sh differential/corpus + +MODE-SKIP: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk (canonicalization-only input) +MODE-SKIP: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk (canonicalization-only input) +MODE-SKIP: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk (canonicalization-only input) +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk + +Summary: 4 pass (incl. expected-diverge), 0 fail, 0 skip, 3 mode-skip (over 7 inputs) diff --git a/reviews/PHASE-04/evidence/differential-canonicalize.txt b/reviews/PHASE-04/evidence/differential-canonicalize.txt new file mode 100644 index 0000000..f4d4ed6 --- /dev/null +++ b/reviews/PHASE-04/evidence/differential-canonicalize.txt @@ -0,0 +1,11 @@ +$ env LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=/home/alh/LLZK/veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus + +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk + +Summary: 7 pass (incl. expected-diverge), 0 fail (over 7 inputs) diff --git a/reviews/PHASE-04/evidence/doctor-workspace.txt b/reviews/PHASE-04/evidence/doctor-workspace.txt new file mode 100644 index 0000000..74d59e3 --- /dev/null +++ b/reviews/PHASE-04/evidence/doctor-workspace.txt @@ -0,0 +1,69 @@ +PASS: tool git is available +PASS: tool lake is available +PASS: optional tool cmake is available +PASS: optional tool ctest is available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json inputRev pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d4cc1bf2d31b +PASS: dependency checkout HEAD is d4cc1bf2d31b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +WARN: workspace VeIR HEAD 0c5280de5715dc0fa518e7e3782e784a5962d4d8 is a descendant of accepted pin d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3; dependency checkout remains the source of truth + +pin verification summary: 0 fail, 1 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence +PASS: found reviews/PHASE-04/evidence + +doctor summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-04/evidence/lake-build.txt b/reviews/PHASE-04/evidence/lake-build.txt new file mode 100644 index 0000000..85e2a06 --- /dev/null +++ b/reviews/PHASE-04/evidence/lake-build.txt @@ -0,0 +1,34 @@ +⚠ [39/626] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1234/1240] Replayed LlzkLean.CertValidate +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-04/evidence/validate-skills.txt b/reviews/PHASE-04/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-04/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-04/evidence/verify-llzk-source.txt b/reviews/PHASE-04/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..b152cdf --- /dev/null +++ b/reviews/PHASE-04/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is d4cc1bf2d31b +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned-with-caveats +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned-with-caveats +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-04/evidence/verify-pins.txt b/reviews/PHASE-04/evidence/verify-pins.txt new file mode 100644 index 0000000..ad993cb --- /dev/null +++ b/reviews/PHASE-04/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json inputRev pins VeIR d4cc1bf2d31b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d4cc1bf2d31b +PASS: dependency checkout HEAD is d4cc1bf2d31b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +WARN: workspace VeIR HEAD 0c5280de5715dc0fa518e7e3782e784a5962d4d8 is a descendant of accepted pin d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3; dependency checkout remains the source of truth + +pin verification summary: 0 fail, 1 warn, mode=strict diff --git a/reviews/PHASE-04/findings.md b/reviews/PHASE-04/findings.md new file mode 100644 index 0000000..0dca872 --- /dev/null +++ b/reviews/PHASE-04/findings.md @@ -0,0 +1,34 @@ +# Phase 4 Findings + +Repository: llzk-lean +Reviewed: 2026-06-09 + +## F4-LLZK-01: Canonical mode failed unclearly with the clean pinned VeIR script + +Severity: low +Status: resolved + +`differential/run-differential.sh --canonicalize ...` forwards +`--canonicalize` to the selected VeIR `scripts/llzk-diff.sh`. Before the VeIR +dependency pin is bumped, the default clean pinned script does not support that +flag. The wrapper previously discovered this only after invoking the selected +script per input, producing a generic `unknown flag: --canonicalize` failure. + +Resolution: the wrapper now checks the selected diff script before expanding the +corpus and exits with an explicit instruction to use +`VEIR_DIFF=../veir/scripts/llzk-diff.sh` for Phase 4 workspace evidence or bump +the clean VeIR pin. + +## F4-LLZK-02: Mode-skip-only runs returned success with zero executed inputs + +Severity: low +Status: resolved + +A parse/print invocation over only `expected-divergence/canonical/` inputs +returned exit 0 with `0 pass`, `0 fail`, and all inputs marked `MODE-SKIP`. +That is correct classification for each file, but it is a false green for the +invocation because no input executed in the selected mode. + +Resolution: the wrapper now exits non-zero when every selected input is +mode-skipped, and the README files document that mode-skip-only runs are not +evidence. diff --git a/reviews/PHASE-04/request.md b/reviews/PHASE-04/request.md new file mode 100644 index 0000000..5e39e77 --- /dev/null +++ b/reviews/PHASE-04/request.md @@ -0,0 +1,17 @@ +# Phase 4 Review Request + +Repository: llzk-lean +Created: 2026-06-09 + +Review the Phase 4 Strategy A differential bootstrap. + +The review must verify that: + +- Phase 4 is active and scoped to Strategy A differential work. +- The bootstrap does not claim pass-pipeline differential acceptance. +- The available test infrastructure is recorded: + `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt` + and `/home/alh/llvm-project`. +- Phase 2 source-truth, Phase 3 operation-gap, and dependency pin gates remain + part of the active harness. +- Review evidence cites exact local files, commits, and command outputs. diff --git a/reviews/PHASE-05/adversarial-review.md b/reviews/PHASE-05/adversarial-review.md new file mode 100644 index 0000000..a900193 --- /dev/null +++ b/reviews/PHASE-05/adversarial-review.md @@ -0,0 +1,80 @@ +# Phase 5 Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## Scope + +This review covers Phase 5 bootstrap, clean VeIR pin consumption for the +canonical differential driver, and the expanded corpus run through the default +`.lake/packages/VeIR` path. It does not claim full Strategy A corpus coverage. + +## Required Checks + +- Confirm `docs/harness/CURRENT.md` names Phase 5 as active. +- Confirm `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md` records the clean + pin consumption target. +- Confirm Phase 4 workspace evidence remains present and separated from clean + dependency acceptance. +- Confirm clean-pin corpus evidence uses the default dependency path, not a + workspace `VEIR_DIFF` override. +- Confirm the corpus matrix covers all 15 VeIR Felt rewrite patterns while + keeping expected divergences separate from positives. + +## Initial Result + +Bootstrap documentation is ready for review once freshness, source, pin, doctor, +skill, and build gates pass. + +## Final Result + +Accepted as Phase 5 clean-pin expanded corpus evidence. + +- `reviews/PHASE-05/evidence/check-doc-freshness.txt`: doc freshness summary is + `0 fail`; the gate now requires Phase 5 to be active, the Phase 5 review + workspace to exist, and Phase 4 evidence to remain present. +- `reviews/PHASE-05/evidence/verify-llzk-source.txt`: LLZK source verification + summary is `0 fail, 1 warn`; the warning is the known stale `../llzk-lib` + worktree HEAD while the gate reads the accepted commit with `git show`. +- `reviews/PHASE-05/evidence/verify-pins.txt`: pin verification summary is + `0 fail, 0 warn`; workspace VeIR HEAD equals the accepted clean pin. +- `reviews/PHASE-05/evidence/doctor-workspace.txt`: strict doctor summary is + `0 fail, 0 warn`. +- `reviews/PHASE-05/evidence/validate-skills.txt`: skill validation summary is + `0 fail over 5 skills`. +- `reviews/PHASE-05/evidence/lake-build.txt`: `lake build` completed + successfully. +- `reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt`: the + default clean dependency driver runs the expanded canonical corpus with no + `VEIR_DIFF` override and reports `21 pass (incl. expected-diverge), 0 fail`. +- `reviews/PHASE-05/evidence/adversarial-review.txt`: confirms the bootstrap + state, clean-pin corpus evidence, and expected-divergence boundary. + +The clean-pin consumption and initial 15-pattern corpus expansion parts of +Phase 5 are complete. Reducing expected divergences and reclassifying closed +gaps remain active work. + +## Fresh Review Update + +A Phase 5 execution-readiness review found one high-severity wrapper issue: +all-SKIP differential runs could return exit 0 when required tools were +unavailable. This is resolved by making SKIP a non-zero wrapper outcome. + +A clean-pin trial then found that the first canonical script pin could hang in +`lake exec veir-opt` despite a built executable being available. This is +resolved by VeIR `220cd215579b435c3c22ce86b34a3f4ce2ca276e`, which prefers the +built `veir-opt` binary and falls back to `lake exec` only when needed. + +A subsequent fresh adversarial review found stale Phase 5 status language after +the 21-input corpus expansion, incomplete corpus polarity documentation for +expected LLZK/VEIR failures, and source evidence that omitted stderr warning +detail. These are resolved by updating the current status docs, tightening doc +freshness against stale seed-corpus language, documenting expected tool-failure +polarity, and refreshing source evidence with stderr captured. + +The final fresh review found that expected-divergence polarity was still too +broad: canonical output-divergence tests would accept an LLZK-side or VEIR-side +tool failure merely because they lived under `expected-divergence/`. This is +resolved by making each expected-divergence file's `EXPECTED-*` header the +source of truth and by adding guard evidence proving a wrong failure mode exits +nonzero. diff --git a/reviews/PHASE-05/disposition.md b/reviews/PHASE-05/disposition.md new file mode 100644 index 0000000..ea3d013 --- /dev/null +++ b/reviews/PHASE-05/disposition.md @@ -0,0 +1,26 @@ +# Phase 5 Disposition + +Repository: llzk-lean +Created: 2026-06-09 +Updated: 2026-06-10 + +## Dispositioned Findings + +- F5-LLZK-01 resolved by making `differential/run-differential.sh` exit + non-zero whenever `llzk-diff.sh` reports SKIP for any selected input. +- F5-LLZK-02 resolved by pinning VeIR + `220cd215579b435c3c22ce86b34a3f4ce2ca276e`, whose differential driver uses + the built `veir-opt` binary when available and preserves `lake exec` as a + fallback. +- F5-LLZK-03 resolved by updating stale Phase 5 status docs and adding + freshness checks that reject seed-only/future-expansion language. +- F5-LLZK-04 resolved by documenting `EXPECTED-LLZK-FAIL` and + `EXPECTED-VEIR-FAIL` corpus polarity and gating those labels in doc + freshness. +- F5-LLZK-05 resolved by refreshing `verify-llzk-source.txt` with stderr + captured so the known stale `../llzk-lib` warning is present in the evidence. +- F5-LLZK-06 resolved by making expected-divergence files declare the exact + accepted `EXPECTED-*` outcome and by adding polarity-guard evidence that a + wrong failure mode exits nonzero. + +No Phase 5 findings remain open. diff --git a/reviews/PHASE-05/evidence/README.md b/reviews/PHASE-05/evidence/README.md new file mode 100644 index 0000000..56b9ab5 --- /dev/null +++ b/reviews/PHASE-05/evidence/README.md @@ -0,0 +1,18 @@ +# Phase 5 Evidence + +Populate this directory with exact command output during Phase 5. + +Expected bootstrap evidence: + +- `check-doc-freshness.txt` +- `verify-llzk-source.txt` +- `verify-pins.txt` +- `doctor-workspace.txt` +- `validate-skills.txt` +- `lake-build.txt` +- `skip-guard.txt` +- `differential-clean-pin-canonicalize.txt` +- `adversarial-review.txt` + +Bootstrap evidence must not be treated as clean-pin Strategy A acceptance +evidence. diff --git a/reviews/PHASE-05/evidence/adversarial-review.txt b/reviews/PHASE-05/evidence/adversarial-review.txt new file mode 100644 index 0000000..cc297b6 --- /dev/null +++ b/reviews/PHASE-05/evidence/adversarial-review.txt @@ -0,0 +1,18 @@ +$ Phase 5 bootstrap adversarial checks + +PASS: docs/harness/CURRENT.md names Phase 5 as active. +PASS: docs/phases/PHASE-05-strategy-a-pin-and-corpus.md records the clean-pin implementation gate. +PASS: Phase 5 docs record clean-pin expanded corpus evidence and leave expected divergences classified. +PASS: docs/harness/SOURCES.md records Phase 4 canonical differential evidence and fresh adversarial review evidence. +PASS: Phase 4 fresh adversarial evidence records the default clean pinned VeIR script guard. +PASS: Phase 5 accepted VeIR dependency pin is 220cd215579b435c3c22ce86b34a3f4ce2ca276e. +PASS: Phase 5 clean-pin canonical evidence uses the default dependency driver without VEIR_DIFF. +PASS: Phase 5 corpus matrix covers all 15 VeIR Felt rewrite-pattern definitions. +PASS: differential wrapper rejects missing-tool SKIP runs as non-acceptance evidence. +PASS: clean-pinned VeIR diff script prefers the built veir-opt binary when present. +PASS: Phase 5 status docs no longer describe corpus expansion as future seed work. +PASS: differential README records the clean-pin expanded corpus status. +PASS: corpus README documents EXPECTED-LLZK-FAIL and EXPECTED-VEIR-FAIL polarity. +PASS: expected-divergence polarity is marker-specific; a canonical EXPECTED-DIVERGE file with forced LLZK failure exits nonzero. +PASS: Phase 5 source evidence captures the known stderr warning detail. +PASS: no Phase 5 findings remain open. diff --git a/reviews/PHASE-05/evidence/check-doc-freshness.txt b/reviews/PHASE-05/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..23ef7aa --- /dev/null +++ b/reviews/PHASE-05/evidence/check-doc-freshness.txt @@ -0,0 +1,199 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-04/evidence/README.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-05/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: CURRENT no longer says corpus expansion is future work +PASS: CURRENT no longer says clean-pin corpus migration is only starting +PASS: CURRENT no longer describes the canonical corpus as seed-only +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES records Phase 4 phase file +PASS: SOURCES records Phase 5 phase file +PASS: SOURCES records Phase 4 implementation and fresh review evidence +PASS: SOURCES records Strategy A differential wrapper and corpus +PASS: SOURCES records accepted local llzk-opt binary +PASS: SOURCES records local llvm-project test infrastructure +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: Phase 4 disposition exists +PASS: Phase 5 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/README.md +PASS: evidence present reviews/PHASE-04/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-04/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-04/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-04/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review-fresh.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-bootstrap.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-canonicalize.txt +PASS: evidence present reviews/PHASE-04/evidence/corpus-classification.txt +PASS: evidence present reviews/PHASE-05/evidence/README.md +PASS: evidence present reviews/PHASE-05/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-05/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-05/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-05/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-05/evidence/skip-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/polarity-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-05/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 4 source evidence reports no failures +PASS: Phase 4 pin evidence reports no failures +PASS: Phase 4 strict doctor evidence reports no failures +PASS: Phase 4 skill evidence reports no failures +PASS: Phase 4 lake build evidence reports success +PASS: Phase 4 adversarial evidence confirms llzk-opt is executable +PASS: Phase 4 adversarial evidence dispositions differential wrapper and corpus edits +PASS: Phase 4 parse/print differential evidence records workspace VeIR script +PASS: Phase 4 parse/print differential evidence reports no failures +PASS: Phase 4 canonical differential evidence records accepted llzk-opt +PASS: Phase 4 canonical differential evidence records canonicalization command +PASS: Phase 4 canonical differential evidence reports no failures +PASS: Phase 4 corpus evidence records canonical expected-divergence cases +PASS: Phase 4 fresh adversarial evidence records clean-pin guard +PASS: Phase 5 source evidence reports no failures +PASS: Phase 5 source evidence captures known stale llzk-lib warning detail +PASS: Phase 5 pin evidence reports no failures +PASS: Phase 5 strict doctor evidence reports no failures +PASS: Phase 5 skill evidence reports no failures +PASS: Phase 5 lake build evidence reports success +PASS: Phase 5 skip guard rejects missing-tool evidence +PASS: Phase 5 polarity guard rejects wrong expected-divergence failure mode +PASS: Phase 5 polarity guard records nonzero exit +PASS: Phase 5 clean-pin canonical evidence records default dependency command +PASS: Phase 5 clean-pin canonical evidence records expanded positive corpus +PASS: Phase 5 clean-pin canonical evidence records expanded expected-divergence corpus +PASS: Phase 5 clean-pin canonical evidence reports no failures +PASS: Phase 5 adversarial evidence records exact polarity guard +PASS: Phase 5 adversarial evidence reports no open findings +PASS: differential README records clean-pin expanded corpus status +PASS: differential README documents exact expected-divergence markers +PASS: differential README no longer calls the Phase 5 corpus intentionally small +PASS: differential README no longer calls the Phase 5 corpus a seed +PASS: differential README no longer carries the stale seed bar +PASS: corpus README documents expected LLZK failure polarity +PASS: corpus README documents expected VEIR failure polarity +PASS: corpus README documents exact output-divergence polarity +PASS: Phase 5 docs record clean-pin Strategy A corpus expansion +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt new file mode 100644 index 0000000..7456ef5 --- /dev/null +++ b/reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt @@ -0,0 +1,24 @@ +$ LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/add_const_swap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk + +Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) diff --git a/reviews/PHASE-05/evidence/doctor-workspace.txt b/reviews/PHASE-05/evidence/doctor-workspace.txt new file mode 100644 index 0000000..6de7618 --- /dev/null +++ b/reviews/PHASE-05/evidence/doctor-workspace.txt @@ -0,0 +1,75 @@ +PASS: tool git is available +PASS: tool lake is available +PASS: optional tool cmake is available +PASS: optional tool ctest is available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 220cd215579b +PASS: lake-manifest.json pins VeIR 220cd215579b +PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 220cd215579b +PASS: dependency checkout HEAD is 220cd215579b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 220cd215579b + +pin verification summary: 0 fail, 0 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence +PASS: found reviews/PHASE-04/evidence +PASS: found reviews/PHASE-05/evidence + +doctor summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-05/evidence/lake-build.txt b/reviews/PHASE-05/evidence/lake-build.txt new file mode 100644 index 0000000..b3c464f --- /dev/null +++ b/reviews/PHASE-05/evidence/lake-build.txt @@ -0,0 +1,34 @@ +⚠ [39/619] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1234/1240] Replayed LlzkLean.CertValidate +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-05/evidence/polarity-guard.txt b/reviews/PHASE-05/evidence/polarity-guard.txt new file mode 100644 index 0000000..bf3dff6 --- /dev/null +++ b/reviews/PHASE-05/evidence/polarity-guard.txt @@ -0,0 +1,12 @@ +$ LLZK_OPT=/bin/false ./differential/run-differential.sh --canonicalize differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk + [llzk-diff] stage 1: lowering input via llzk-opt --mlir-print-op-generic + FAIL: llzk-opt could not lower input + +Summary: 0 pass (incl. expected-diverge), 1 fail (over 1 inputs) + +Failed inputs (re-run with the specific path for the full diff; +set VEIR_DIFF_KEEP=1 to retain tmp files for debugging): + - /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk + +exit code: 1 diff --git a/reviews/PHASE-05/evidence/skip-guard.txt b/reviews/PHASE-05/evidence/skip-guard.txt new file mode 100644 index 0000000..c3528c2 --- /dev/null +++ b/reviews/PHASE-05/evidence/skip-guard.txt @@ -0,0 +1,8 @@ +$ tmp=$(mktemp -d); mkdir -p "$tmp/scripts"; cp .lake/packages/VeIR/scripts/llzk-diff.sh "$tmp/scripts/llzk-diff.sh"; PATH=/usr/bin:/bin LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF="$tmp/scripts/llzk-diff.sh" ./differential/run-differential.sh differential/corpus/felt/const_identities.mlir +SKIP: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir (llzk-diff.sh exit 77 — required differential tool unavailable) + +Summary: 0 pass (incl. expected-diverge), 0 fail, 1 skip, 0 mode-skip (over 1 inputs) + +ERROR: 1 input(s) skipped because required tools were unavailable; this is not acceptance evidence. + +exit code: 2 diff --git a/reviews/PHASE-05/evidence/validate-skills.txt b/reviews/PHASE-05/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-05/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-05/evidence/verify-llzk-source.txt b/reviews/PHASE-05/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..e409411 --- /dev/null +++ b/reviews/PHASE-05/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is 220cd215579b +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned-with-caveats +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned-with-caveats +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-05/evidence/verify-pins.txt b/reviews/PHASE-05/evidence/verify-pins.txt new file mode 100644 index 0000000..98ceeb2 --- /dev/null +++ b/reviews/PHASE-05/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 220cd215579b +PASS: lake-manifest.json pins VeIR 220cd215579b +PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 220cd215579b +PASS: dependency checkout HEAD is 220cd215579b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 220cd215579b + +pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-05/findings.md b/reviews/PHASE-05/findings.md new file mode 100644 index 0000000..dca0fb2 --- /dev/null +++ b/reviews/PHASE-05/findings.md @@ -0,0 +1,99 @@ +# Phase 5 Findings + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## F5-LLZK-01: Differential wrapper returned success when every input skipped + +Severity: high +Status: resolved + +`differential/run-differential.sh` counted `llzk-diff.sh` exit 77 as `SKIP`, +but still returned exit 0 when no input failed. A missing `lake` or other +required tool could therefore produce `0 pass`, `0 fail`, and nonzero `skip` +while still looking like a successful wrapper invocation. + +Resolution: the wrapper now exits non-zero whenever any input is skipped +because required tools are unavailable. SKIP remains visible in the summary, +but cannot be used as Phase 5 acceptance evidence. + +## F5-LLZK-02: Clean-pinned differential driver could hang in `lake exec` + +Severity: high +Status: resolved + +The first clean-pin candidate, `3e936409c85a27b6d9695f5431d6ccb8a6d842fd`, +contained `--canonicalize` support but invoked `veir-opt` only through +`lake exec`. In the llzk-lean dependency checkout, the first canonical corpus +input did not finish within a 240-second bounded run, while the already-built +`.lake/packages/VeIR/.lake/build/bin/veir-opt` completed the same lowered input +immediately. + +Resolution: VeIR commit `220cd215579b435c3c22ce86b34a3f4ce2ca276e` updates +`scripts/llzk-diff.sh` to prefer an existing `.lake/build/bin/veir-opt` and +fall back to `lake exec` only when the binary is absent. llzk-lean now pins +that commit, and the clean-pin canonical corpus evidence runs through the +default dependency driver without `VEIR_DIFF`. + +## F5-LLZK-03: Phase 5 status docs still described corpus expansion as future seed work + +Severity: medium +Status: resolved + +After the clean-pin corpus was expanded to 21 inputs, `docs/harness/CURRENT.md` +still said corpus expansion beyond the seed set was the next Strategy A task, +and `differential/README.md` still described the corpus as a reviewed seed with +a "Current seed bar." Those claims contradicted the Phase 5 corpus evidence and +could mislead the next phase handoff even while freshness passed. + +Resolution: `docs/harness/CURRENT.md`, `docs/harness/GATES.md`, and +`differential/README.md` now describe the clean-pin expanded corpus and the +15-pattern rewrite matrix without claiming full Strategy A acceptance. +`scripts/harness/check-doc-freshness.sh` now rejects the stale seed/future-work +phrases and requires the differential README to record the expanded corpus +status. + +## F5-LLZK-04: Corpus docs omitted expected tool-failure polarity + +Severity: low +Status: resolved + +`differential/corpus/README.md` documented PASS/DIVERGE inversion under +`expected-divergence/`, but the wrapper and current corpus also support +`EXPECTED-LLZK-FAIL` and `EXPECTED-VEIR-FAIL`. Future parser/verifier-gap inputs +could therefore be documented as ordinary divergence even when one tool failed +before comparable output existed. + +Resolution: the corpus README now documents expected LLZK/VEIR failure polarity, +and doc freshness requires both expected-failure labels to remain documented. + +## F5-LLZK-05: Source evidence omitted stderr warning detail + +Severity: low +Status: resolved + +`reviews/PHASE-05/evidence/verify-llzk-source.txt` reported +`LLZK source verification summary: 0 fail, 1 warn`, but the warning text itself +was emitted on stderr and was not captured in the evidence file. The known stale +`../llzk-lib` worktree warning was documented elsewhere, but the evidence file +was not exact command output. + +Resolution: Phase 5 source evidence is refreshed with stderr captured so the +warning detail appears alongside the pass/fail summary. + +## F5-LLZK-06: Expected-divergence polarity accepted wrong failure modes + +Severity: high +Status: resolved + +`differential/run-differential.sh` treated every file under +`expected-divergence/` as allowed to pass on `DIVERGE`, `VEIR-FAIL`, or +`LLZK-FAIL`. That was too broad for canonical output-divergence tests: a +regression where `llzk-opt` or `veir-opt` stopped producing comparable output +would still count as accepted evidence instead of failing the corpus run. + +Resolution: the wrapper now requires each expected-divergence file to declare +its exact accepted label in a header comment: `EXPECTED-DIVERGE`, +`EXPECTED-LLZK-FAIL`, or `EXPECTED-VEIR-FAIL`. The corpus docs and Strategy A +README document the stricter polarity, and `polarity-guard.txt` records a +forced wrong-mode failure returning nonzero. diff --git a/reviews/PHASE-05/request.md b/reviews/PHASE-05/request.md new file mode 100644 index 0000000..d04fd2c --- /dev/null +++ b/reviews/PHASE-05/request.md @@ -0,0 +1,17 @@ +# Phase 5 Review Request + +Repository: llzk-lean +Created: 2026-06-09 + +Review the Phase 5 Strategy A pin-and-corpus bootstrap. + +The review must verify that: + +- Phase 5 is active and scoped to clean VeIR pin consumption plus corpus + expansion. +- The bootstrap does not claim clean-pin Strategy A acceptance. +- Phase 4 workspace canonical differential evidence remains recorded and + separated from clean dependency evidence. +- Phase 4 adversarial findings are closed. +- Phase 2 source-truth, Phase 3 operation-gap, Phase 4 differential evidence, + and dependency pin gates remain part of the active harness. diff --git a/reviews/PHASE-06/adversarial-review.md b/reviews/PHASE-06/adversarial-review.md new file mode 100644 index 0000000..36c7031 --- /dev/null +++ b/reviews/PHASE-06/adversarial-review.md @@ -0,0 +1,24 @@ +# Phase 6 Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## Scope + +This review covers the Phase 6 bootstrap only. It verifies that Phase 6 starts +from Phase 5's clean-pin corpus and exact expected-divergence polarity without +claiming full Strategy A acceptance. + +## Bootstrap Checks + +- Confirm Phase 5 is marked completed and all Phase 5 findings are closed. +- Confirm `docs/harness/CURRENT.md` names Phase 6 as active. +- Confirm `docs/harness/SOURCES.md` records the Phase 6 phase file and Phase 5 + exact-polarity guard evidence. +- Confirm freshness, source-truth, pin, doctor, skill, build, and clean-pin + canonical differential baseline gates pass. + +## Result + +Phase 6 is ready for implementation work once the bootstrap evidence under +`reviews/PHASE-06/evidence/` is populated by the current gates. diff --git a/reviews/PHASE-06/disposition.md b/reviews/PHASE-06/disposition.md new file mode 100644 index 0000000..73915b7 --- /dev/null +++ b/reviews/PHASE-06/disposition.md @@ -0,0 +1,6 @@ +# Phase 6 Disposition + +Repository: llzk-lean +Created: 2026-06-10 + +No Phase 6 bootstrap findings are open. diff --git a/reviews/PHASE-06/evidence/README.md b/reviews/PHASE-06/evidence/README.md new file mode 100644 index 0000000..63375b6 --- /dev/null +++ b/reviews/PHASE-06/evidence/README.md @@ -0,0 +1,14 @@ +# Phase 6 Evidence + +Populate this directory with exact command output during Phase 6. + +Bootstrap evidence expected: + +- `check-doc-freshness.txt` +- `verify-llzk-source.txt` +- `verify-pins.txt` +- `doctor-workspace.txt` +- `validate-skills.txt` +- `lake-build.txt` +- `differential-clean-pin-canonicalize.txt` +- `adversarial-review.txt` diff --git a/reviews/PHASE-06/evidence/adversarial-review.txt b/reviews/PHASE-06/evidence/adversarial-review.txt new file mode 100644 index 0000000..53a082a --- /dev/null +++ b/reviews/PHASE-06/evidence/adversarial-review.txt @@ -0,0 +1,9 @@ +$ Phase 6 bootstrap adversarial checks + +PASS: Phase 5 is marked completed before Phase 6 starts. +PASS: docs/harness/CURRENT.md names Phase 6 as active. +PASS: docs/harness/SOURCES.md records the Phase 6 phase file. +PASS: Phase 5 exact-polarity guard evidence is present. +PASS: expected-divergence polarity remains exact and marker-driven. +PASS: Phase 6 docs preserve the clean-pin canonical baseline without claiming full Strategy A acceptance. +PASS: no Phase 6 bootstrap findings remain open. diff --git a/reviews/PHASE-06/evidence/check-doc-freshness.txt b/reviews/PHASE-06/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..f736dcd --- /dev/null +++ b/reviews/PHASE-06/evidence/check-doc-freshness.txt @@ -0,0 +1,226 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-04/evidence/README.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-05/evidence/README.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: found reviews/PHASE-06/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: Phase 5 phase file is marked completed +PASS: CURRENT no longer says corpus expansion is future work +PASS: CURRENT no longer says clean-pin corpus migration is only starting +PASS: CURRENT no longer describes the canonical corpus as seed-only +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES records Phase 4 phase file +PASS: SOURCES records Phase 5 phase file +PASS: SOURCES records Phase 6 phase file +PASS: SOURCES records Phase 4 implementation and fresh review evidence +PASS: SOURCES records Strategy A differential wrapper and corpus +PASS: SOURCES records accepted local llzk-opt binary +PASS: SOURCES records local llvm-project test infrastructure +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: Phase 4 disposition exists +PASS: Phase 5 disposition exists +PASS: Phase 6 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/README.md +PASS: evidence present reviews/PHASE-04/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-04/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-04/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-04/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review-fresh.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-bootstrap.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-canonicalize.txt +PASS: evidence present reviews/PHASE-04/evidence/corpus-classification.txt +PASS: evidence present reviews/PHASE-05/evidence/README.md +PASS: evidence present reviews/PHASE-05/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-05/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-05/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-05/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-05/evidence/skip-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/polarity-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-05/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-06/evidence/README.md +PASS: evidence present reviews/PHASE-06/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-06/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-06/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-06/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-06/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 4 source evidence reports no failures +PASS: Phase 4 pin evidence reports no failures +PASS: Phase 4 strict doctor evidence reports no failures +PASS: Phase 4 skill evidence reports no failures +PASS: Phase 4 lake build evidence reports success +PASS: Phase 4 adversarial evidence confirms llzk-opt is executable +PASS: Phase 4 adversarial evidence dispositions differential wrapper and corpus edits +PASS: Phase 4 parse/print differential evidence records workspace VeIR script +PASS: Phase 4 parse/print differential evidence reports no failures +PASS: Phase 4 canonical differential evidence records accepted llzk-opt +PASS: Phase 4 canonical differential evidence records canonicalization command +PASS: Phase 4 canonical differential evidence reports no failures +PASS: Phase 4 corpus evidence records canonical expected-divergence cases +PASS: Phase 4 fresh adversarial evidence records clean-pin guard +PASS: Phase 5 source evidence reports no failures +PASS: Phase 5 source evidence captures known stale llzk-lib warning detail +PASS: Phase 5 pin evidence reports no failures +PASS: Phase 5 strict doctor evidence reports no failures +PASS: Phase 5 skill evidence reports no failures +PASS: Phase 5 lake build evidence reports success +PASS: Phase 5 skip guard rejects missing-tool evidence +PASS: Phase 5 polarity guard rejects wrong expected-divergence failure mode +PASS: Phase 5 polarity guard records nonzero exit +PASS: Phase 5 clean-pin canonical evidence records default dependency command +PASS: Phase 5 clean-pin canonical evidence records expanded positive corpus +PASS: Phase 5 clean-pin canonical evidence records expanded expected-divergence corpus +PASS: Phase 5 clean-pin canonical evidence reports no failures +PASS: Phase 5 adversarial evidence records exact polarity guard +PASS: Phase 5 adversarial evidence reports no open findings +PASS: Phase 6 source evidence reports no failures +PASS: Phase 6 pin evidence reports no failures +PASS: Phase 6 strict doctor evidence reports no failures +PASS: Phase 6 skill evidence reports no failures +PASS: Phase 6 lake build evidence reports success +PASS: Phase 6 clean-pin canonical baseline reports no failures +PASS: Phase 6 adversarial evidence records Phase 5 closeout +PASS: Phase 6 adversarial evidence records exact polarity baseline +PASS: differential README records clean-pin expanded corpus status +PASS: differential README documents exact expected-divergence markers +PASS: differential README no longer calls the Phase 5 corpus intentionally small +PASS: differential README no longer calls the Phase 5 corpus a seed +PASS: differential README no longer carries the stale seed bar +PASS: corpus README documents expected LLZK failure polarity +PASS: corpus README documents expected VEIR failure polarity +PASS: corpus README documents exact output-divergence polarity +PASS: Phase 5 docs record clean-pin Strategy A corpus expansion +PASS: Phase 6 docs record divergence burn-down baseline +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt new file mode 100644 index 0000000..7456ef5 --- /dev/null +++ b/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt @@ -0,0 +1,24 @@ +$ LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/add_const_swap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk + +Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) diff --git a/reviews/PHASE-06/evidence/doctor-workspace.txt b/reviews/PHASE-06/evidence/doctor-workspace.txt new file mode 100644 index 0000000..38dfd92 --- /dev/null +++ b/reviews/PHASE-06/evidence/doctor-workspace.txt @@ -0,0 +1,81 @@ +PASS: tool git is available +PASS: tool lake is available +PASS: optional tool cmake is available +PASS: optional tool ctest is available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD matches bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 220cd215579b +PASS: lake-manifest.json pins VeIR 220cd215579b +PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 220cd215579b +PASS: dependency checkout HEAD is 220cd215579b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 220cd215579b + +pin verification summary: 0 fail, 0 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence +PASS: found reviews/PHASE-04/evidence +PASS: found reviews/PHASE-05/evidence +PASS: found reviews/PHASE-06/evidence + +doctor summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-06/evidence/lake-build.txt b/reviews/PHASE-06/evidence/lake-build.txt new file mode 100644 index 0000000..979a48b --- /dev/null +++ b/reviews/PHASE-06/evidence/lake-build.txt @@ -0,0 +1,34 @@ +⚠ [39/65] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1234/1240] Replayed LlzkLean.CertValidate +info: LlzkLean/CertValidate.lean:126:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-06/evidence/validate-skills.txt b/reviews/PHASE-06/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-06/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-06/evidence/verify-llzk-source.txt b/reviews/PHASE-06/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..e409411 --- /dev/null +++ b/reviews/PHASE-06/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is 220cd215579b +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned-with-caveats +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned-with-caveats +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-06/evidence/verify-pins.txt b/reviews/PHASE-06/evidence/verify-pins.txt new file mode 100644 index 0000000..98ceeb2 --- /dev/null +++ b/reviews/PHASE-06/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 220cd215579b +PASS: lake-manifest.json pins VeIR 220cd215579b +PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 220cd215579b +PASS: dependency checkout HEAD is 220cd215579b +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 220cd215579b + +pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-06/findings.md b/reviews/PHASE-06/findings.md new file mode 100644 index 0000000..17d8ea8 --- /dev/null +++ b/reviews/PHASE-06/findings.md @@ -0,0 +1,6 @@ +# Phase 6 Findings + +Repository: llzk-lean +Reviewed: 2026-06-10 + +No Phase 6 bootstrap findings are open. diff --git a/reviews/PHASE-06/request.md b/reviews/PHASE-06/request.md new file mode 100644 index 0000000..23a3f69 --- /dev/null +++ b/reviews/PHASE-06/request.md @@ -0,0 +1,13 @@ +# Phase 6 Review Request + +Repository: llzk-lean +Created: 2026-06-10 + +Review the Phase 6 Strategy A divergence burn-down bootstrap. + +Scope: + +- Phase 6 is active and starts from the Phase 5 clean-pin exact-polarity corpus. +- Phase 5 findings are closed before Phase 6 implementation work starts. +- The bootstrap does not claim full Strategy A acceptance. +- The next implementation target is divergence reduction or reclassification. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index e6a3954..670623f 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -4,7 +4,8 @@ set -u ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" FAIL=0 -ACCEPTED_VEIR_COMMIT="d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" +ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" +ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" fail() { echo "FAIL: $*" >&2 @@ -33,13 +34,64 @@ require_nonempty() { fi } +require_contains() { + local path="$1" + local needle="$2" + local description="$3" + if grep -Fq -- "$needle" "${ROOT}/${path}"; then + ok "$description" + else + fail "${description}: ${path} does not contain ${needle}" + fi +} + +require_not_contains() { + local path="$1" + local needle="$2" + local description="$3" + if grep -Fq -- "$needle" "${ROOT}/${path}"; then + fail "${description}: ${path} still contains ${needle}" + else + ok "$description" + fi +} + +require_op_once() { + local mnemonic="$1" + local count + count="$(grep -Fc -- "| \`${mnemonic}\` |" "${ROOT}/docs/harness/FELT_OP_GAPS.md")" + if [[ "$count" == "1" ]]; then + ok "FELT_OP_GAPS records ${mnemonic} exactly once" + else + fail "FELT_OP_GAPS records ${mnemonic} ${count} times" + fi +} + +require_op_row_contains() { + local mnemonic="$1" + local needle="$2" + local description="$3" + local row + row="$(grep -F -- "| \`${mnemonic}\` |" "${ROOT}/docs/harness/FELT_OP_GAPS.md")" + if [[ "$row" == *"$needle"* ]]; then + ok "$description" + else + fail "${description}: ${mnemonic} row does not contain ${needle}" + fi +} + require_file docs/phases/PHASE-00-harness-reset.md require_file docs/phases/PHASE-01-pins-and-repro.md require_file docs/phases/PHASE-02-llzk-source-truth.md +require_file docs/phases/PHASE-03-felt-op-gap-ledger.md +require_file docs/phases/PHASE-04-strategy-a-differential.md +require_file docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +require_file docs/phases/PHASE-06-strategy-a-divergence-burndown.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md require_file docs/harness/GATES.md +require_file docs/harness/FELT_OP_GAPS.md require_file docs/harness/LLZK_SOURCE.md require_file docs/harness/PINS.md require_file docs/harness/REVIEWS.md @@ -51,15 +103,35 @@ require_file reviews/PHASE-02/disposition.md require_file reviews/PHASE-02/findings.md require_file reviews/PHASE-02/request.md require_file reviews/PHASE-02/adversarial-review.md +require_file reviews/PHASE-03/disposition.md +require_file reviews/PHASE-03/findings.md +require_file reviews/PHASE-03/request.md +require_file reviews/PHASE-03/adversarial-review.md +require_file reviews/PHASE-03/evidence/README.md +require_file reviews/PHASE-04/disposition.md +require_file reviews/PHASE-04/findings.md +require_file reviews/PHASE-04/request.md +require_file reviews/PHASE-04/adversarial-review.md +require_file reviews/PHASE-04/evidence/README.md +require_file reviews/PHASE-05/disposition.md +require_file reviews/PHASE-05/findings.md +require_file reviews/PHASE-05/request.md +require_file reviews/PHASE-05/adversarial-review.md +require_file reviews/PHASE-05/evidence/README.md +require_file reviews/PHASE-06/disposition.md +require_file reviews/PHASE-06/findings.md +require_file reviews/PHASE-06/request.md +require_file reviews/PHASE-06/adversarial-review.md +require_file reviews/PHASE-06/evidence/README.md -phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-02-llzk-source-truth.md" | head -1)" +phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-06-strategy-a-divergence-burndown.md" | head -1)" if [[ "$phase_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then ok "phase review date has ISO format" else fail "phase review date is missing or not ISO formatted" fi -for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md docs/harness/LLZK_SOURCE.md docs/harness/PINS.md docs/harness/REVIEWS.md; do +for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md docs/harness/FELT_OP_GAPS.md docs/harness/LLZK_SOURCE.md docs/harness/PINS.md docs/harness/REVIEWS.md; do doc_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/${doc}" | head -1)" if [[ "$doc_date" == "$phase_date" ]]; then ok "${doc} review date agrees with phase" @@ -68,12 +140,18 @@ for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md fi done -if grep -q "Active phase: Phase 2" "${ROOT}/docs/harness/CURRENT.md"; then +if grep -q "Active phase: Phase 6" "${ROOT}/docs/harness/CURRENT.md"; then ok "CURRENT names active phase" else - fail "CURRENT does not name Phase 2 as active" + fail "CURRENT does not name Phase 6 as active" fi +require_contains docs/phases/PHASE-05-strategy-a-pin-and-corpus.md "Status: completed; superseded by Phase 6" "Phase 5 phase file is marked completed" + +require_not_contains docs/harness/CURRENT.md "corpus expansion beyond the seed set remains the next" "CURRENT no longer says corpus expansion is future work" +require_not_contains docs/harness/CURRENT.md "starts moving the corpus evidence" "CURRENT no longer says clean-pin corpus migration is only starting" +require_not_contains docs/harness/CURRENT.md "seed canonical corpus must keep running" "CURRENT no longer describes the canonical corpus as seed-only" + if grep -q "Accepted VeIR pin" "${ROOT}/docs/harness/SOURCES.md"; then ok "SOURCES records accepted VeIR pin" else @@ -86,18 +164,122 @@ else fail "SOURCES does not record accepted LLZK source commit" fi +if grep -q "docs/harness/FELT_OP_GAPS.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Felt operation gap ledger" +else + fail "SOURCES does not record docs/harness/FELT_OP_GAPS.md" +fi + +if grep -q "docs/phases/PHASE-04-strategy-a-differential.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 4 phase file" +else + fail "SOURCES does not record docs/phases/PHASE-04-strategy-a-differential.md" +fi + +if grep -q "docs/phases/PHASE-05-strategy-a-pin-and-corpus.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 5 phase file" +else + fail "SOURCES does not record docs/phases/PHASE-05-strategy-a-pin-and-corpus.md" +fi + +if grep -q "docs/phases/PHASE-06-strategy-a-divergence-burndown.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 6 phase file" +else + fail "SOURCES does not record docs/phases/PHASE-06-strategy-a-divergence-burndown.md" +fi + +if grep -q "reviews/PHASE-04/evidence/differential-canonicalize.txt" "${ROOT}/docs/harness/SOURCES.md" && + grep -q "reviews/PHASE-04/evidence/adversarial-review-fresh.txt" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 4 implementation and fresh review evidence" +else + fail "SOURCES does not record Phase 4 implementation and fresh review evidence" +fi + +if grep -q "differential/run-differential.sh" "${ROOT}/docs/harness/SOURCES.md" && + grep -q "differential/corpus/" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Strategy A differential wrapper and corpus" +else + fail "SOURCES does not record Strategy A differential wrapper and corpus" +fi + +if grep -Fq -- "/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records accepted local llzk-opt binary" +else + fail "SOURCES does not record accepted local llzk-opt binary" +fi + +if grep -Fq -- "/home/alh/llvm-project" "${ROOT}/docs/harness/SOURCES.md" && + grep -Fq -- "49f12af164138123589263fe75ea5f1d356e8780" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records local llvm-project test infrastructure" +else + fail "SOURCES does not record local llvm-project test infrastructure" +fi + +if grep -Fq -- "$ACCEPTED_LLZK_REMOTE" "${ROOT}/docs/harness/SOURCES.md" && + grep -Fq -- "$ACCEPTED_LLZK_REMOTE" "${ROOT}/docs/harness/LLZK_SOURCE.md"; then + ok "SOURCES and LLZK_SOURCE record accepted LLZK remote" +else + fail "SOURCES or LLZK_SOURCE does not record accepted LLZK remote ${ACCEPTED_LLZK_REMOTE}" +fi + if grep -q "$ACCEPTED_VEIR_COMMIT" "${ROOT}/docs/harness/PINS.md"; then ok "PINS records accepted VeIR commit" else fail "PINS does not record accepted VeIR commit" fi +op_rows="$(grep -Ec '^\| `[^`]+` \|' "${ROOT}/docs/harness/FELT_OP_GAPS.md")" +if [[ "$op_rows" == "18" ]]; then + ok "FELT_OP_GAPS has exactly 18 operation rows" +else + fail "FELT_OP_GAPS has ${op_rows} operation rows, expected 18" +fi + +for mnemonic in \ + const add sub mul pow div uintdiv sintdiv umod smod neg inv \ + bit_and bit_or bit_xor bit_not shl shr; do + require_op_once "$mnemonic" +done + +for mnemonic in sub mul neg; do + require_op_row_contains "$mnemonic" "Gap in Strategy A/E coverage" "FELT_OP_GAPS marks ${mnemonic} Strategy A/E coverage gap" +done + +for mnemonic in pow div uintdiv sintdiv umod smod inv bit_and bit_or bit_xor bit_not shl shr; do + require_op_row_contains "$mnemonic" 'Missing from consumed VeIR `Data.Felt` and `InterpModel`' "FELT_OP_GAPS marks ${mnemonic} consumed VeIR semantic model missing" + require_op_row_contains "$mnemonic" "| Gap |" "FELT_OP_GAPS marks ${mnemonic} as a gap" +done + if grep -q "Disposition" "${ROOT}/reviews/PHASE-02/disposition.md"; then ok "Phase 2 disposition exists" else fail "Phase 2 disposition is not populated" fi +if grep -q "# Phase 3 Disposition" "${ROOT}/reviews/PHASE-03/disposition.md"; then + ok "Phase 3 disposition exists" +else + fail "Phase 3 disposition is not populated" +fi + +if grep -q "# Phase 4 Disposition" "${ROOT}/reviews/PHASE-04/disposition.md"; then + ok "Phase 4 disposition exists" +else + fail "Phase 4 disposition is not populated" +fi + +if grep -q "# Phase 5 Disposition" "${ROOT}/reviews/PHASE-05/disposition.md"; then + ok "Phase 5 disposition exists" +else + fail "Phase 5 disposition is not populated" +fi + +if grep -q "# Phase 6 Disposition" "${ROOT}/reviews/PHASE-06/disposition.md"; then + ok "Phase 6 disposition exists" +else + fail "Phase 6 disposition is not populated" +fi + for evidence in \ reviews/PHASE-02/evidence/llzk-lib-refs.txt \ reviews/PHASE-02/evidence/llzk-field-registry.txt \ @@ -109,6 +291,136 @@ for evidence in \ require_nonempty "$evidence" done +for evidence in \ + reviews/PHASE-03/evidence/README.md \ + reviews/PHASE-03/evidence/check-doc-freshness.txt \ + reviews/PHASE-03/evidence/verify-llzk-source.txt \ + reviews/PHASE-03/evidence/verify-pins.txt \ + reviews/PHASE-03/evidence/doctor-workspace.txt \ + reviews/PHASE-03/evidence/validate-skills.txt \ + reviews/PHASE-03/evidence/lake-build.txt \ + reviews/PHASE-03/evidence/adversarial-review.txt; do + require_nonempty "$evidence" +done + +for evidence in \ + reviews/PHASE-04/evidence/README.md \ + reviews/PHASE-04/evidence/check-doc-freshness.txt \ + reviews/PHASE-04/evidence/verify-llzk-source.txt \ + reviews/PHASE-04/evidence/verify-pins.txt \ + reviews/PHASE-04/evidence/doctor-workspace.txt \ + reviews/PHASE-04/evidence/validate-skills.txt \ + reviews/PHASE-04/evidence/lake-build.txt \ + reviews/PHASE-04/evidence/adversarial-review.txt \ + reviews/PHASE-04/evidence/adversarial-review-fresh.txt \ + reviews/PHASE-04/evidence/differential-bootstrap.txt \ + reviews/PHASE-04/evidence/differential-canonicalize.txt \ + reviews/PHASE-04/evidence/corpus-classification.txt; do + require_nonempty "$evidence" +done + +for evidence in \ + reviews/PHASE-05/evidence/README.md \ + reviews/PHASE-05/evidence/check-doc-freshness.txt \ + reviews/PHASE-05/evidence/verify-llzk-source.txt \ + reviews/PHASE-05/evidence/verify-pins.txt \ + reviews/PHASE-05/evidence/doctor-workspace.txt \ + reviews/PHASE-05/evidence/validate-skills.txt \ + reviews/PHASE-05/evidence/lake-build.txt \ + reviews/PHASE-05/evidence/skip-guard.txt \ + reviews/PHASE-05/evidence/polarity-guard.txt \ + reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt \ + reviews/PHASE-05/evidence/adversarial-review.txt; do + require_nonempty "$evidence" +done + +for evidence in \ + reviews/PHASE-06/evidence/README.md \ + reviews/PHASE-06/evidence/check-doc-freshness.txt \ + reviews/PHASE-06/evidence/verify-llzk-source.txt \ + reviews/PHASE-06/evidence/verify-pins.txt \ + reviews/PHASE-06/evidence/doctor-workspace.txt \ + reviews/PHASE-06/evidence/validate-skills.txt \ + reviews/PHASE-06/evidence/lake-build.txt \ + reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt \ + reviews/PHASE-06/evidence/adversarial-review.txt; do + require_nonempty "$evidence" +done + +require_contains reviews/PHASE-03/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "verify-llzk-source evidence reports no failures" +require_contains reviews/PHASE-03/evidence/verify-pins.txt "pin verification summary: 0 fail" "pin evidence reports no failures" +require_contains reviews/PHASE-03/evidence/doctor-workspace.txt "doctor summary: 0 fail" "strict doctor evidence reports no failures" +require_contains reviews/PHASE-03/evidence/validate-skills.txt "skill validation summary: 0 fail" "skill evidence reports no failures" +require_contains reviews/PHASE-03/evidence/lake-build.txt "Build completed successfully" "lake build evidence reports success" +require_contains reviews/PHASE-03/evidence/lake-build.txt "catalog covers 2 of them; 13 uncovered" "lake build evidence records expected certificate coverage gap" +require_contains reviews/PHASE-03/evidence/adversarial-review.txt "PASS: no missing-op semantic definitions found in consumed VeIR Felt semantics" "adversarial evidence confirms missing-op semantics were not added" +require_contains reviews/PHASE-03/evidence/adversarial-review.txt "PASS: no modified, staged, or untracked files under Lean cert/catalog/corpus implementation paths" "adversarial evidence confirms no Strategy E/A implementation changes" +require_contains reviews/PHASE-04/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "Phase 4 source evidence reports no failures" +require_contains reviews/PHASE-04/evidence/verify-pins.txt "pin verification summary: 0 fail" "Phase 4 pin evidence reports no failures" +require_contains reviews/PHASE-04/evidence/doctor-workspace.txt "doctor summary: 0 fail" "Phase 4 strict doctor evidence reports no failures" +require_contains reviews/PHASE-04/evidence/validate-skills.txt "skill validation summary: 0 fail" "Phase 4 skill evidence reports no failures" +require_contains reviews/PHASE-04/evidence/lake-build.txt "Build completed successfully" "Phase 4 lake build evidence reports success" +require_contains reviews/PHASE-04/evidence/adversarial-review.txt "PASS: llzk-opt binary is executable" "Phase 4 adversarial evidence confirms llzk-opt is executable" +require_contains reviews/PHASE-04/evidence/adversarial-review.txt "PASS: canonicalization-aware differential wrapper and corpus are dispositioned under reviews/PHASE-04" "Phase 4 adversarial evidence dispositions differential wrapper and corpus edits" +require_contains reviews/PHASE-04/evidence/differential-bootstrap.txt "VEIR_DIFF=/home/alh/LLZK/veir/scripts/llzk-diff.sh" "Phase 4 parse/print differential evidence records workspace VeIR script" +require_contains reviews/PHASE-04/evidence/differential-bootstrap.txt "Summary: 4 pass (incl. expected-diverge), 0 fail, 0 skip, 3 mode-skip" "Phase 4 parse/print differential evidence reports no failures" +require_contains reviews/PHASE-04/evidence/differential-canonicalize.txt "LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt" "Phase 4 canonical differential evidence records accepted llzk-opt" +require_contains reviews/PHASE-04/evidence/differential-canonicalize.txt "--canonicalize differential/corpus" "Phase 4 canonical differential evidence records canonicalization command" +require_contains reviews/PHASE-04/evidence/differential-canonicalize.txt "Summary: 7 pass (incl. expected-diverge), 0 fail" "Phase 4 canonical differential evidence reports no failures" +require_contains reviews/PHASE-04/evidence/corpus-classification.txt "differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk" "Phase 4 corpus evidence records canonical expected-divergence cases" +require_contains reviews/PHASE-04/evidence/adversarial-review-fresh.txt "PASS: llzk-lean canonical run without VEIR_DIFF now exits early with an actionable clean-pin/override message." "Phase 4 fresh adversarial evidence records clean-pin guard" +require_contains reviews/PHASE-05/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "Phase 5 source evidence reports no failures" +require_contains reviews/PHASE-05/evidence/verify-llzk-source.txt "WARN: llzk-lib worktree HEAD" "Phase 5 source evidence captures known stale llzk-lib warning detail" +require_contains reviews/PHASE-05/evidence/verify-pins.txt "pin verification summary: 0 fail" "Phase 5 pin evidence reports no failures" +require_contains reviews/PHASE-05/evidence/doctor-workspace.txt "doctor summary: 0 fail" "Phase 5 strict doctor evidence reports no failures" +require_contains reviews/PHASE-05/evidence/validate-skills.txt "skill validation summary: 0 fail" "Phase 5 skill evidence reports no failures" +require_contains reviews/PHASE-05/evidence/lake-build.txt "Build completed successfully" "Phase 5 lake build evidence reports success" +require_contains reviews/PHASE-05/evidence/skip-guard.txt "ERROR: 1 input(s) skipped because required tools were unavailable; this is not acceptance evidence." "Phase 5 skip guard rejects missing-tool evidence" +require_contains reviews/PHASE-05/evidence/polarity-guard.txt "LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk" "Phase 5 polarity guard rejects wrong expected-divergence failure mode" +require_contains reviews/PHASE-05/evidence/polarity-guard.txt "exit code: 1" "Phase 5 polarity guard records nonzero exit" +require_contains reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt "./differential/run-differential.sh --canonicalize differential/corpus" "Phase 5 clean-pin canonical evidence records default dependency command" +require_contains reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt "differential/corpus/felt/add_const_swap.llzk" "Phase 5 clean-pin canonical evidence records expanded positive corpus" +require_contains reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt "differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk" "Phase 5 clean-pin canonical evidence records expanded expected-divergence corpus" +require_contains reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 5 clean-pin canonical evidence reports no failures" +require_contains reviews/PHASE-05/evidence/adversarial-review.txt "PASS: expected-divergence polarity is marker-specific" "Phase 5 adversarial evidence records exact polarity guard" +require_contains reviews/PHASE-05/evidence/adversarial-review.txt "PASS: no Phase 5 findings remain open." "Phase 5 adversarial evidence reports no open findings" +require_contains reviews/PHASE-06/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "Phase 6 source evidence reports no failures" +require_contains reviews/PHASE-06/evidence/verify-pins.txt "pin verification summary: 0 fail" "Phase 6 pin evidence reports no failures" +require_contains reviews/PHASE-06/evidence/doctor-workspace.txt "doctor summary: 0 fail" "Phase 6 strict doctor evidence reports no failures" +require_contains reviews/PHASE-06/evidence/validate-skills.txt "skill validation summary: 0 fail" "Phase 6 skill evidence reports no failures" +require_contains reviews/PHASE-06/evidence/lake-build.txt "Build completed successfully" "Phase 6 lake build evidence reports success" +require_contains reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 6 clean-pin canonical baseline reports no failures" +require_contains reviews/PHASE-06/evidence/adversarial-review.txt "PASS: Phase 5 is marked completed before Phase 6 starts." "Phase 6 adversarial evidence records Phase 5 closeout" +require_contains reviews/PHASE-06/evidence/adversarial-review.txt "PASS: expected-divergence polarity remains exact and marker-driven." "Phase 6 adversarial evidence records exact polarity baseline" +require_contains differential/README.md "clean-pin expanded corpus" "differential README records clean-pin expanded corpus status" +require_contains differential/README.md "The directory is not a wildcard" "differential README documents exact expected-divergence markers" +require_not_contains differential/README.md "still intentionally small" "differential README no longer calls the Phase 5 corpus intentionally small" +require_not_contains differential/README.md "corpus is still a reviewed seed" "differential README no longer calls the Phase 5 corpus a seed" +require_not_contains differential/README.md "Current seed bar" "differential README no longer carries the stale seed bar" +require_contains differential/corpus/README.md 'EXPECTED-LLZK-FAIL' "corpus README documents expected LLZK failure polarity" +require_contains differential/corpus/README.md 'EXPECTED-VEIR-FAIL' "corpus README documents expected VEIR failure polarity" +require_contains differential/corpus/README.md 'with `EXPECTED-DIVERGE` marker' "corpus README documents exact output-divergence polarity" + +if grep -q "Phase 5 implementation gate" "${ROOT}/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md" && + grep -q "Clean-pin expanded corpus evidence covers the 15 VeIR Felt rewrite-pattern" "${ROOT}/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md"; then + ok "Phase 5 docs record clean-pin Strategy A corpus expansion" +else + fail "Phase 5 docs do not record clean-pin Strategy A corpus expansion" +fi + +if grep -q "Phase 6: Strategy A Divergence Burn-Down" "${ROOT}/docs/phases/PHASE-06-strategy-a-divergence-burndown.md" && + grep -q "21 pass (incl. expected-diverge), 0 fail" "${ROOT}/docs/phases/PHASE-06-strategy-a-divergence-burndown.md"; then + ok "Phase 6 docs record divergence burn-down baseline" +else + fail "Phase 6 docs do not record divergence burn-down baseline" +fi + +if grep -Fq -- "$ACCEPTED_LLZK_REMOTE" "${ROOT}/reviews/PHASE-02/evidence/llzk-lib-refs.txt"; then + ok "Phase 2 llzk-lib ref evidence records accepted remote" +else + fail "Phase 2 llzk-lib ref evidence does not record accepted remote ${ACCEPTED_LLZK_REMOTE}" +fi + echo echo "doc freshness summary: ${FAIL} fail" if [[ "$FAIL" -ne 0 ]]; then diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh index 4fc43fd..113496f 100755 --- a/scripts/harness/doctor.sh +++ b/scripts/harness/doctor.sh @@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -EXPECTED_LLZK_LEAN_HEAD="ea2363f87bcc" +EXPECTED_LLZK_LEAN_HEAD="617702beadfb" FAIL=0 WARN=0 @@ -15,7 +15,7 @@ usage() { cat <<'USAGE' usage: scripts/harness/doctor.sh [--mode strict|exploratory] [--workspace-veir PATH] -Validates the Phase 1 llzk-lean harness. Strict mode requires a clean +Validates the current llzk-lean harness. Strict mode requires a clean .lake/packages/VeIR checkout at the accepted reproducible pin. Exploratory mode only downgrades an optional workspace VeIR mismatch. USAGE @@ -124,10 +124,15 @@ require_file AGENTS.md require_file docs/phases/PHASE-00-harness-reset.md require_file docs/phases/PHASE-01-pins-and-repro.md require_file docs/phases/PHASE-02-llzk-source-truth.md +require_file docs/phases/PHASE-03-felt-op-gap-ledger.md +require_file docs/phases/PHASE-04-strategy-a-differential.md +require_file docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +require_file docs/phases/PHASE-06-strategy-a-divergence-burndown.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md require_file docs/harness/GATES.md +require_file docs/harness/FELT_OP_GAPS.md require_file docs/harness/LLZK_SOURCE.md require_file docs/harness/PINS.md require_file docs/harness/REVIEWS.md @@ -143,6 +148,22 @@ require_file reviews/PHASE-02/request.md require_file reviews/PHASE-02/findings.md require_file reviews/PHASE-02/disposition.md require_file reviews/PHASE-02/adversarial-review.md +require_file reviews/PHASE-03/request.md +require_file reviews/PHASE-03/findings.md +require_file reviews/PHASE-03/disposition.md +require_file reviews/PHASE-03/adversarial-review.md +require_file reviews/PHASE-04/request.md +require_file reviews/PHASE-04/findings.md +require_file reviews/PHASE-04/disposition.md +require_file reviews/PHASE-04/adversarial-review.md +require_file reviews/PHASE-05/request.md +require_file reviews/PHASE-05/findings.md +require_file reviews/PHASE-05/disposition.md +require_file reviews/PHASE-05/adversarial-review.md +require_file reviews/PHASE-06/request.md +require_file reviews/PHASE-06/findings.md +require_file reviews/PHASE-06/disposition.md +require_file reviews/PHASE-06/adversarial-review.md require_executable scripts/harness/check-doc-freshness.sh require_executable scripts/harness/diff-smoke.sh require_executable scripts/harness/cert-smoke.sh @@ -178,6 +199,30 @@ else fail "missing reviews/PHASE-02/evidence" fi +if [[ -d "${ROOT}/reviews/PHASE-03/evidence" ]]; then + ok "found reviews/PHASE-03/evidence" +else + fail "missing reviews/PHASE-03/evidence" +fi + +if [[ -d "${ROOT}/reviews/PHASE-04/evidence" ]]; then + ok "found reviews/PHASE-04/evidence" +else + fail "missing reviews/PHASE-04/evidence" +fi + +if [[ -d "${ROOT}/reviews/PHASE-05/evidence" ]]; then + ok "found reviews/PHASE-05/evidence" +else + fail "missing reviews/PHASE-05/evidence" +fi + +if [[ -d "${ROOT}/reviews/PHASE-06/evidence" ]]; then + ok "found reviews/PHASE-06/evidence" +else + fail "missing reviews/PHASE-06/evidence" +fi + echo echo "doctor summary: ${FAIL} fail, ${WARN} warn, mode=${MODE}" if [[ "$FAIL" -ne 0 ]]; then diff --git a/scripts/harness/verify-llzk-source.sh b/scripts/harness/verify-llzk-source.sh index 6b8b3b1..6816476 100755 --- a/scripts/harness/verify-llzk-source.sh +++ b/scripts/harness/verify-llzk-source.sh @@ -8,8 +8,26 @@ LLZK_LIB="${ROOT}/../llzk-lib" ACCEPTED_LLZK_COMMIT="db922857bc5a88a9107627ef6b36a8b5e57bc5c2" ACCEPTED_LLZK_SHORT="${ACCEPTED_LLZK_COMMIT:0:12}" ACCEPTED_LLZK_REF="origin/main" +ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" +ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" +ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" FIELD_REGISTRY_PATH="lib/Util/Field.cpp" +LEDGER_PATHS=( + include/llzk/Dialect/Felt/IR/Ops.td + include/llzk/Dialect/Felt/IR/Types.td + include/llzk/Dialect/Felt/IR/Attrs.td + include/llzk/Dialect/Felt/IR/OpInterfaces.td + lib/Dialect/Felt/IR/Ops.cpp + "$FIELD_REGISTRY_PATH" + test/Dialect/Felt/felt_arith_pass.llzk + test/Dialect/Felt/felt_arith_fail.llzk + test/Dialect/Felt/felt_const_fold.llzk + test/Dialect/Felt/felt_spec_pass.llzk + test/Dialect/Felt/types_pass.llzk + unittests/IR/FeltFoldTests.cpp +) + EXPECTED_OPS=( const add @@ -90,17 +108,36 @@ if [[ -f "$ledger" ]]; then else fail "LLZK source ledger does not record ${ACCEPTED_LLZK_COMMIT}" fi + if grep -Fq "$ACCEPTED_LLZK_REMOTE" "$ledger"; then + ok "LLZK source ledger records accepted remote ${ACCEPTED_LLZK_REMOTE}" + else + fail "LLZK source ledger does not record accepted remote ${ACCEPTED_LLZK_REMOTE}" + fi if grep -Fq "$FIELD_REGISTRY_PATH" "$ledger"; then ok "LLZK source ledger records ${FIELD_REGISTRY_PATH}" else fail "LLZK source ledger does not record ${FIELD_REGISTRY_PATH}" fi + for path in "${LEDGER_PATHS[@]}"; do + if grep -Fq "$path" "$ledger"; then + ok "LLZK source ledger records ${path}" + else + fail "LLZK source ledger does not record ${path}" + fi + done else fail "missing docs/harness/LLZK_SOURCE.md" fi if [[ -n "$llzk" && -d "$llzk/.git" ]]; then - echo "accepted LLZK source: ${ACCEPTED_LLZK_COMMIT} (${ACCEPTED_LLZK_REF})" + echo "accepted LLZK source: ${ACCEPTED_LLZK_COMMIT} (${ACCEPTED_LLZK_REF}, ${ACCEPTED_LLZK_REMOTE})" + + origin_url="$(git -C "$llzk" remote get-url origin 2>/dev/null || true)" + if [[ "$origin_url" == "$ACCEPTED_LLZK_REMOTE" ]]; then + ok "llzk-lib origin remote matches ${ACCEPTED_LLZK_REMOTE}" + else + fail "llzk-lib origin remote ${origin_url:-} does not match ${ACCEPTED_LLZK_REMOTE}" + fi if git -C "$llzk" cat-file -e "${ACCEPTED_LLZK_COMMIT}^{commit}" 2>/dev/null; then ok "accepted LLZK commit exists locally" @@ -144,13 +181,20 @@ if [[ -n "$llzk" && -d "$llzk/.git" ]]; then git -C "$llzk" show "${ACCEPTED_LLZK_COMMIT}:$1" 2>/dev/null } - expect_path include/llzk/Dialect/Felt/IR/Ops.td - expect_path include/llzk/Dialect/Felt/IR/Types.td - expect_path include/llzk/Dialect/Felt/IR/Attrs.td - expect_path lib/Dialect/Felt/IR/Ops.cpp - expect_path "$FIELD_REGISTRY_PATH" - expect_path test/Dialect/Felt/felt_arith_pass.llzk - expect_path unittests/IR/FeltFoldTests.cpp + check_source_text() { + local path="$1" + local needle="$2" + local desc="$3" + if get_source "$path" | grep -Fq -- "$needle"; then + ok "$desc" + else + fail "$desc missing" + fi + } + + for path in "${LEDGER_PATHS[@]}"; do + expect_path "$path" + done actual_ops="$( get_source include/llzk/Dialect/Felt/IR/Ops.td | @@ -213,6 +257,26 @@ if [[ -n "$llzk" && -d "$llzk/.git" ]]; then else fail "Felt type source missing optional field-name parameter" fi + + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td 'def LLZK_FeltConstAttr' "Felt attrs source defines FeltConstAttr" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td 'let mnemonic = "const";' "Felt attrs source defines const mnemonic" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td 'def LLZK_FieldSpecAttr' "Felt attrs source defines FieldSpecAttr" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td 'let mnemonic = "field";' "Felt attrs source defines field mnemonic" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td '::mlir::StringAttr getFieldName() const;' "Felt attrs source exposes getFieldName" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td '- grumpkin' "Felt attrs source lists grumpkin as built-in" + check_source_text include/llzk/Dialect/Felt/IR/Attrs.td '- koalabear' "Felt attrs source lists koalabear as built-in" + check_source_text include/llzk/Dialect/Felt/IR/OpInterfaces.td 'def FeltBinaryOpInterface' "Felt op interface source defines binary interface" + check_source_text include/llzk/Dialect/Felt/IR/OpInterfaces.td '"getLhs"' "Felt op interface source exposes getLhs" + check_source_text include/llzk/Dialect/Felt/IR/OpInterfaces.td '"getRhs"' "Felt op interface source exposes getRhs" + check_source_text lib/Dialect/Felt/IR/Ops.cpp 'tryGetBinaryFoldData' "Felt folder source has binary fold data helper" + check_source_text lib/Dialect/Felt/IR/Ops.cpp 'Field::tryGetField' "Felt folder source resolves registered fields" + check_source_text lib/Dialect/Felt/IR/Ops.cpp 'data->field->reduce(data->lhsVal + data->rhsVal)' "Felt folder source reduces add folds" + check_source_text test/Dialect/Felt/felt_arith_fail.llzk "field 'moo' is not defined" "Felt verifier-failure test rejects unknown fields" + check_source_text test/Dialect/Felt/felt_const_fold.llzk 'fold_add_wrap' "Felt fold test covers add wrap-around" + check_source_text test/Dialect/Felt/felt_const_fold.llzk 'felt.sintdiv' "Felt fold test covers signed division" + check_source_text test/Dialect/Felt/felt_spec_pass.llzk '#felt.field<"moo", 7>' "Felt field-spec test covers custom field syntax" + check_source_text test/Dialect/Felt/types_pass.llzk '!felt.type' "Felt type test covers bare felt type syntax" + check_source_text unittests/IR/FeltFoldTests.cpp 'AddNoFoldUnspecified' "Felt unit tests cover unspecified-field no-fold" fi check_local_text() { @@ -242,6 +306,68 @@ check_field_list checker/src/CertChecker.cpp "checker registry comment block" check_field_list docs/strategy-a-oracle.md "Strategy A registered-field source claim" check_field_list docs/harness/LLZK_SOURCE.md "LLZK source ledger" +check_felt_prime_file() { + local path="$1" + local desc="$2" + if [[ ! -f "$path" ]]; then + fail "${desc} feltPrime file is missing at ${path}" + return + fi + + if grep -Fq "lib/Util/Field.cpp::initKnownFields" "$path"; then + ok "${desc} feltPrime cites current LLZK registry path" + else + fail "${desc} feltPrime does not cite lib/Util/Field.cpp::initKnownFields" + fi + for entry in bn128 bn254 grumpkin babybear goldilocks mersenne31 koalabear; do + if grep -Fq "$entry" "$path"; then + ok "${desc} feltPrime mentions ${entry}" + else + fail "${desc} feltPrime missing ${entry}" + fi + done + + check_felt_prime_case() { + local field="$1" + local prime="$2" + if awk -v field="$field" -v prime="$prime" ' + $0 ~ "if n = \"" field "\"\\.toUTF8 then" { + found = 1 + if ($0 ~ "some[[:space:]]+" prime) { + matched = 1 + } else if ((getline nextline) > 0 && nextline ~ "some[[:space:]]+" prime) { + matched = 1 + } + } + END { exit(found && matched ? 0 : 1) } + ' "$path"; then + ok "${desc} feltPrime maps ${field} to accepted prime" + else + fail "${desc} feltPrime does not map ${field} to accepted prime ${prime}" + fi + } + check_felt_prime_case "bn254" "21888242871839275222246405745257275088548364400416034343698204186575808495617" + check_felt_prime_case "bn128" "21888242871839275222246405745257275088548364400416034343698204186575808495617" + check_felt_prime_case "grumpkin" "21888242871839275222246405745257275088696311157297823662689037894645226208583" + check_felt_prime_case "babybear" "2013265921" + check_felt_prime_case "goldilocks" "18446744069414584321" + check_felt_prime_case "mersenne31" "2147483647" + check_felt_prime_case "koalabear" "2130706433" +} + +veir_dep="${ROOT}/.lake/packages/VeIR" +if [[ -d "${veir_dep}/.git" ]]; then + dep_head="$(git -C "$veir_dep" rev-parse HEAD 2>/dev/null || true)" + if [[ "$dep_head" == "$ACCEPTED_VEIR_COMMIT" ]]; then + ok "pinned VeIR dependency HEAD is ${ACCEPTED_VEIR_SHORT}" + else + fail "pinned VeIR dependency HEAD ${dep_head:-} does not match ${ACCEPTED_VEIR_COMMIT}" + fi +else + fail "pinned VeIR dependency checkout missing at ${veir_dep}" +fi +check_felt_prime_file "${veir_dep}/Veir/Passes/Felt/InterpModel.lean" "pinned VeIR dependency" + check_local_text docs/strategy-e-certificates.md '"sameAttr"' "Strategy E documents sameAttr side condition" check_local_text docs/strategy-e-certificates.md '"attrInRegistry"' "Strategy E documents attrInRegistry side condition" check_local_text LlzkLean/Cert.lean '(patternId := "constant_fold_add")' "Lean cert catalog contains constant_fold_add" diff --git a/scripts/harness/verify-pins.sh b/scripts/harness/verify-pins.sh index 56eb66d..393f745 100755 --- a/scripts/harness/verify-pins.sh +++ b/scripts/harness/verify-pins.sh @@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -ACCEPTED_VEIR_COMMIT="d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3" +ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" ACCEPTED_VEIR_REMOTE="https://github.com/project-llzk/veir.git" ACCEPTED_VEIR_BRANCH="felt-review-structural-close" diff --git a/skills/cert-checker-review/SKILL.md b/skills/cert-checker-review/SKILL.md index bf2eef5..58c5f28 100644 --- a/skills/cert-checker-review/SKILL.md +++ b/skills/cert-checker-review/SKILL.md @@ -7,7 +7,8 @@ or MLIR matcher status. ## Procedure -- Use `scripts/harness/cert-smoke.sh` for Phase 0 smoke status. +- Use `scripts/harness/cert-smoke.sh` for smoke classification; do not treat + the smoke result as Phase 1 acceptance evidence. - Distinguish schema validation, theorem metadata coverage, driver behavior, and MLIR matcher coverage. - Treat MLIR matcher absence as a reported status, not as runtime verification. diff --git a/skills/lean-axiom-audit/SKILL.md b/skills/lean-axiom-audit/SKILL.md index 7da0ff0..ad623f8 100644 --- a/skills/lean-axiom-audit/SKILL.md +++ b/skills/lean-axiom-audit/SKILL.md @@ -8,11 +8,11 @@ Use this skill when reviewing Lean proof files, theorem claims, `axiom`, or ## Procedure - Audit the actual dependency checkout, not just the Lake pin. -- Record exact files and command evidence under `reviews/PHASE-00/evidence/` - when the claim affects Phase 0. +- Record exact files and command evidence under the active phase review + directory, e.g. `reviews/PHASE-01/evidence/` for the current pin phase. - Do not treat dirty proof files as release evidence. ## Validation Run `scripts/harness/validate-skills.sh` and -`scripts/harness/doctor.sh --mode exploratory`. +`scripts/harness/doctor.sh --workspace-veir ../veir`. diff --git a/skills/llzk-lean-dependency-audit/SKILL.md b/skills/llzk-lean-dependency-audit/SKILL.md index 2905f2d..6170f64 100644 --- a/skills/llzk-lean-dependency-audit/SKILL.md +++ b/skills/llzk-lean-dependency-audit/SKILL.md @@ -7,13 +7,14 @@ the workspace VeIR checkout. ## Procedure -- Start from `docs/harness/CURRENT.md` and `docs/harness/SOURCES.md`. +- Start from `docs/harness/CURRENT.md`, `docs/harness/SOURCES.md`, and + `docs/harness/PINS.md`. - Compare `lakefile.toml`, `lake-manifest.json`, and the actual dependency - checkout. -- Treat dirty dependency state as exploratory unless a phase explicitly accepts - it. + checkout, including remote URL, manifest `type`, `rev`, and `inputRev`. +- Treat dirty dependency state as exploratory only; it is not acceptance + evidence. ## Validation -Run `scripts/harness/doctor.sh` or -`scripts/harness/doctor.sh --mode exploratory`. +Run `scripts/harness/verify-pins.sh --workspace-veir ../veir` and +`scripts/harness/doctor.sh --workspace-veir ../veir`. diff --git a/skills/mlir-differential/SKILL.md b/skills/mlir-differential/SKILL.md index e4ceb03..20232dd 100644 --- a/skills/mlir-differential/SKILL.md +++ b/skills/mlir-differential/SKILL.md @@ -6,7 +6,8 @@ Use this skill when running or reviewing Strategy A differential checks. ## Procedure -- Use `scripts/harness/diff-smoke.sh` for Phase 0 smoke status. +- Use `scripts/harness/diff-smoke.sh` for smoke classification; do not treat + the smoke result as Phase 1 acceptance evidence. - Classify missing tools, parse failures, pass failures, semantic divergence, and expected divergence separately. - Do not treat a missing `llzk-opt` skip as coverage. diff --git a/skills/phase-bootstrap/SKILL.md b/skills/phase-bootstrap/SKILL.md index 08db1f2..2ca14fd 100644 --- a/skills/phase-bootstrap/SKILL.md +++ b/skills/phase-bootstrap/SKILL.md @@ -8,7 +8,8 @@ Use this skill when creating or closing a phase bootstrap file. - Start from `docs/phases/PHASE_TEMPLATE.md`. - Update `docs/harness/CURRENT.md`, `docs/harness/SOURCES.md`, and - `docs/harness/GATES.md` with exact refs and dependency mode. + `docs/harness/GATES.md` with exact refs and dependency mode; update + `docs/harness/PINS.md` when the phase changes dependency state. - Create `reviews//request.md`, `findings.md`, `disposition.md`, and `evidence/`. @@ -16,4 +17,4 @@ Use this skill when creating or closing a phase bootstrap file. Run `scripts/harness/check-doc-freshness.sh`, `scripts/harness/validate-skills.sh`, and -`scripts/harness/doctor.sh --mode exploratory`. +`scripts/harness/doctor.sh --workspace-veir ../veir`. From 8d035c224538c3cbe8905aa5dca38cf63615fce9 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 16:32:48 +0100 Subject: [PATCH 08/16] Burn down DCE-only Strategy A divergences --- differential/README.md | 20 ++++++++----- differential/corpus/README.md | 18 +++++++----- .../canonical/registered_add_fold.llzk | 13 --------- .../canonical => felt}/constant_fold_mul.llzk | 7 +++-- .../canonical => felt}/constant_fold_sub.llzk | 7 +++-- .../corpus/felt/registered_add_fold.llzk | 12 ++++++++ differential/run-differential.sh | 2 +- docs/harness/CURRENT.md | 26 ++++++++++------- docs/harness/FELT_OP_GAPS.md | 2 +- docs/harness/GATES.md | 18 ++++++------ docs/harness/PINS.md | 11 +++---- docs/harness/SOURCES.md | 6 ++-- ...PHASE-06-strategy-a-divergence-burndown.md | 29 +++++++++++++++---- docs/strategy-a-oracle.md | 23 +++++++-------- lake-manifest.json | 4 +-- lakefile.toml | 2 +- reviews/PHASE-06/adversarial-review.md | 21 ++++++++++---- reviews/PHASE-06/disposition.md | 8 ++++- reviews/PHASE-06/evidence/README.md | 2 +- .../PHASE-06/evidence/adversarial-review.txt | 9 ++++-- .../PHASE-06/evidence/check-doc-freshness.txt | 1 + .../differential-clean-pin-canonicalize.txt | 6 ++-- .../PHASE-06/evidence/doctor-workspace.txt | 17 ++++++----- reviews/PHASE-06/evidence/lake-build.txt | 3 +- reviews/PHASE-06/evidence/validate-skills.txt | 1 + .../PHASE-06/evidence/verify-llzk-source.txt | 3 +- reviews/PHASE-06/evidence/verify-pins.txt | 15 +++++----- reviews/PHASE-06/findings.md | 19 +++++++++++- reviews/PHASE-06/request.md | 10 +++++-- scripts/harness/check-doc-freshness.sh | 2 +- scripts/harness/doctor.sh | 11 ++++--- scripts/harness/verify-llzk-source.sh | 2 +- scripts/harness/verify-pins.sh | 2 +- 33 files changed, 208 insertions(+), 124 deletions(-) delete mode 100644 differential/corpus/expected-divergence/canonical/registered_add_fold.llzk rename differential/corpus/{expected-divergence/canonical => felt}/constant_fold_mul.llzk (51%) rename differential/corpus/{expected-divergence/canonical => felt}/constant_fold_sub.llzk (51%) create mode 100644 differential/corpus/felt/registered_add_fold.llzk diff --git a/differential/README.md b/differential/README.md index 955bd4c..2607e7a 100644 --- a/differential/README.md +++ b/differential/README.md @@ -12,13 +12,15 @@ specific corpus and reporting. ## Status -**Canonicalization-aware, clean-pin expanded corpus.** +**Canonicalization-aware, clean-pin expanded corpus with Phase 6 burn-down.** `run-differential.sh` wraps VEIR's script, supports parse/print mode and canonicalization mode, and classifies output divergence, LLZK failure, VEIR failure, missing tools, and mode-skipped corpus entries -separately. The Phase 5 clean-pin corpus covers all 15 current VeIR -Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, but it is -not full Strategy A acceptance coverage. +separately. The Phase 6 clean-pin corpus covers all 15 current VeIR +Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, with +registered add/sub/mul constant folds reclassified to PASS after VeIR +canonical mode started running `felt-combine,dce`. This is not full +Strategy A acceptance coverage. ## Running locally @@ -29,7 +31,7 @@ lake build # Builds llzk-lean's own Lean code export LLZK_OPT=/path/to/llzk-opt ./differential/run-differential.sh -# Phase 5 clean-pin canonical evidence path: +# Phase 6 clean-pin canonical evidence path: ./differential/run-differential.sh --canonicalize differential/corpus # Historical Phase 4 workspace implementation run: @@ -70,14 +72,18 @@ non-zero if any input lands in the FAIL column. ## Corpus expansion targets -Current Phase 5 bar: +Current Phase 6 bar: - `corpus/felt/const_identities.mlir` — live const proof-of-life. - `corpus/felt/types_smoke.llzk` — custom-asm lowering smoke. - `corpus/felt/arithmetic_no_fold.llzk` — canonical no-fire arithmetic. - `corpus/felt/add_const_swap.llzk` — positive coverage for the current rewrite pattern that both tools normalize the same way. +- `corpus/felt/registered_add_fold.llzk`, + `corpus/felt/constant_fold_sub.llzk`, and + `corpus/felt/constant_fold_mul.llzk` — Phase 6 positives closed by the + clean `felt-combine,dce` pipeline. - `corpus/expected-divergence/canonical/*` — classified clean-pin - canonicalization gaps for DCE, modular reduction, field-registry + canonicalization gaps for modular reduction, field-registry preconditions, and VeIR-only algebraic rewrites. - `corpus/README.md` — the current 21-input inventory and 15-pattern rewrite coverage matrix. diff --git a/differential/corpus/README.md b/differential/corpus/README.md index 09e9ac5..1a7af9e 100644 --- a/differential/corpus/README.md +++ b/differential/corpus/README.md @@ -79,16 +79,16 @@ produced no parse/print or canonicalization evidence. | `felt/const_identities.mlir` | PASS | Generic-form live FeltConstAttr round-trip with unnamed `!felt.type`; passes parse/print and canonicalization | | `felt/types_smoke.llzk` | PASS | LLZK custom-asm function type smoke; reclassified from expected divergence after normalizer fixes | | `felt/arithmetic_no_fold.llzk` | PASS | Canonical no-fire coverage for live add/sub/mul/neg over non-constant inputs | +| `felt/registered_add_fold.llzk` | PASS | Registered-field add folds to 12; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | +| `felt/constant_fold_sub.llzk` | PASS | Registered-field subtraction folds to 5; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | +| `felt/constant_fold_mul.llzk` | PASS | Registered-field multiplication folds to 42; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | | `expected-divergence/named_field_const.mlir` | EXPECTED-LLZK-FAIL | Generic named-field FeltConstAttr still fails on LLZK's parser/verifier path | | `expected-divergence/canonical/add_neg_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + (-x)` to zero; LLZK leaves the non-constant add/neg pair in place | | `expected-divergence/canonical/add_sub_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c) - c` to `x`; LLZK leaves the add/sub pair in place | | `expected-divergence/canonical/assoc_const_fold_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c1) + c2` to `x + (c1 + c2)`; LLZK leaves the nested add chain in place | | `expected-divergence/canonical/assoc_const_fold_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x * c1) * c2` to `x * (c1 * c2)`; LLZK leaves the nested multiplication chain in place | -| `expected-divergence/canonical/constant_fold_mul.llzk` | EXPECTED-DIVERGE | Both tools fold registered multiplication, but LLZK also erases now-dead input constants while VeIR `felt-combine` does not run DCE | | `expected-divergence/canonical/constant_fold_neg.llzk` | EXPECTED-DIVERGE | LLZK reduces registered negation modulo babybear; VeIR currently emits the raw integer | -| `expected-divergence/canonical/constant_fold_sub.llzk` | EXPECTED-DIVERGE | Both tools fold registered subtraction, but LLZK also erases now-dead input constants while VeIR `felt-combine` does not run DCE | | `expected-divergence/canonical/neg_neg_to_self.llzk` | EXPECTED-DIVERGE | VeIR rewrites double negation to `x`; LLZK leaves the outer negation chain in place | -| `expected-divergence/canonical/registered_add_fold.llzk` | EXPECTED-DIVERGE | Both tools fold registered add, but LLZK also erases now-dead input constants while VEIR `felt-combine` does not run DCE | | `expected-divergence/canonical/registered_add_wrap.llzk` | EXPECTED-DIVERGE | LLZK reduces registered-field fold results modulo babybear; VEIR currently emits the raw integer | | `expected-divergence/canonical/right_identity_one_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 1` to `x`; LLZK leaves the non-constant multiplication in place | | `expected-divergence/canonical/right_identity_zero_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + 0` to `x`; LLZK leaves the non-constant add in place | @@ -97,13 +97,15 @@ produced no parse/print or canonicalization evidence. | `expected-divergence/canonical/sub_add_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x - c) + c` to `x`; LLZK leaves the sub/add pair in place | | `expected-divergence/canonical/unspecified_add_fold.llzk` | EXPECTED-DIVERGE | LLZK skips bare `!felt.type` binary folds; VEIR currently folds them | -The current clean-pin canonical run reports: +The current Phase 6 clean-pin canonical corpus records 7 PASS cases, +13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` +parser/verifier gap. The run reports: ```text Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) ``` -## Phase 5 rewrite-pattern coverage +## Phase 6 rewrite-pattern coverage This matrix tracks coverage against the 15 `Veir.FeltPass` rewrite-pattern definitions. It is not a Strategy A acceptance claim: `EXPECTED-DIVERGE` means @@ -113,13 +115,13 @@ gate. | VeIR pattern | Corpus status | Corpus file | |---|---|---| | `right_identity_zero_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_zero_add.llzk` | -| `constant_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/registered_add_fold.llzk` | +| `constant_fold_add` | PASS | `felt/registered_add_fold.llzk` | | `self_subtraction_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/self_subtraction_to_zero.llzk` | | `assoc_const_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/assoc_const_fold_add.llzk` | | `right_identity_one_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_one_mul.llzk` | | `right_zero_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_zero_mul.llzk` | -| `constant_fold_sub` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_sub.llzk` | -| `constant_fold_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_mul.llzk` | +| `constant_fold_sub` | PASS | `felt/constant_fold_sub.llzk` | +| `constant_fold_mul` | PASS | `felt/constant_fold_mul.llzk` | | `constant_fold_neg` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_neg.llzk` | | `add_neg_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/add_neg_to_zero.llzk` | | `neg_neg_to_self` | EXPECTED-DIVERGE | `expected-divergence/canonical/neg_neg_to_self.llzk` | diff --git a/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk b/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk deleted file mode 100644 index 1eed4e0..0000000 --- a/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk +++ /dev/null @@ -1,13 +0,0 @@ -// EXPECTED-DIVERGE in canonicalization mode. -// -// Both tools fold the registered-field add to 12, but their pipelines are not -// observationally aligned yet: LLZK's canonicalizer removes the now-dead input -// constants, while VEIR's `felt-combine` does not run DCE. This is a Phase 4 -// Strategy A pipeline gap, not a parser failure. - -function.def @fold_add() -> !felt.type<"babybear"> { - %a = felt.const 5 : !felt.type<"babybear"> - %b = felt.const 7 : !felt.type<"babybear"> - %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> - function.return %c : !felt.type<"babybear"> -} diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk b/differential/corpus/felt/constant_fold_mul.llzk similarity index 51% rename from differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk rename to differential/corpus/felt/constant_fold_mul.llzk index e81231e..6480536 100644 --- a/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk +++ b/differential/corpus/felt/constant_fold_mul.llzk @@ -1,7 +1,8 @@ -// EXPECTED-DIVERGE in canonicalization mode. +// Canonical positive for registered-field multiplication folding. // -// Both tools fold the multiplication to 42, but LLZK also erases the now-dead -// input constants while VeIR `felt-combine` does not run DCE. +// Phase 6 reclassified this from expected divergence after VeIR canonical +// differential mode started running `felt-combine,dce`, matching LLZK's +// removal of now-dead input constants. function.def @fold_mul() -> !felt.type<"babybear"> { %a = felt.const 6 : !felt.type<"babybear"> diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk b/differential/corpus/felt/constant_fold_sub.llzk similarity index 51% rename from differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk rename to differential/corpus/felt/constant_fold_sub.llzk index e7dd5bc..dcfb0f5 100644 --- a/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk +++ b/differential/corpus/felt/constant_fold_sub.llzk @@ -1,7 +1,8 @@ -// EXPECTED-DIVERGE in canonicalization mode. +// Canonical positive for registered-field subtraction folding. // -// Both tools fold the subtraction to 5, but LLZK also erases the now-dead -// input constants while VeIR `felt-combine` does not run DCE. +// Phase 6 reclassified this from expected divergence after VeIR canonical +// differential mode started running `felt-combine,dce`, matching LLZK's +// removal of now-dead input constants. function.def @fold_sub() -> !felt.type<"babybear"> { %a = felt.const 9 : !felt.type<"babybear"> diff --git a/differential/corpus/felt/registered_add_fold.llzk b/differential/corpus/felt/registered_add_fold.llzk new file mode 100644 index 0000000..ab4edc5 --- /dev/null +++ b/differential/corpus/felt/registered_add_fold.llzk @@ -0,0 +1,12 @@ +// Canonical positive for registered-field addition folding. +// +// Phase 6 reclassified this from expected divergence after VeIR canonical +// differential mode started running `felt-combine,dce`, matching LLZK's +// removal of now-dead input constants. + +function.def @fold_add() -> !felt.type<"babybear"> { + %a = felt.const 5 : !felt.type<"babybear"> + %b = felt.const 7 : !felt.type<"babybear"> + %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/run-differential.sh b/differential/run-differential.sh index 6bc1cad..6e1c137 100755 --- a/differential/run-differential.sh +++ b/differential/run-differential.sh @@ -21,7 +21,7 @@ # VEIR_DIFF=/path use an explicit VEIR scripts/llzk-diff.sh. By default # the clean pinned Lake dependency is used. # CANONICALIZE=1 pass --canonicalize to llzk-diff.sh so it compares -# `llzk-opt --canonicalize` with `veir-opt -p=felt-combine`. +# `llzk-opt --canonicalize` with `veir-opt -p=felt-combine,dce`. # LOWER_FIRST=1 force --lower-first for every input. The wrapper already # applies --lower-first automatically to .llzk inputs. # diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index 1314130..bf3491b 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -4,7 +4,7 @@ Last reviewed: 2026-06-10 ## Active Phase -- Active phase: Phase 6, Strategy A divergence burn-down bootstrap. +- Active phase: Phase 6, Strategy A divergence burn-down. - Phase bootstrap file: `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. - Companion repository: `../veir`. - Companion phase file: `../veir/docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. @@ -12,7 +12,7 @@ Last reviewed: 2026-06-10 ## Accepted VeIR Pin - Accepted VeIR commit: - `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. - Accepted source branch: `felt-review-structural-close`. - Accepted source remote: `https://github.com/project-llzk/veir.git`. - Pin mode: remote commit, consumed through Lake metadata and a clean @@ -74,10 +74,12 @@ the clean dependency checkout remains the source of truth. Phase 4 reviewed workspace canonicalization evidence for the seed corpus. Phase 5 consumed the canonicalization-aware VeIR driver through the clean dependency pin and recorded the expanded 21-input canonical corpus on that - path. Phase 6 starts from that exact-polarity baseline. The corpus covers all - 15 current VeIR Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, - plus one EXPECTED-LLZK-FAIL parser/verifier gap, but this is not full - Strategy A acceptance. + path. Phase 6 starts from that exact-polarity baseline and has reclassified + the DCE-only registered add/sub/mul fold cases after the clean VeIR driver + began running `felt-combine,dce`. The corpus covers all 15 current VeIR Felt + rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, plus one + EXPECTED-LLZK-FAIL parser/verifier gap, but this is not full Strategy A + acceptance. - The local `../llzk-lib` worktree is behind fetched `origin/main`. Current source claims use `git show origin/main:...` at `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`, not stale worktree files. @@ -85,8 +87,9 @@ the clean dependency checkout remains the source of truth. differential coverage through a workspace `VEIR_DIFF` override. Phase 5 pinned the canonicalization-aware VeIR driver, recorded expanded corpus evidence on the clean dependency path, and fixed expected-divergence polarity to exact - file-header markers. Phase 6 is the divergence burn-down bootstrap for that - baseline. + file-header markers. Phase 6's first burn-down target aligns VeIR's canonical + diff path with LLZK's dead-input cleanup by consuming the DCE-enabled VeIR + pin. ## Acceptance Rule @@ -107,6 +110,7 @@ Phase 6 bootstrap is current only when: - `scripts/harness/validate-skills.sh` passes. Phase 6 implementation evidence additionally requires reducing or reclassifying -expected divergences without weakening the clean-pin canonical baseline. Until a -Phase 6 implementation deliberately changes that matrix, the current clean-pin -canonical run remains `21 pass (incl. expected-diverge), 0 fail`. +expected divergences without weakening the clean-pin canonical baseline. The +current clean-pin canonical run remains `21 pass (incl. expected-diverge), 0 +fail` and records 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 +`EXPECTED-LLZK-FAIL` parser/verifier gap. diff --git a/docs/harness/FELT_OP_GAPS.md b/docs/harness/FELT_OP_GAPS.md index 7fe9132..3e49e01 100644 --- a/docs/harness/FELT_OP_GAPS.md +++ b/docs/harness/FELT_OP_GAPS.md @@ -11,7 +11,7 @@ Last reviewed: 2026-06-10 `git@github.com:project-llzk/llzk-lib.git`. - Consumed VeIR dependency: `.lake/packages/VeIR` at - `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. - Current certificate catalog: `LlzkLean/Cert.lean` and `certs/felt-combine.cert.json`. - Current differential corpus: diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index a1fab45..924d9b1 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -19,7 +19,7 @@ Last reviewed: 2026-06-10 | Skill validation | `scripts/harness/validate-skills.sh` | Passes when repo-local skills have required sections | Repo-local skills remain auditable | | Phase 4 workspace differential gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus` | Runs workspace VeIR's canonicalization-aware diff script over the reviewed seed corpus | Initial Phase 4 evidence exists, but remains workspace evidence until the clean VeIR dependency pin consumes the updated script | | Phase 5 clean-pin implementation gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` override | The canonicalization-aware diff script has been consumed through a clean dependency pin and supports the Phase 6 divergence burn-down baseline | -| Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Remains `21 pass (incl. expected-diverge), 0 fail` until a reviewed Phase 6 change reduces or reclassifies a divergence | Prevents Phase 6 from starting on a weakened Strategy A baseline | +| Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Reports `21 pass (incl. expected-diverge), 0 fail` with 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap | Confirms Phase 6 reduced the expected-divergence matrix without weakening the clean-pin baseline | ## Reproducible-Pin Failures @@ -98,7 +98,7 @@ Last reviewed: 2026-06-10 `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and `koalabear` as recorded in `docs/harness/LLZK_SOURCE.md`. - `.lake/packages/VeIR` is missing, not at - `220cd215579b435c3c22ce86b34a3f4ce2ca276e`, or its + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`, or its `Veir/Passes/Felt/InterpModel.lean` `feltPrime` mirror disagrees with the accepted LLZK field registry. - Checker registry comments omit an accepted built-in field. @@ -110,9 +110,9 @@ Last reviewed: 2026-06-10 `https://github.com/project-llzk/veir.git`. - `lake-manifest.json` does not record VeIR as a `git` dependency. - Either Lake file names a commit other than - `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. - `lake-manifest.json` records a VeIR `inputRev` other than - `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. - `.lake/packages/VeIR` HEAD differs from the manifest rev. - `.lake/packages/VeIR` has any modified, deleted, staged, or untracked file. - A supplied workspace VeIR path neither equals nor descends from the accepted @@ -129,8 +129,8 @@ The current harness does not prove: - Full Lean proof audit beyond buildability of the selected pin. - CI coverage when external tooling is missing. - Missing Felt operation semantics beyond the registry source facts. -- Phase 6 divergence burn-down has not yet reduced expected divergences. Phase 5 - clean-pin corpus evidence expands the Felt rewrite-pattern matrix but does not - expand certificates, complete all Strategy A corpus coverage, or port missing - operations. Phase 4 workspace evidence remains historical seed evidence; Phase - 6 implementation evidence must preserve the clean dependency baseline. +- Phase 6 divergence burn-down has reduced the DCE-only expected divergences, + but this does not expand certificates, complete all Strategy A corpus + coverage, or port missing operations. Phase 4 workspace evidence remains + historical seed evidence; Phase 6 implementation evidence must preserve the + clean dependency baseline. diff --git a/docs/harness/PINS.md b/docs/harness/PINS.md index 0920081..7023c86 100644 --- a/docs/harness/PINS.md +++ b/docs/harness/PINS.md @@ -4,8 +4,8 @@ Last reviewed: 2026-06-10 ## Accepted VeIR Pin -- Commit: `220cd215579b435c3c22ce86b34a3f4ce2ca276e` -- Short ref: `220cd215579b` +- Commit: `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` +- Short ref: `a0bb2fc8e6d3` - Remote: `https://github.com/project-llzk/veir.git` - Branch at selection time: `felt-review-structural-close` - Mode: remote commit pinned through Lake metadata and a clean Lake package @@ -16,9 +16,10 @@ This commit is a descendant of the Phase 2 accepted pin the Phase 1 accepted pin `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. This pin preserves the Phase 2 VeIR field-registry update and source-truth -gate, and adds the Phase 5 canonicalization-aware `scripts/llzk-diff.sh` -driver consumed by the default llzk-lean dependency checkout. The script uses a -built `.lake/build/bin/veir-opt` when present and falls back to `lake exec`. +gate, preserves the Phase 5 canonicalization-aware `scripts/llzk-diff.sh` +driver consumed by the default llzk-lean dependency checkout, and adds the +Phase 6 DCE-enabled canonical differential path. The script uses a built +`.lake/build/bin/veir-opt` when present and falls back to `lake exec`. ## Required State diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md index 97ab7a3..7a09e3f 100644 --- a/docs/harness/SOURCES.md +++ b/docs/harness/SOURCES.md @@ -7,7 +7,7 @@ Last reviewed: 2026-06-10 | Source | Ref or retrieval | Use | |---|---:|---| | `docs/phases/PHASE-01-pins-and-repro.md` | local file, 2026-06-05 | Phase 1 objective, artifacts, gates, done criteria | -| Accepted VeIR pin | `220cd215579b435c3c22ce86b34a3f4ce2ca276e` | Dependency commit consumed by llzk-lean | +| Accepted VeIR pin | `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` | Dependency commit consumed by llzk-lean | | Accepted VeIR branch | `felt-review-structural-close` | Remote branch containing the accepted commit | | Accepted VeIR remote | `https://github.com/project-llzk/veir.git` | Canonical source repository for the accepted pin | | `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | @@ -30,13 +30,13 @@ Last reviewed: 2026-06-10 | `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` | local file, 2026-06-10 | Phase 6 divergence burn-down objective, artifacts, gates, and done criteria | | `differential/run-differential.sh` | local file, 2026-06-09 | llzk-lean corpus wrapper around the consumed VeIR diff script | | `differential/corpus/` | local files, 2026-06-09 | Current Strategy A corpus and expected-divergence classification | -| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support | +| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support; Phase 6 canonical mode runs `felt-combine,dce` | | Workspace VeIR `scripts/llzk-diff.sh` | `../veir/scripts/llzk-diff.sh`, local file, 2026-06-09 | Phase 4 canonicalization-aware driver used explicitly through `VEIR_DIFF=../veir/scripts/llzk-diff.sh` | | Phase 4 canonical differential evidence | `reviews/PHASE-04/evidence/differential-canonicalize.txt` | Reviewed workspace Strategy A seed evidence; not clean-pin acceptance | | Phase 4 fresh adversarial review evidence | `reviews/PHASE-04/evidence/adversarial-review-fresh.txt` | Confirms Phase 4 wrapper findings were resolved before Phase 5 | | Phase 5 clean-pin canonical differential evidence | `reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt` | Expanded corpus canonical run through the default clean dependency driver | | Phase 5 exact-polarity guard evidence | `reviews/PHASE-05/evidence/polarity-guard.txt` | Proves a canonical `EXPECTED-DIVERGE` input fails on the wrong LLZK failure mode | -| Phase 6 bootstrap review workspace | `reviews/PHASE-06/` | Active Phase 6 request, findings, disposition, adversarial review, and evidence | +| Phase 6 review workspace | `reviews/PHASE-06/` | Active Phase 6 request, findings, disposition, adversarial review, implementation evidence, and burn-down disposition | | Accepted local `llzk-opt` binary | `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt` | LLZK executable for Strategy A differential testing | | Local LLVM/MLIR checkout | `/home/alh/llvm-project` at `49f12af164138123589263fe75ea5f1d356e8780` | Source and build tree for local MLIR/LLVM testing support | | Local `mlir-opt` | `/home/alh/llvm-project/build/bin/mlir-opt`, version `23.0.0git` | Local MLIR tool available for Strategy A testing | diff --git a/docs/phases/PHASE-06-strategy-a-divergence-burndown.md b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md index 6280ef9..867ee2b 100644 --- a/docs/phases/PHASE-06-strategy-a-divergence-burndown.md +++ b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md @@ -22,7 +22,7 @@ the next implementation target explicit. `617702beadfbad6be784945e2bd98e8a788d357c`. - Workspace VeIR HEAD at Phase 6 bootstrap: `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. -- Consumed VeIR dependency pin remains: +- Consumed VeIR dependency pin at bootstrap: `220cd215579b435c3c22ce86b34a3f4ce2ca276e`. - Accepted LLZK source commit remains: `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. @@ -32,6 +32,22 @@ the next implementation target explicit. - Phase 5 final review fixed exact expected-divergence polarity so a canonical output-divergence test no longer passes on a wrong LLZK/VEIR failure mode. +## Phase 6 Implementation Update + +- First burn-down VeIR commit: + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. +- llzk-lean now consumes that clean VeIR pin through Lake metadata and a clean + `.lake/packages/VeIR` checkout. +- VeIR canonical differential mode now compares `llzk-opt --canonicalize` + against `veir-opt -p=felt-combine,dce`, aligning VeIR's diff path with + LLZK's dead-input cleanup after constant folds. +- The clean-pin corpus still has 21 inputs and `0 fail`, but the classification + is now 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and + 1 `EXPECTED-LLZK-FAIL` named-field parser/verifier gap. +- Reclassified positives: + `felt/registered_add_fold.llzk`, `felt/constant_fold_sub.llzk`, and + `felt/constant_fold_mul.llzk`. + ## Non-Goals - Do not change the accepted LLZK source commit or field-registry facts. @@ -52,6 +68,8 @@ the next implementation target explicit. exact-polarity closeout evidence. - `docs/harness/GATES.md`: document Phase 6 bootstrap and divergence burn-down gates. +- `lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR`: consume the + Phase 6 DCE-enabled VeIR pin. - `scripts/harness/check-doc-freshness.sh`: require Phase 6 to be active while preserving Phase 2 through Phase 5 evidence checks. - `scripts/harness/doctor.sh`: require Phase 6 docs and review workspace. @@ -76,8 +94,8 @@ the next implementation target explicit. `lake build` succeeds. - Strategy A baseline: `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` - remains `21 pass (incl. expected-diverge), 0 fail` until Phase 6 deliberately - reduces or reclassifies a divergence. + reports `21 pass (incl. expected-diverge), 0 fail` with the Phase 6 + reclassification above. ## Review Requirements @@ -97,5 +115,6 @@ the next implementation target explicit. closeout evidence. - Freshness, source truth, pin verification, strict doctor, skill validation, `lake build`, and the clean-pin canonical differential baseline pass. -- The first Phase 6 implementation target is explicit: reduce or reclassify at - least one expected divergence without broadening unproved Strategy A claims. +- The first Phase 6 implementation target is complete: reclassify the three + DCE-only constant-fold divergences without broadening unproved Strategy A + claims. diff --git a/docs/strategy-a-oracle.md b/docs/strategy-a-oracle.md index 3cf55f9..a62c721 100644 --- a/docs/strategy-a-oracle.md +++ b/docs/strategy-a-oracle.md @@ -14,7 +14,7 @@ The harness supports two modes: - parse/print mode: both tools parse the input and emit generic MLIR, which is then normalized and compared. - canonicalization mode: `llzk-opt --canonicalize` is compared against - `veir-opt -p=felt-combine`. + `veir-opt -p=felt-combine,dce`. The workspace VeIR script now implements canonicalization mode. Until llzk-lean bumps its clean VeIR pin, llzk-lean runs this implementation @@ -61,8 +61,8 @@ The Phase 4 ordering is now: - Enable canonicalization in the diff script and classify the first canonical divergences. - Add field-registry and modular-reduction parity on VEIR's side so - constant-fold corpus cases can move from expected-divergence to - positive coverage. + remaining modular-reduction corpus cases can move from expected-divergence + to positive coverage. Without that ordering, named-field corpus additions will mostly document the known modular-reduction gap rather than demonstrate alignment. @@ -118,20 +118,19 @@ Current state (2026-06-09): sorry-free and axiom-clean under the accepted Phase 1 pin. This still does not close the theorem↔pattern or IR-semantics joints; see `docs/REVIEW.md`. -- ✅ Workspace harness has a canonicalization mode. llzk-lean acceptance still - needs either an explicit reviewed `VEIR_DIFF=../veir/scripts/llzk-diff.sh` - run or a clean VeIR pin bump. +- ✅ Clean-pin harness has a canonicalization mode. Phase 6's first burn-down + pin runs VeIR `felt-combine,dce`, which reclassifies registered add/sub/mul + constant folds from expected divergence to positive coverage. - 🚧 CI workflow stubbed in `.github/workflows/differential.yml`. Skips green if `llzk-opt` not provisioned — CI provisioning is v1 work. Outstanding work to reach v1: -1. **Land the canonicalization script in the consumed pin.** The - workspace script invokes both tools with their canonicalize pipelines - (`llzk-opt --canonicalize` and `veir-opt -p=felt-combine`). llzk-lean - still needs a clean pin bump before the default wrapper consumes that - implementation without `VEIR_DIFF=...`. +1. **Continue burning down classified divergences.** The consumed clean pin now + invokes both tools with their canonicalize pipelines + (`llzk-opt --canonicalize` and `veir-opt -p=felt-combine,dce`). The next + VeIR-side target is modular reduction for registered-field folds. 2. **Corpus expansion.** Hand-author a Felt corpus that exercises every pattern in VEIR's `Combine.lean` against an equivalent LLZK input. @@ -192,7 +191,7 @@ not a code change. ## Acceptance criteria for v1 - Diff script invokes both tools with canonicalization enabled - (`llzk-opt --canonicalize`, `veir-opt -p=felt-combine`). + (`llzk-opt --canonicalize`, `veir-opt -p=felt-combine,dce`). - Every input under `llzk-lib/test/Dialect/Felt/` (or its generic-form equivalent) passes the differential. - Every pattern in VEIR's `Veir.Passes.Felt.Combine` is exercised by diff --git a/lake-manifest.json b/lake-manifest.json index 2491b03..de4c7dd 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -5,10 +5,10 @@ "type": "git", "subDir": null, "scope": "", - "rev": "220cd215579b435c3c22ce86b34a3f4ce2ca276e", + "rev": "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "220cd215579b435c3c22ce86b34a3f4ce2ca276e", + "inputRev": "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", diff --git a/lakefile.toml b/lakefile.toml index d831d95..6af459a 100644 --- a/lakefile.toml +++ b/lakefile.toml @@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] [[require]] name = "VeIR" git = "https://github.com/project-llzk/veir.git" -rev = "220cd215579b435c3c22ce86b34a3f4ce2ca276e" +rev = "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" [[lean_lib]] name = "LlzkLean" diff --git a/reviews/PHASE-06/adversarial-review.md b/reviews/PHASE-06/adversarial-review.md index 36c7031..19ba9d8 100644 --- a/reviews/PHASE-06/adversarial-review.md +++ b/reviews/PHASE-06/adversarial-review.md @@ -5,9 +5,10 @@ Reviewed: 2026-06-10 ## Scope -This review covers the Phase 6 bootstrap only. It verifies that Phase 6 starts -from Phase 5's clean-pin corpus and exact expected-divergence polarity without -claiming full Strategy A acceptance. +This review covers the Phase 6 bootstrap and first implementation target. It +verifies that Phase 6 starts from Phase 5's clean-pin corpus and exact +expected-divergence polarity, then reclassifies only DCE-only divergences +without claiming full Strategy A acceptance. ## Bootstrap Checks @@ -18,7 +19,17 @@ claiming full Strategy A acceptance. - Confirm freshness, source-truth, pin, doctor, skill, build, and clean-pin canonical differential baseline gates pass. +## Implementation Checks + +- Confirm the consumed VeIR pin is + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. +- Confirm canonical differential mode runs `felt-combine,dce`. +- Confirm only `registered_add_fold.llzk`, `constant_fold_sub.llzk`, and + `constant_fold_mul.llzk` moved from expected divergence to `felt/`. +- Confirm remaining expected-divergence files keep exact `EXPECTED-*` polarity. + ## Result -Phase 6 is ready for implementation work once the bootstrap evidence under -`reviews/PHASE-06/evidence/` is populated by the current gates. +F6-LLZK-01 is resolved. Phase 6 implementation evidence under +`reviews/PHASE-06/evidence/` records the clean-pin corpus at +`21 pass (incl. expected-diverge), 0 fail`. diff --git a/reviews/PHASE-06/disposition.md b/reviews/PHASE-06/disposition.md index 73915b7..25cc79a 100644 --- a/reviews/PHASE-06/disposition.md +++ b/reviews/PHASE-06/disposition.md @@ -3,4 +3,10 @@ Repository: llzk-lean Created: 2026-06-10 -No Phase 6 bootstrap findings are open. +- F6-LLZK-01 resolved by consuming VeIR + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`, whose canonical differential + path runs `felt-combine,dce`, and by moving + `registered_add_fold.llzk`, `constant_fold_sub.llzk`, and + `constant_fold_mul.llzk` to the positive corpus. + +No Phase 6 findings remain open. diff --git a/reviews/PHASE-06/evidence/README.md b/reviews/PHASE-06/evidence/README.md index 63375b6..fda8a2b 100644 --- a/reviews/PHASE-06/evidence/README.md +++ b/reviews/PHASE-06/evidence/README.md @@ -2,7 +2,7 @@ Populate this directory with exact command output during Phase 6. -Bootstrap evidence expected: +Bootstrap and first burn-down evidence expected: - `check-doc-freshness.txt` - `verify-llzk-source.txt` diff --git a/reviews/PHASE-06/evidence/adversarial-review.txt b/reviews/PHASE-06/evidence/adversarial-review.txt index 53a082a..579a618 100644 --- a/reviews/PHASE-06/evidence/adversarial-review.txt +++ b/reviews/PHASE-06/evidence/adversarial-review.txt @@ -1,9 +1,12 @@ -$ Phase 6 bootstrap adversarial checks +$ Phase 6 implementation adversarial checks PASS: Phase 5 is marked completed before Phase 6 starts. PASS: docs/harness/CURRENT.md names Phase 6 as active. PASS: docs/harness/SOURCES.md records the Phase 6 phase file. -PASS: Phase 5 exact-polarity guard evidence is present. +PASS: accepted VeIR pin is a0bb2fc8e6d38ab068247dfc6506ba63f5feb953. +PASS: canonical differential mode consumes VeIR felt-combine,dce through the clean dependency pin. PASS: expected-divergence polarity remains exact and marker-driven. +PASS: DCE-only registered add/sub/mul folds moved to the positive corpus. +PASS: remaining expected-divergence cases still use exact EXPECTED-* markers. PASS: Phase 6 docs preserve the clean-pin canonical baseline without claiming full Strategy A acceptance. -PASS: no Phase 6 bootstrap findings remain open. +PASS: no Phase 6 findings remain open. diff --git a/reviews/PHASE-06/evidence/check-doc-freshness.txt b/reviews/PHASE-06/evidence/check-doc-freshness.txt index f736dcd..1b307b6 100644 --- a/reviews/PHASE-06/evidence/check-doc-freshness.txt +++ b/reviews/PHASE-06/evidence/check-doc-freshness.txt @@ -1,3 +1,4 @@ +$ scripts/harness/check-doc-freshness.sh PASS: found docs/phases/PHASE-00-harness-reset.md PASS: found docs/phases/PHASE-01-pins-and-repro.md PASS: found docs/phases/PHASE-02-llzk-source-truth.md diff --git a/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt index 7456ef5..d0da204 100644 --- a/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt +++ b/reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt @@ -3,11 +3,8 @@ EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergen EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk -EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_mul.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk -EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/constant_fold_sub.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk -EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_fold.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk @@ -19,6 +16,9 @@ EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-diverg PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/add_const_swap.llzk PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_mul.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_sub.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/registered_add_fold.llzk PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) diff --git a/reviews/PHASE-06/evidence/doctor-workspace.txt b/reviews/PHASE-06/evidence/doctor-workspace.txt index 38dfd92..aabf9b1 100644 --- a/reviews/PHASE-06/evidence/doctor-workspace.txt +++ b/reviews/PHASE-06/evidence/doctor-workspace.txt @@ -1,9 +1,10 @@ +$ scripts/harness/doctor.sh --workspace-veir ../veir PASS: tool git is available PASS: tool lake is available PASS: optional tool cmake is available PASS: optional tool ctest is available PASS: git root is /home/alh/LLZK/llzk-lean -PASS: llzk-lean HEAD matches bootstrap input 617702beadfb +PASS: llzk-lean HEAD 3b3ae2b0cf16 descends from bootstrap input 617702beadfb PASS: found AGENTS.md PASS: found docs/phases/PHASE-00-harness-reset.md PASS: found docs/phases/PHASE-01-pins-and-repro.md @@ -54,19 +55,19 @@ PASS: executable scripts/harness/cert-smoke.sh PASS: executable scripts/harness/verify-pins.sh PASS: executable scripts/harness/verify-llzk-source.sh PASS: executable scripts/harness/validate-skills.sh -accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +accepted VeIR pin: a0bb2fc8e6d38ab068247dfc6506ba63f5feb953 accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git -PASS: lakefile.toml pins VeIR 220cd215579b -PASS: lake-manifest.json pins VeIR 220cd215579b -PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lakefile.toml pins VeIR a0bb2fc8e6d3 +PASS: lake-manifest.json pins VeIR a0bb2fc8e6d3 +PASS: lake-manifest.json inputRev pins VeIR a0bb2fc8e6d3 PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git PASS: lake-manifest.json records VeIR as a git dependency -PASS: Lake files agree on VeIR 220cd215579b -PASS: dependency checkout HEAD is 220cd215579b +PASS: Lake files agree on VeIR a0bb2fc8e6d3 +PASS: dependency checkout HEAD is a0bb2fc8e6d3 PASS: dependency checkout HEAD equals manifest rev PASS: dependency checkout is clean -PASS: workspace VeIR HEAD equals accepted pin 220cd215579b +PASS: workspace VeIR HEAD equals accepted pin a0bb2fc8e6d3 pin verification summary: 0 fail, 0 warn, mode=strict PASS: pin verification passed diff --git a/reviews/PHASE-06/evidence/lake-build.txt b/reviews/PHASE-06/evidence/lake-build.txt index 979a48b..8035784 100644 --- a/reviews/PHASE-06/evidence/lake-build.txt +++ b/reviews/PHASE-06/evidence/lake-build.txt @@ -1,4 +1,5 @@ -⚠ [39/65] Replayed Veir.Verifier +$ lake build +⚠ [39/639] Replayed Veir.Verifier warning: Veir/Verifier.lean:2107:23: This simp argument is unused: throw diff --git a/reviews/PHASE-06/evidence/validate-skills.txt b/reviews/PHASE-06/evidence/validate-skills.txt index 3e6aaec..f066d39 100644 --- a/reviews/PHASE-06/evidence/validate-skills.txt +++ b/reviews/PHASE-06/evidence/validate-skills.txt @@ -1,3 +1,4 @@ +$ scripts/harness/validate-skills.sh PASS: skills/cert-checker-review/SKILL.md has title PASS: skills/cert-checker-review/SKILL.md has usage trigger PASS: skills/cert-checker-review/SKILL.md has validation path diff --git a/reviews/PHASE-06/evidence/verify-llzk-source.txt b/reviews/PHASE-06/evidence/verify-llzk-source.txt index e409411..a12d07d 100644 --- a/reviews/PHASE-06/evidence/verify-llzk-source.txt +++ b/reviews/PHASE-06/evidence/verify-llzk-source.txt @@ -1,3 +1,4 @@ +$ scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib PASS: llzk-lib path is /home/alh/LLZK/llzk-lib PASS: found docs/harness/LLZK_SOURCE.md PASS: LLZK source ledger records db922857bc5a @@ -89,7 +90,7 @@ PASS: LLZK source ledger mentions babybear PASS: LLZK source ledger mentions goldilocks PASS: LLZK source ledger mentions mersenne31 PASS: LLZK source ledger mentions koalabear -PASS: pinned VeIR dependency HEAD is 220cd215579b +PASS: pinned VeIR dependency HEAD is a0bb2fc8e6d3 PASS: pinned VeIR dependency feltPrime cites current LLZK registry path PASS: pinned VeIR dependency feltPrime mentions bn128 PASS: pinned VeIR dependency feltPrime mentions bn254 diff --git a/reviews/PHASE-06/evidence/verify-pins.txt b/reviews/PHASE-06/evidence/verify-pins.txt index 98ceeb2..79719af 100644 --- a/reviews/PHASE-06/evidence/verify-pins.txt +++ b/reviews/PHASE-06/evidence/verify-pins.txt @@ -1,15 +1,16 @@ -accepted VeIR pin: 220cd215579b435c3c22ce86b34a3f4ce2ca276e +$ scripts/harness/verify-pins.sh --workspace-veir ../veir +accepted VeIR pin: a0bb2fc8e6d38ab068247dfc6506ba63f5feb953 accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git -PASS: lakefile.toml pins VeIR 220cd215579b -PASS: lake-manifest.json pins VeIR 220cd215579b -PASS: lake-manifest.json inputRev pins VeIR 220cd215579b +PASS: lakefile.toml pins VeIR a0bb2fc8e6d3 +PASS: lake-manifest.json pins VeIR a0bb2fc8e6d3 +PASS: lake-manifest.json inputRev pins VeIR a0bb2fc8e6d3 PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git PASS: lake-manifest.json records VeIR as a git dependency -PASS: Lake files agree on VeIR 220cd215579b -PASS: dependency checkout HEAD is 220cd215579b +PASS: Lake files agree on VeIR a0bb2fc8e6d3 +PASS: dependency checkout HEAD is a0bb2fc8e6d3 PASS: dependency checkout HEAD equals manifest rev PASS: dependency checkout is clean -PASS: workspace VeIR HEAD equals accepted pin 220cd215579b +PASS: workspace VeIR HEAD equals accepted pin a0bb2fc8e6d3 pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-06/findings.md b/reviews/PHASE-06/findings.md index 17d8ea8..ce2be50 100644 --- a/reviews/PHASE-06/findings.md +++ b/reviews/PHASE-06/findings.md @@ -3,4 +3,21 @@ Repository: llzk-lean Reviewed: 2026-06-10 -No Phase 6 bootstrap findings are open. +## F6-LLZK-01: DCE-only constant-fold divergences remained classified negative + +Severity: medium +Status: resolved + +At Phase 6 bootstrap, `registered_add_fold.llzk`, `constant_fold_sub.llzk`, +and `constant_fold_mul.llzk` were still classified as `EXPECTED-DIVERGE` +although the difference was pipeline alignment rather than arithmetic: LLZK's +canonicalizer erased now-dead input constants, while VeIR canonical +differential mode ran only `felt-combine`. + +Resolution: VeIR commit `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` updates +canonical differential mode to run `felt-combine,dce`. llzk-lean consumes that +clean pin and reclassifies the three files under `differential/corpus/felt/`. +The clean-pin canonical corpus remains `21 pass (incl. expected-diverge), +0 fail`. + +No Phase 6 findings remain open. diff --git a/reviews/PHASE-06/request.md b/reviews/PHASE-06/request.md index 23a3f69..b149018 100644 --- a/reviews/PHASE-06/request.md +++ b/reviews/PHASE-06/request.md @@ -3,11 +3,17 @@ Repository: llzk-lean Created: 2026-06-10 -Review the Phase 6 Strategy A divergence burn-down bootstrap. +Review the Phase 6 Strategy A divergence burn-down bootstrap and first +implementation target. Scope: - Phase 6 is active and starts from the Phase 5 clean-pin exact-polarity corpus. - Phase 5 findings are closed before Phase 6 implementation work starts. - The bootstrap does not claim full Strategy A acceptance. -- The next implementation target is divergence reduction or reclassification. +- The first implementation target reclassifies the DCE-only registered + add/sub/mul constant-fold divergences through the clean VeIR pin + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. +- The clean-pin canonical corpus remains `21 pass (incl. expected-diverge), + 0 fail` with 7 PASS cases, 13 `EXPECTED-DIVERGE` cases, and + 1 `EXPECTED-LLZK-FAIL` case. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index 670623f..f85df5a 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -4,7 +4,7 @@ set -u ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" FAIL=0 -ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" +ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" fail() { diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh index 113496f..85ddc4a 100755 --- a/scripts/harness/doctor.sh +++ b/scripts/harness/doctor.sh @@ -6,7 +6,8 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -EXPECTED_LLZK_LEAN_HEAD="617702beadfb" +EXPECTED_LLZK_LEAN_HEAD="617702beadfbad6be784945e2bd98e8a788d357c" +EXPECTED_LLZK_LEAN_SHORT="${EXPECTED_LLZK_LEAN_HEAD:0:12}" FAIL=0 WARN=0 @@ -114,10 +115,12 @@ else fi head_short="$(git -C "$ROOT" rev-parse --short=12 HEAD 2>/dev/null || true)" -if [[ "$head_short" == "$EXPECTED_LLZK_LEAN_HEAD" ]]; then - ok "llzk-lean HEAD matches bootstrap input ${EXPECTED_LLZK_LEAN_HEAD}" +if [[ "$head_short" == "$EXPECTED_LLZK_LEAN_SHORT" ]]; then + ok "llzk-lean HEAD matches bootstrap input ${EXPECTED_LLZK_LEAN_SHORT}" +elif git -C "$ROOT" merge-base --is-ancestor "$EXPECTED_LLZK_LEAN_HEAD" HEAD 2>/dev/null; then + ok "llzk-lean HEAD ${head_short:-} descends from bootstrap input ${EXPECTED_LLZK_LEAN_SHORT}" else - warn "llzk-lean HEAD ${head_short:-} differs from bootstrap input ${EXPECTED_LLZK_LEAN_HEAD}" + warn "llzk-lean HEAD ${head_short:-} differs from bootstrap input ${EXPECTED_LLZK_LEAN_SHORT}" fi require_file AGENTS.md diff --git a/scripts/harness/verify-llzk-source.sh b/scripts/harness/verify-llzk-source.sh index 6816476..cab96b6 100755 --- a/scripts/harness/verify-llzk-source.sh +++ b/scripts/harness/verify-llzk-source.sh @@ -9,7 +9,7 @@ ACCEPTED_LLZK_COMMIT="db922857bc5a88a9107627ef6b36a8b5e57bc5c2" ACCEPTED_LLZK_SHORT="${ACCEPTED_LLZK_COMMIT:0:12}" ACCEPTED_LLZK_REF="origin/main" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" -ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" +ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" FIELD_REGISTRY_PATH="lib/Util/Field.cpp" diff --git a/scripts/harness/verify-pins.sh b/scripts/harness/verify-pins.sh index 393f745..5362ea0 100755 --- a/scripts/harness/verify-pins.sh +++ b/scripts/harness/verify-pins.sh @@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -ACCEPTED_VEIR_COMMIT="220cd215579b435c3c22ce86b34a3f4ce2ca276e" +ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" ACCEPTED_VEIR_REMOTE="https://github.com/project-llzk/veir.git" ACCEPTED_VEIR_BRANCH="felt-review-structural-close" From 17ad33a335683ae5831288741542abf5f9a6c68a Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 17:19:52 +0100 Subject: [PATCH 09/16] Record fresh Phase 6 adversarial review --- reviews/PHASE-06/adversarial-review.md | 10 +++++++++- reviews/PHASE-06/evidence/adversarial-review.txt | 10 ++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/reviews/PHASE-06/adversarial-review.md b/reviews/PHASE-06/adversarial-review.md index 19ba9d8..951f8ed 100644 --- a/reviews/PHASE-06/adversarial-review.md +++ b/reviews/PHASE-06/adversarial-review.md @@ -24,12 +24,20 @@ without claiming full Strategy A acceptance. - Confirm the consumed VeIR pin is `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. - Confirm canonical differential mode runs `felt-combine,dce`. +- Confirm the clean dependency checkout under `.lake/packages/VeIR` is exactly + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` and its diff script invokes + `-p=felt-combine,dce`. - Confirm only `registered_add_fold.llzk`, `constant_fold_sub.llzk`, and `constant_fold_mul.llzk` moved from expected divergence to `felt/`. +- Confirm those three moved inputs pass independently in canonical mode. - Confirm remaining expected-divergence files keep exact `EXPECTED-*` polarity. +- Confirm the Phase 6 llzk-lean change did not edit Lean implementation files + while changing corpus classification, pins, harness scripts, docs, and + evidence. ## Result F6-LLZK-01 is resolved. Phase 6 implementation evidence under `reviews/PHASE-06/evidence/` records the clean-pin corpus at -`21 pass (incl. expected-diverge), 0 fail`. +`21 pass (incl. expected-diverge), 0 fail`. A fresh post-implementation +adversarial pass found no new findings. diff --git a/reviews/PHASE-06/evidence/adversarial-review.txt b/reviews/PHASE-06/evidence/adversarial-review.txt index 579a618..24e288d 100644 --- a/reviews/PHASE-06/evidence/adversarial-review.txt +++ b/reviews/PHASE-06/evidence/adversarial-review.txt @@ -10,3 +10,13 @@ PASS: DCE-only registered add/sub/mul folds moved to the positive corpus. PASS: remaining expected-divergence cases still use exact EXPECTED-* markers. PASS: Phase 6 docs preserve the clean-pin canonical baseline without claiming full Strategy A acceptance. PASS: no Phase 6 findings remain open. + +$ Fresh post-implementation adversarial checks + +PASS: clean dependency checkout HEAD is a0bb2fc8e6d38ab068247dfc6506ba63f5feb953. +PASS: clean dependency llzk-diff.sh contains veir-opt -p=felt-combine,dce in canonical mode. +PASS: targeted canonical run passes registered_add_fold.llzk, constant_fold_sub.llzk, and constant_fold_mul.llzk individually. +PASS: positive corpus contains no EXPECTED-* markers. +PASS: reclassified files no longer appear under differential/corpus/expected-divergence. +PASS: Phase 6 llzk-lean changes touch no Lean implementation files. +PASS: fresh post-implementation adversarial pass found no new findings. From bb836ca1862b39e44bcbef20b6302d05277f31bf Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 21:06:50 +0100 Subject: [PATCH 10/16] Close Phase 7 and bootstrap Phase 8 --- LlzkLean/Cert.lean | 18 +- LlzkLean/CertValidate.lean | 25 +- certs/felt-combine.cert.json | 2 +- checker/tests/test_loader.cpp | 2 +- differential/README.md | 30 +- differential/corpus/README.md | 14 +- .../canonical/constant_fold_neg.llzk | 10 - .../canonical/registered_add_wrap.llzk | 13 - .../corpus/felt/constant_fold_neg.llzk | 9 + .../corpus/felt/registered_add_wrap.llzk | 10 + docs/REVIEW.md | 9 +- docs/harness/CURRENT.md | 50 ++-- docs/harness/FELT_OP_GAPS.md | 10 +- docs/harness/GATES.md | 52 +++- docs/harness/PINS.md | 15 +- docs/harness/SOURCES.md | 12 +- docs/phases/PHASE-01-pins-and-repro.md | 2 +- docs/phases/PHASE-02-llzk-source-truth.md | 2 +- docs/phases/PHASE-03-felt-op-gap-ledger.md | 5 +- ...PHASE-06-strategy-a-divergence-burndown.md | 2 +- .../PHASE-07-strategy-a-modular-reduction.md | 141 ++++++++++ ...PHASE-08-strategy-a-field-preconditions.md | 119 ++++++++ docs/strategy-a-oracle.md | 44 +-- docs/strategy-e-certificates.md | 4 +- lake-manifest.json | 4 +- lakefile.toml | 2 +- reviews/PHASE-07/adversarial-review.md | 54 ++++ reviews/PHASE-07/disposition.md | 31 ++ reviews/PHASE-07/evidence/README.md | 9 + .../PHASE-07/evidence/adversarial-review.txt | 15 + reviews/PHASE-07/evidence/cert-smoke.txt | 5 + .../PHASE-07/evidence/check-doc-freshness.txt | 265 ++++++++++++++++++ .../differential-clean-pin-canonicalize.txt | 23 ++ .../PHASE-07/evidence/doctor-workspace.txt | 87 ++++++ reviews/PHASE-07/evidence/lake-build.txt | 34 +++ reviews/PHASE-07/evidence/validate-skills.txt | 22 ++ .../PHASE-07/evidence/verify-llzk-source.txt | 119 ++++++++ reviews/PHASE-07/evidence/verify-pins.txt | 15 + reviews/PHASE-07/findings.md | 69 +++++ reviews/PHASE-07/request.md | 27 ++ reviews/PHASE-08/adversarial-review.md | 31 ++ reviews/PHASE-08/disposition.md | 11 + reviews/PHASE-08/evidence/README.md | 8 + .../PHASE-08/evidence/adversarial-review.txt | 12 + reviews/PHASE-08/findings.md | 6 + reviews/PHASE-08/request.md | 23 ++ scripts/harness/check-doc-freshness.sh | 117 +++++++- scripts/harness/doctor.sh | 22 ++ scripts/harness/verify-llzk-source.sh | 6 +- scripts/harness/verify-pins.sh | 2 +- 50 files changed, 1466 insertions(+), 153 deletions(-) delete mode 100644 differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk delete mode 100644 differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk create mode 100644 differential/corpus/felt/constant_fold_neg.llzk create mode 100644 differential/corpus/felt/registered_add_wrap.llzk create mode 100644 docs/phases/PHASE-07-strategy-a-modular-reduction.md create mode 100644 docs/phases/PHASE-08-strategy-a-field-preconditions.md create mode 100644 reviews/PHASE-07/adversarial-review.md create mode 100644 reviews/PHASE-07/disposition.md create mode 100644 reviews/PHASE-07/evidence/README.md create mode 100644 reviews/PHASE-07/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-07/evidence/cert-smoke.txt create mode 100644 reviews/PHASE-07/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt create mode 100644 reviews/PHASE-07/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-07/evidence/lake-build.txt create mode 100644 reviews/PHASE-07/evidence/validate-skills.txt create mode 100644 reviews/PHASE-07/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-07/evidence/verify-pins.txt create mode 100644 reviews/PHASE-07/findings.md create mode 100644 reviews/PHASE-07/request.md create mode 100644 reviews/PHASE-08/adversarial-review.md create mode 100644 reviews/PHASE-08/disposition.md create mode 100644 reviews/PHASE-08/evidence/README.md create mode 100644 reviews/PHASE-08/evidence/adversarial-review.txt create mode 100644 reviews/PHASE-08/findings.md create mode 100644 reviews/PHASE-08/request.md diff --git a/LlzkLean/Cert.lean b/LlzkLean/Cert.lean index c6b6b16..820a35c 100644 --- a/LlzkLean/Cert.lean +++ b/LlzkLean/Cert.lean @@ -275,16 +275,10 @@ def feltCombineCatalog : List Cert := [ (conditions := []) (llzkParityStatus := .veirOnly) (description := "felt.add x (felt.const 0) → x. Sound over any ZMod p."), - -- LLZK does this fold but with two caveats VEIR doesn't fully - -- share today: - -- (a) LLZK short-circuits unless both operands have a registered - -- field name (`tryGetBinaryFoldData` in - -- lib/Dialect/Felt/IR/Ops.cpp); VEIR now guards equal field - -- types, but does not model LLZK's registry membership check. - -- (b) LLZK applies modular reduction (`Field::reduce` in - -- lib/Util/Field.cpp); VEIR's implementation stores c1+c2 as - -- an unreduced Int. - -- v0.2.0 expresses LLZK's actual fold conditions structurally: + -- LLZK does this fold when both operands share a registered field name. + -- Phase 7 aligns VEIR's registered-field fold result with LLZK's + -- `Field::reduce`; the side conditions below express LLZK's actual fold + -- preconditions structurally: -- - both operands' fieldName attrs must match (sameAttr) -- - the shared fieldName must resolve in LLZK's Field registry -- (attrInRegistry) @@ -297,8 +291,8 @@ def feltCombineCatalog : List Cert := [ .sameAttr "fieldName" ["lhs", "rhs"], .attrInRegistry "lhs" "fieldName" "field" ]) - (llzkParityStatus := .alignedWithCaveats) - (description := "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (Field::reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned.") + (llzkParityStatus := .aligned) + (description := "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2 reduced through the registered field). Sound over any ZMod p and aligned with LLZK's Field::reduce under the recorded registry side conditions.") -- TODO: derive the remaining 13 entries from -- Veir.Passes.Felt.Combine reflectively. Hand-listed here as -- stub-quality scaffolding — the real emitter walks the Lean diff --git a/LlzkLean/CertValidate.lean b/LlzkLean/CertValidate.lean index de7a138..1f327f6 100644 --- a/LlzkLean/CertValidate.lean +++ b/LlzkLean/CertValidate.lean @@ -39,6 +39,21 @@ import Veir.Passes.Felt.Proofs namespace LlzkLean.Cert +section + +private partial def exprContainsConst (target : Lean.Name) : Lean.Expr → Bool + | .const n _ => n == target + | .app f a => exprContainsConst target f || exprContainsConst target a + | .lam _ t b _ => exprContainsConst target t || exprContainsConst target b + | .forallE _ t b _ => exprContainsConst target t || exprContainsConst target b + | .letE _ t v b _ => + exprContainsConst target t || exprContainsConst target v || exprContainsConst target b + | .mdata _ b => exprContainsConst target b + | .proj _ _ b => exprContainsConst target b + | _ => false + +end + open Lean Elab Command in /-- Build-time assertion that the fully-qualified Lean name `nameStr` @@ -77,7 +92,7 @@ elab "#assertCatalogCoverage" : command => do let mut veirPatternIds : List String := [] for (n, info) in env.constants.toList do match n, info with - | .str parent baseName, .defnInfo _ => + | .str parent baseName, .defnInfo defnInfo => -- Filter to rewrite-pattern defs only. VEIR's pattern namespace -- also contains: -- - `matchAdd`, `matchSub`, ... — helper matchers (start with @@ -100,7 +115,13 @@ elab "#assertCatalogCoverage" : command => do baseName == "projectToOperand" || baseName == "replaceWithNewOp" || baseName == "replaceWithBinOpOfConst" - if parent == nsPrefix && !isHelper && !isPass && !isInternal && !isRewriteTailHelper then + -- Actual rewrite patterns take the active pattern rewriter plus an + -- operation pointer. This keeps ordinary helpers in `Veir.FeltPass` + -- from inflating the certificate coverage count. + let isPatternShaped := + exprContainsConst ``Veir.PatternRewriter defnInfo.type && + exprContainsConst ``Veir.OperationPtr defnInfo.type + if parent == nsPrefix && isPatternShaped && !isHelper && !isPass && !isInternal && !isRewriteTailHelper then veirPatternIds := baseName :: veirPatternIds | _, _ => pure () let catalogIds := feltCombineCatalog.map (·.patternId) diff --git a/certs/felt-combine.cert.json b/certs/felt-combine.cert.json index fbcfcf3..c2758f7 100644 --- a/certs/felt-combine.cert.json +++ b/certs/felt-combine.cert.json @@ -5,6 +5,6 @@ "_aboutLlzkParityStatus": "Per-cert tag indicating how a VEIR rewrite relates to LLZK's runtime: 'aligned' = LLZK performs the same rewrite exactly; 'aligned-with-caveats' = LLZK performs it under additional source-specific conditions; 'veir-only' = LLZK has no matching fold or canonicalization pattern, the cert is a Lean-side soundness statement only. The C++ checker uses this to pick assertion polarity.", "certs": [ {"patternId":"right_identity_zero_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"any"},{"kind":"const","opKind":"felt.const","value":0}],"commutative":true},"rhs":{"kind":"any"},"conditions":[],"theoremName":"Veir.Data.Felt.right_identity_zero_add","llzkParityStatus":"veir-only","description":"felt.add x (felt.const 0) → x. Sound over any ZMod p."}, - {"patternId":"constant_fold_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"const","opKind":"felt.const"},{"kind":"const","opKind":"felt.const"}],"commutative":true},"rhs":{"kind":"const","opKind":"felt.const"},"conditions":[{"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]},{"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"}],"theoremName":"Veir.Data.Felt.constant_fold_add","llzkParityStatus":"aligned-with-caveats","description":"felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Sound over any ZMod p. Caveat: LLZK applies modular reduction (Field::reduce); VEIR's runtime fold stores c1+c2 unreduced. Otherwise aligned."} + {"patternId":"constant_fold_add","rootKind":"felt.add","lhs":{"kind":"opResult","opKind":"felt.add","operands":[{"kind":"const","opKind":"felt.const"},{"kind":"const","opKind":"felt.const"}],"commutative":true},"rhs":{"kind":"const","opKind":"felt.const"},"conditions":[{"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]},{"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"}],"theoremName":"Veir.Data.Felt.constant_fold_add","llzkParityStatus":"aligned","description":"felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2 reduced through the registered field). Sound over any ZMod p and aligned with LLZK's Field::reduce under the recorded registry side conditions."} ] } diff --git a/checker/tests/test_loader.cpp b/checker/tests/test_loader.cpp index 18bf0b5..95add21 100644 --- a/checker/tests/test_loader.cpp +++ b/checker/tests/test_loader.cpp @@ -202,7 +202,7 @@ TEST(load_committed_snapshot) { // Spot-check cert[1]: constant_fold_add const Cert &c1 = catalog->certs[1]; EXPECT(c1.patternId == "constant_fold_add", "cert[1] patternId"); - EXPECT(c1.llzkParityStatus == LlzkParityStatus::AlignedWithCaveats, + EXPECT(c1.llzkParityStatus == LlzkParityStatus::Aligned, "cert[1] parity"); EXPECT(c1.conditions.size() == 2, "cert[1] has 2 conditions"); EXPECT(c1.conditions[0].kind == SideCondition::Kind::SameAttr, diff --git a/differential/README.md b/differential/README.md index 2607e7a..7b82063 100644 --- a/differential/README.md +++ b/differential/README.md @@ -12,15 +12,18 @@ specific corpus and reporting. ## Status -**Canonicalization-aware, clean-pin expanded corpus with Phase 6 burn-down.** +**Canonicalization-aware, clean-pin expanded corpus with Phase 8 bootstrap.** `run-differential.sh` wraps VEIR's script, supports parse/print mode and canonicalization mode, and classifies output divergence, LLZK failure, VEIR failure, missing tools, and mode-skipped corpus entries separately. The Phase 6 clean-pin corpus covers all 15 current VeIR Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, with registered add/sub/mul constant folds reclassified to PASS after VeIR -canonical mode started running `felt-combine,dce`. This is not full -Strategy A acceptance coverage. +canonical mode started running `felt-combine,dce`. Phase 7 reclassifies +the registered-field add-wrap and negation folds after VeIR began reducing +registered fold results through the accepted field registry. Phase 8 starts +from that baseline and targets the remaining bare/unknown-field fold +precondition gap. This is not full Strategy A acceptance coverage. ## Running locally @@ -31,7 +34,7 @@ lake build # Builds llzk-lean's own Lean code export LLZK_OPT=/path/to/llzk-opt ./differential/run-differential.sh -# Phase 6 clean-pin canonical evidence path: +# Phase 8 clean-pin canonical evidence path: ./differential/run-differential.sh --canonicalize differential/corpus # Historical Phase 4 workspace implementation run: @@ -72,7 +75,7 @@ non-zero if any input lands in the FAIL column. ## Corpus expansion targets -Current Phase 6 bar: +Current Phase 8 bootstrap bar: - `corpus/felt/const_identities.mlir` — live const proof-of-life. - `corpus/felt/types_smoke.llzk` — custom-asm lowering smoke. - `corpus/felt/arithmetic_no_fold.llzk` — canonical no-fire arithmetic. @@ -82,9 +85,13 @@ Current Phase 6 bar: `corpus/felt/constant_fold_sub.llzk`, and `corpus/felt/constant_fold_mul.llzk` — Phase 6 positives closed by the clean `felt-combine,dce` pipeline. -- `corpus/expected-divergence/canonical/*` — classified clean-pin - canonicalization gaps for modular reduction, field-registry - preconditions, and VeIR-only algebraic rewrites. +- `corpus/felt/registered_add_wrap.llzk` and + `corpus/felt/constant_fold_neg.llzk` — Phase 7 positives closed by + registered-field modular reduction in VeIR folds. +- `corpus/expected-divergence/canonical/unspecified_add_fold.llzk` — Phase 8 + target for unresolved bare/unknown-field fold preconditions. +- The remaining `corpus/expected-divergence/canonical/*` files — classified + clean-pin canonicalization gaps for VeIR-only algebraic rewrites. - `corpus/README.md` — the current 21-input inventory and 15-pattern rewrite coverage matrix. @@ -152,9 +159,8 @@ differences: Any *remaining* difference after normalization is a real divergence and either: -1. A canonical-form mismatch (e.g., VEIR emits `42` where LLZK emits - `42 mod p` because VEIR's folds don't apply modular reduction — - tracked in `../../veir/REVIEW.md` VH3) - — fix on the VEIR side. +1. A canonical-form mismatch, such as a remaining field-registry or + canonicalization precondition gap — fix on the side whose behavior + disagrees with the reviewed source fact. 2. An LLZK bug — file against `llzk-lib`. 3. A spec disagreement — escalate to the strategy doc. diff --git a/differential/corpus/README.md b/differential/corpus/README.md index 1a7af9e..cfd74ed 100644 --- a/differential/corpus/README.md +++ b/differential/corpus/README.md @@ -82,14 +82,14 @@ produced no parse/print or canonicalization evidence. | `felt/registered_add_fold.llzk` | PASS | Registered-field add folds to 12; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | | `felt/constant_fold_sub.llzk` | PASS | Registered-field subtraction folds to 5; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | | `felt/constant_fold_mul.llzk` | PASS | Registered-field multiplication folds to 42; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | +| `felt/registered_add_wrap.llzk` | PASS | Registered-field add folds through babybear reduction; Phase 7 aligns VeIR with LLZK's reduced result | +| `felt/constant_fold_neg.llzk` | PASS | Registered-field negation folds through babybear reduction; Phase 7 aligns VeIR with LLZK's reduced result | | `expected-divergence/named_field_const.mlir` | EXPECTED-LLZK-FAIL | Generic named-field FeltConstAttr still fails on LLZK's parser/verifier path | | `expected-divergence/canonical/add_neg_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + (-x)` to zero; LLZK leaves the non-constant add/neg pair in place | | `expected-divergence/canonical/add_sub_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c) - c` to `x`; LLZK leaves the add/sub pair in place | | `expected-divergence/canonical/assoc_const_fold_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c1) + c2` to `x + (c1 + c2)`; LLZK leaves the nested add chain in place | | `expected-divergence/canonical/assoc_const_fold_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x * c1) * c2` to `x * (c1 * c2)`; LLZK leaves the nested multiplication chain in place | -| `expected-divergence/canonical/constant_fold_neg.llzk` | EXPECTED-DIVERGE | LLZK reduces registered negation modulo babybear; VeIR currently emits the raw integer | | `expected-divergence/canonical/neg_neg_to_self.llzk` | EXPECTED-DIVERGE | VeIR rewrites double negation to `x`; LLZK leaves the outer negation chain in place | -| `expected-divergence/canonical/registered_add_wrap.llzk` | EXPECTED-DIVERGE | LLZK reduces registered-field fold results modulo babybear; VEIR currently emits the raw integer | | `expected-divergence/canonical/right_identity_one_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 1` to `x`; LLZK leaves the non-constant multiplication in place | | `expected-divergence/canonical/right_identity_zero_add.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + 0` to `x`; LLZK leaves the non-constant add in place | | `expected-divergence/canonical/right_zero_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 0` to zero; LLZK leaves the non-constant multiplication in place | @@ -97,15 +97,15 @@ produced no parse/print or canonicalization evidence. | `expected-divergence/canonical/sub_add_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x - c) + c` to `x`; LLZK leaves the sub/add pair in place | | `expected-divergence/canonical/unspecified_add_fold.llzk` | EXPECTED-DIVERGE | LLZK skips bare `!felt.type` binary folds; VEIR currently folds them | -The current Phase 6 clean-pin canonical corpus records 7 PASS cases, -13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` +The current Phase 8 bootstrap clean-pin canonical corpus records 9 PASS cases, +11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap. The run reports: ```text Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) ``` -## Phase 6 rewrite-pattern coverage +## Phase 8 bootstrap rewrite-pattern coverage This matrix tracks coverage against the 15 `Veir.FeltPass` rewrite-pattern definitions. It is not a Strategy A acceptance claim: `EXPECTED-DIVERGE` means @@ -115,14 +115,14 @@ gate. | VeIR pattern | Corpus status | Corpus file | |---|---|---| | `right_identity_zero_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_zero_add.llzk` | -| `constant_fold_add` | PASS | `felt/registered_add_fold.llzk` | +| `constant_fold_add` | PASS | `felt/registered_add_fold.llzk`, `felt/registered_add_wrap.llzk` | | `self_subtraction_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/self_subtraction_to_zero.llzk` | | `assoc_const_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/assoc_const_fold_add.llzk` | | `right_identity_one_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_one_mul.llzk` | | `right_zero_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_zero_mul.llzk` | | `constant_fold_sub` | PASS | `felt/constant_fold_sub.llzk` | | `constant_fold_mul` | PASS | `felt/constant_fold_mul.llzk` | -| `constant_fold_neg` | EXPECTED-DIVERGE | `expected-divergence/canonical/constant_fold_neg.llzk` | +| `constant_fold_neg` | PASS | `felt/constant_fold_neg.llzk` | | `add_neg_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/add_neg_to_zero.llzk` | | `neg_neg_to_self` | EXPECTED-DIVERGE | `expected-divergence/canonical/neg_neg_to_self.llzk` | | `add_const_swap` | PASS | `felt/add_const_swap.llzk` | diff --git a/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk b/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk deleted file mode 100644 index ad1dbdc..0000000 --- a/differential/corpus/expected-divergence/canonical/constant_fold_neg.llzk +++ /dev/null @@ -1,10 +0,0 @@ -// EXPECTED-DIVERGE in canonicalization mode. -// -// LLZK reduces the folded registered-field negation modulo babybear -// (`-5` becomes `2013265916`), while VeIR currently emits the raw integer. - -function.def @fold_neg() -> !felt.type<"babybear"> { - %a = felt.const 5 : !felt.type<"babybear"> - %c = felt.neg %a : !felt.type<"babybear"> - function.return %c : !felt.type<"babybear"> -} diff --git a/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk b/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk deleted file mode 100644 index 2aec97a..0000000 --- a/differential/corpus/expected-divergence/canonical/registered_add_wrap.llzk +++ /dev/null @@ -1,13 +0,0 @@ -// EXPECTED-DIVERGE in canonicalization mode. -// -// LLZK folds registered-field arithmetic through Field::reduce. For babybear, -// (p - 1) + 2 reduces to 1. VEIR's current constant fold records the raw -// integer result and therefore emits 2013265922. This documents the modular -// reduction gap tracked by Strategy A. - -function.def @fold_add_wrap() -> !felt.type<"babybear"> { - %a = felt.const 2013265920 : !felt.type<"babybear"> - %b = felt.const 2 : !felt.type<"babybear"> - %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> - function.return %c : !felt.type<"babybear"> -} diff --git a/differential/corpus/felt/constant_fold_neg.llzk b/differential/corpus/felt/constant_fold_neg.llzk new file mode 100644 index 0000000..aff652e --- /dev/null +++ b/differential/corpus/felt/constant_fold_neg.llzk @@ -0,0 +1,9 @@ +// Phase 7: registered-field negation folds through the accepted field +// registry. For babybear, `-5` reduces to `2013265916`; both LLZK +// canonicalization and VeIR `felt-combine,dce` emit the reduced constant. + +function.def @fold_neg() -> !felt.type<"babybear"> { + %a = felt.const 5 : !felt.type<"babybear"> + %c = felt.neg %a : !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/differential/corpus/felt/registered_add_wrap.llzk b/differential/corpus/felt/registered_add_wrap.llzk new file mode 100644 index 0000000..4fa5ed2 --- /dev/null +++ b/differential/corpus/felt/registered_add_wrap.llzk @@ -0,0 +1,10 @@ +// Phase 7: registered-field arithmetic folds through the accepted field +// registry. For babybear, (p - 1) + 2 reduces to 1; both LLZK +// canonicalization and VeIR `felt-combine,dce` emit the reduced constant. + +function.def @fold_add_wrap() -> !felt.type<"babybear"> { + %a = felt.const 2013265920 : !felt.type<"babybear"> + %b = felt.const 2 : !felt.type<"babybear"> + %c = felt.add %a, %b : !felt.type<"babybear">, !felt.type<"babybear"> + function.return %c : !felt.type<"babybear"> +} diff --git a/docs/REVIEW.md b/docs/REVIEW.md index e5e7cb7..f7bdca7 100644 --- a/docs/REVIEW.md +++ b/docs/REVIEW.md @@ -155,10 +155,11 @@ Two framing caveats worth stating to non-Lean readers: **Medium:** M1 no CI axiom-gate (the `warn.sorry false` admits are gone as of F1, but a CI `#print axioms` gate to *prevent regressions* is still absent); M2 -`#assertCatalogCoverage` uses fragile base-name heuristics; M3 three namespaces -for one unit (`Veir.FeltPass` / `Veir.Data.Felt` / path `Passes/Felt`); M4 -`constant_fold_add` "aligned-with-caveats" understates that VEIR folds -unconditionally while LLZK requires a registered field name. +`#assertCatalogCoverage` remains a shape heuristic rather than reflective +metadata; M3 three namespaces for one unit (`Veir.FeltPass` / +`Veir.Data.Felt` / path `Passes/Felt`); M4 `constant_fold_add` is now marked +`aligned` under registered-field side conditions, but the cert is still +hand-authored rather than derived from the VEIR pattern body. **Low:** L1 `JsonParser` `LLONG_MAX_REL_LIMIT` misnamed + most-negative-int64 edge; L2 README "26 tests / 15 verified" reads as more coverage than the stubs diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index bf3491b..9c4c56d 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -4,15 +4,15 @@ Last reviewed: 2026-06-10 ## Active Phase -- Active phase: Phase 6, Strategy A divergence burn-down. -- Phase bootstrap file: `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. +- Active phase: Phase 8, Strategy A field preconditions. +- Phase bootstrap file: `docs/phases/PHASE-08-strategy-a-field-preconditions.md`. - Companion repository: `../veir`. -- Companion phase file: `../veir/docs/phases/PHASE-06-strategy-a-divergence-burndown.md`. +- Companion phase file: `../veir/docs/phases/PHASE-08-strategy-a-field-preconditions.md`. ## Accepted VeIR Pin - Accepted VeIR commit: - `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. + `8e9c08925fce1caf8d6eb1d69239aae263629802`. - Accepted source branch: `felt-review-structural-close`. - Accepted source remote: `https://github.com/project-llzk/veir.git`. - Pin mode: remote commit, consumed through Lake metadata and a clean @@ -74,10 +74,12 @@ the clean dependency checkout remains the source of truth. Phase 4 reviewed workspace canonicalization evidence for the seed corpus. Phase 5 consumed the canonicalization-aware VeIR driver through the clean dependency pin and recorded the expanded 21-input canonical corpus on that - path. Phase 6 starts from that exact-polarity baseline and has reclassified - the DCE-only registered add/sub/mul fold cases after the clean VeIR driver - began running `felt-combine,dce`. The corpus covers all 15 current VeIR Felt - rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, plus one + path. Phase 6 started from that exact-polarity baseline and reclassified the + DCE-only registered add/sub/mul fold cases after the clean VeIR driver began + running `felt-combine,dce`. Phase 7 reclassified the registered-field + modular-reduction add-wrap and negation cases after VeIR began reducing fold + results through the accepted registry. The corpus covers all 15 current VeIR + Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, plus one EXPECTED-LLZK-FAIL parser/verifier gap, but this is not full Strategy A acceptance. - The local `../llzk-lib` worktree is behind fetched `origin/main`. Current @@ -87,30 +89,36 @@ the clean dependency checkout remains the source of truth. differential coverage through a workspace `VEIR_DIFF` override. Phase 5 pinned the canonicalization-aware VeIR driver, recorded expanded corpus evidence on the clean dependency path, and fixed expected-divergence polarity to exact - file-header markers. Phase 6's first burn-down target aligns VeIR's canonical - diff path with LLZK's dead-input cleanup by consuming the DCE-enabled VeIR - pin. + file-header markers. Phase 6's first burn-down target aligned VeIR's + canonical diff path with LLZK's dead-input cleanup by consuming the + DCE-enabled VeIR pin. Phase 7 targeted registered-field modular reduction for + `registered_add_wrap.llzk` and `constant_fold_neg.llzk`. Phase 8 starts from + that baseline and targets field-precondition parity for + `unspecified_add_fold.llzk`. ## Acceptance Rule -Phase 6 bootstrap is current only when: +Phase 8 bootstrap is current only when: - `docs/harness/FELT_OP_GAPS.md` records every accepted LLZK Felt mnemonic and explicitly marks unsupported Strategy A/E coverage as gaps. -- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` exists and - `docs/harness/CURRENT.md` names Phase 6 as active. +- `docs/phases/PHASE-08-strategy-a-field-preconditions.md` exists and + `docs/harness/CURRENT.md` names Phase 8 as active. - `docs/harness/SOURCES.md` records `differential/run-differential.sh`, the - Phase 6 phase file, Phase 5 exact-polarity guard evidence, the accepted - `llzk-opt` binary path, and `/home/alh/llvm-project`. + Phase 8 phase file, Phase 7 closeout evidence, Phase 5 exact-polarity guard + evidence, the accepted `llzk-opt` binary path, and `/home/alh/llvm-project`. - `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` passes. - `scripts/harness/verify-pins.sh --workspace-veir ../veir` passes. - `scripts/harness/doctor.sh --workspace-veir ../veir` passes in strict mode. - `lake build` succeeds against the clean dependency checkout. +- `scripts/harness/cert-smoke.sh` passes against the committed certificate + snapshot. - `scripts/harness/check-doc-freshness.sh` passes. - `scripts/harness/validate-skills.sh` passes. -Phase 6 implementation evidence additionally requires reducing or reclassifying -expected divergences without weakening the clean-pin canonical baseline. The -current clean-pin canonical run remains `21 pass (incl. expected-diverge), 0 -fail` and records 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 -`EXPECTED-LLZK-FAIL` parser/verifier gap. +Phase 8 implementation evidence additionally requires reducing or reclassifying +the bare/unknown-field fold-precondition divergence without weakening the +clean-pin canonical baseline. The current clean-pin canonical run remains +`21 pass (incl. expected-diverge), 0 fail` and records 9 PASS cases, 11 +`EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` +parser/verifier gap. diff --git a/docs/harness/FELT_OP_GAPS.md b/docs/harness/FELT_OP_GAPS.md index 3e49e01..9b754ee 100644 --- a/docs/harness/FELT_OP_GAPS.md +++ b/docs/harness/FELT_OP_GAPS.md @@ -11,7 +11,7 @@ Last reviewed: 2026-06-10 `git@github.com:project-llzk/llzk-lib.git`. - Consumed VeIR dependency: `.lake/packages/VeIR` at - `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. + `8e9c08925fce1caf8d6eb1d69239aae263629802`. - Current certificate catalog: `LlzkLean/Cert.lean` and `certs/felt-combine.cert.json`. - Current differential corpus: @@ -31,10 +31,10 @@ and an adversarial review disposition. | LLZK mnemonic | Consumed VeIR semantic status | Strategy A differential status | Strategy E certificate status | Phase 3 status | |---|---|---|---|---| | `const` | Covered baseline in `Data.Felt.const` and `InterpModel.interpretConst` | Smoke corpus only; no acceptance claim | Used by existing cert shapes | Covered baseline | -| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus only; no acceptance claim | `right_identity_zero_add` and `constant_fold_add` certs exist | Covered with known LLZK modular-reduction caveat | -| `sub` | Covered baseline in `Data.Felt.sub` and `InterpModel.interpretSub` | No complete accepted corpus coverage | No committed cert yet for existing VeIR sub rewrites | Gap in Strategy A/E coverage | -| `mul` | Covered baseline in `Data.Felt.mul` and `InterpModel.interpretMul` | No complete accepted corpus coverage | No committed cert yet for existing VeIR mul rewrites | Gap in Strategy A/E coverage | -| `neg` | Covered baseline in `Data.Felt.neg` and `InterpModel.interpretNeg` | No complete accepted corpus coverage | No committed cert yet for existing VeIR neg rewrites | Gap in Strategy A/E coverage | +| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus plus Phase 7 registered-field reduction coverage; Phase 8 targets bare/unknown-field fold preconditions | `right_identity_zero_add` and `constant_fold_add` certs exist | Registered-field fold reduction aligned; bare/unknown-field preconditions remain scoped gaps | +| `sub` | Covered baseline in `Data.Felt.sub` and `InterpModel.interpretSub` | Phase 6 registered-field constant subtraction PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR sub rewrites | Gap in Strategy A/E coverage | +| `mul` | Covered baseline in `Data.Felt.mul` and `InterpModel.interpretMul` | Phase 6 registered-field constant multiplication PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR mul rewrites | Gap in Strategy A/E coverage | +| `neg` | Covered baseline in `Data.Felt.neg` and `InterpModel.interpretNeg` | Phase 7 registered-field constant negation PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR neg rewrites | Gap in Strategy A/E coverage | | `pow` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | | `div` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | | `uintdiv` | Missing from consumed VeIR `Data.Felt` and `InterpModel` | No complete accepted corpus coverage | No committed cert | Gap | diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index 924d9b1..0db1405 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -6,8 +6,8 @@ Last reviewed: 2026-06-10 | Gate | Command | Expected behavior | What it proves | |---|---|---|---| -| Strategy A Phase 6 bootstrap | `scripts/harness/check-doc-freshness.sh` | Passes only when Phase 6 is active, the Phase 6 review workspace exists, Phase 5 is marked completed, exact-polarity guard evidence remains present, and the source ledger records the Phase 6 phase file plus local test infrastructure | Phase 6 starts from the clean-pin exact-polarity corpus without claiming full Strategy A acceptance | -| Felt operation gap ledger | `scripts/harness/check-doc-freshness.sh` | Passes only when the Phase 3 review workspace exists, `docs/harness/FELT_OP_GAPS.md` is present, exactly 18 accepted LLZK Felt mnemonic rows appear, and every unsupported or incomplete Strategy A/E row is still marked as a gap | Phase 5 continues from the complete documented operation-gap map instead of implicit Strategy A/E coverage claims | +| Strategy A Phase 8 bootstrap | `scripts/harness/check-doc-freshness.sh` | Passes only when Phase 8 is active, the Phase 8 review workspace exists, Phase 7 is marked completed, exact-polarity guard evidence remains present, and the source ledger records the Phase 8 phase file plus local test infrastructure | Phase 8 starts from the Phase 7 clean-pin exact-polarity corpus without claiming full Strategy A acceptance | +| Felt operation gap ledger | `scripts/harness/check-doc-freshness.sh` | Passes only when the Phase 3 review workspace exists, `docs/harness/FELT_OP_GAPS.md` is present, exactly 18 accepted LLZK Felt mnemonic rows appear, and every unsupported or incomplete Strategy A/E row is still marked as a gap | Phase 8 continues from the complete documented operation-gap map instead of implicit Strategy A/E coverage claims | | LLZK source truth | `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` | Passes only when the accepted LLZK source remote, commit, and `origin/main` match, the source ledger records every gated source file, the accepted Felt op set and representative syntax/fold facts match the ledger, the pinned VeIR dependency's `feltPrime` matches the accepted field registry, and checker/certificate artifacts enumerate the accepted built-ins | Phase 2 source facts are exact-ref and exact-remote based, the consumed VeIR pin mirrors the LLZK registry, and certificate/checker comments match the LLZK source registry | | Pin verification | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | Passes only when Lake file URLs/revs, manifest `type`/`inputRev`, and dependency HEAD agree on the accepted commit, the dependency is clean, and workspace VeIR is either the accepted commit or a descendant used only for metadata context | llzk-lean is not relying on hidden `.lake/packages/VeIR` edits or a spoofed source | | Strict doctor | `scripts/harness/doctor.sh --workspace-veir ../veir` | Passes after the pin gate and layout checks pass | Current strict harness state is complete | @@ -15,11 +15,13 @@ Last reviewed: 2026-06-10 | Lake build | `lake build` | Builds against the clean accepted VeIR dependency | The selected pin is buildable by llzk-lean | | Doc freshness | `scripts/harness/check-doc-freshness.sh` | Passes when current phase docs, Phase 3 review workspace, required Phase 3 evidence outputs, Phase 2 source evidence, dated harness docs, and expected success markers in the evidence are present | Canonical phase metadata, review state, and closeout evidence are current | | Differential smoke | `scripts/harness/diff-smoke.sh` | Keeps smoke status classification behavior | Strategy A status remains classified without becoming an acceptance claim | -| Certificate smoke | `scripts/harness/cert-smoke.sh` | Keeps smoke status classification behavior | Strategy E status remains classified without becoming an acceptance claim | +| Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds the checker smoke binaries, loads the committed certificate snapshot, checks schema metadata and parity dispatch, and reports whether MLIR matcher support is active or absent | Strategy E snapshot/checker drift is caught without claiming runtime MLIR rewrite verification | | Skill validation | `scripts/harness/validate-skills.sh` | Passes when repo-local skills have required sections | Repo-local skills remain auditable | | Phase 4 workspace differential gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus` | Runs workspace VeIR's canonicalization-aware diff script over the reviewed seed corpus | Initial Phase 4 evidence exists, but remains workspace evidence until the clean VeIR dependency pin consumes the updated script | | Phase 5 clean-pin implementation gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` override | The canonicalization-aware diff script has been consumed through a clean dependency pin and supports the Phase 6 divergence burn-down baseline | | Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Reports `21 pass (incl. expected-diverge), 0 fail` with 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap | Confirms Phase 6 reduced the expected-divergence matrix without weakening the clean-pin baseline | +| Phase 7 modular-reduction burn-down | `scripts/harness/check-doc-freshness.sh`, `scripts/harness/cert-smoke.sh`, plus the Phase 5 clean-pin implementation gate | Requires Phase 7 docs and evidence to identify `registered_add_wrap.llzk` and `constant_fold_neg.llzk` as the first registered-field modular-reduction targets, preserve the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` after reclassification, and keep the committed Strategy E snapshot loadable after the `constant_fold_add` parity update | Phase 7 closes the narrow modular-reduction target without broadening Strategy A acceptance or leaving checker/catalog drift | +| Phase 8 field-precondition burn-down | `scripts/harness/check-doc-freshness.sh` plus the Phase 5 clean-pin implementation gate | Requires Phase 8 docs and evidence to identify `unspecified_add_fold.llzk` as the first bare/unknown-field precondition target while preserving the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` at bootstrap | Phase 8 starts the next narrow burn-down without reclassifying unrelated algebraic canonicalization divergences | ## Reproducible-Pin Failures @@ -27,16 +29,22 @@ Last reviewed: 2026-06-10 `scripts/harness/check-doc-freshness.sh` must fail if: -- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` is missing. +- `docs/phases/PHASE-08-strategy-a-field-preconditions.md` is missing. +- Any phase file other than + `docs/phases/PHASE-08-strategy-a-field-preconditions.md` is marked active. +- `docs/phases/PHASE-07-strategy-a-modular-reduction.md` is not marked + completed and superseded by Phase 8. +- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` is not marked + completed and superseded by Phase 7. - `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md` is not marked completed and superseded by Phase 6. - `docs/phases/PHASE-04-strategy-a-differential.md` is missing. - `docs/phases/PHASE-03-felt-op-gap-ledger.md` is missing. -- `docs/harness/CURRENT.md` does not name Phase 6 as active. +- `docs/harness/CURRENT.md` does not name Phase 8 as active. - `docs/harness/SOURCES.md` does not record `differential/run-differential.sh`, `differential/corpus/`, - `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`, Phase 5 - exact-polarity guard evidence, + `docs/phases/PHASE-08-strategy-a-field-preconditions.md`, Phase 7 closeout + evidence, Phase 5 exact-polarity guard evidence, `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt`, and `/home/alh/llvm-project`. - `docs/harness/FELT_OP_GAPS.md` is missing. @@ -59,6 +67,10 @@ Last reviewed: 2026-06-10 adversarial-review file, or evidence README. - `reviews/PHASE-06` lacks a request, findings file, disposition file, adversarial-review file, or evidence README. +- `reviews/PHASE-07` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. +- `reviews/PHASE-08` lacks a request, findings file, disposition file, + adversarial-review file, or evidence README. - `reviews/PHASE-03/evidence` lacks nonempty Phase 3 outputs for doc freshness, LLZK source truth, pin verification, strict doctor, skill validation, lake build, or adversarial review. @@ -76,6 +88,15 @@ Last reviewed: 2026-06-10 default dependency canonicalization command and corpus evidence exist. - Phase 6 bootstrap docs claim full Strategy A acceptance, omit the Phase 5 exact-polarity baseline, or fail to mark Phase 5 completed. +- Phase 7 bootstrap docs claim full Strategy A acceptance, omit the Phase 6 + closeout baseline, fail to mark Phase 6 completed, or broaden the first + implementation target beyond registered-field modular reduction without + implementation evidence. +- Phase 7 evidence omits a passing certificate-smoke run after changing + `constant_fold_add` parity or the committed certificate snapshot. +- Phase 8 bootstrap docs claim full Strategy A acceptance, omit the Phase 7 + closeout baseline, fail to mark Phase 7 completed, or broaden the first + implementation target beyond bare/unknown-field fold-precondition parity. `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` must fail if: @@ -98,7 +119,7 @@ Last reviewed: 2026-06-10 `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and `koalabear` as recorded in `docs/harness/LLZK_SOURCE.md`. - `.lake/packages/VeIR` is missing, not at - `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`, or its + `8e9c08925fce1caf8d6eb1d69239aae263629802`, or its `Veir/Passes/Felt/InterpModel.lean` `feltPrime` mirror disagrees with the accepted LLZK field registry. - Checker registry comments omit an accepted built-in field. @@ -110,9 +131,9 @@ Last reviewed: 2026-06-10 `https://github.com/project-llzk/veir.git`. - `lake-manifest.json` does not record VeIR as a `git` dependency. - Either Lake file names a commit other than - `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. + `8e9c08925fce1caf8d6eb1d69239aae263629802`. - `lake-manifest.json` records a VeIR `inputRev` other than - `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. + `8e9c08925fce1caf8d6eb1d69239aae263629802`. - `.lake/packages/VeIR` HEAD differs from the manifest rev. - `.lake/packages/VeIR` has any modified, deleted, staged, or untracked file. - A supplied workspace VeIR path neither equals nor descends from the accepted @@ -129,8 +150,9 @@ The current harness does not prove: - Full Lean proof audit beyond buildability of the selected pin. - CI coverage when external tooling is missing. - Missing Felt operation semantics beyond the registry source facts. -- Phase 6 divergence burn-down has reduced the DCE-only expected divergences, - but this does not expand certificates, complete all Strategy A corpus - coverage, or port missing operations. Phase 4 workspace evidence remains - historical seed evidence; Phase 6 implementation evidence must preserve the - clean dependency baseline. +- Phase 6 divergence burn-down reduced the DCE-only expected divergences, and + Phase 7 reduced registered-field modular-reduction divergences, but this does + not expand certificates, complete all Strategy A corpus coverage, or port + missing operations. Phase 4 workspace evidence remains historical seed + evidence; Phase 8 implementation evidence must preserve the clean dependency + baseline while targeting bare/unknown-field fold-precondition parity. diff --git a/docs/harness/PINS.md b/docs/harness/PINS.md index 7023c86..014f266 100644 --- a/docs/harness/PINS.md +++ b/docs/harness/PINS.md @@ -4,8 +4,8 @@ Last reviewed: 2026-06-10 ## Accepted VeIR Pin -- Commit: `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` -- Short ref: `a0bb2fc8e6d3` +- Commit: `8e9c08925fce1caf8d6eb1d69239aae263629802` +- Short ref: `8e9c08925fce` - Remote: `https://github.com/project-llzk/veir.git` - Branch at selection time: `felt-review-structural-close` - Mode: remote commit pinned through Lake metadata and a clean Lake package @@ -17,9 +17,12 @@ the Phase 1 accepted pin `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. This pin preserves the Phase 2 VeIR field-registry update and source-truth gate, preserves the Phase 5 canonicalization-aware `scripts/llzk-diff.sh` -driver consumed by the default llzk-lean dependency checkout, and adds the -Phase 6 DCE-enabled canonical differential path. The script uses a built -`.lake/build/bin/veir-opt` when present and falls back to `lake exec`. +driver consumed by the default llzk-lean dependency checkout, adds the +Phase 6 DCE-enabled canonical differential path, and adds Phase 7 +registered-field fold-result reduction. Phase 8 starts from the same accepted +pin while targeting bare/unknown-field fold-precondition parity. The script +uses a built `.lake/build/bin/veir-opt` when present and falls back to +`lake exec`. ## Required State @@ -42,7 +45,7 @@ The following must all identify the accepted commit: acceptance evidence. - Exploratory workspace: `scripts/harness/verify-pins.sh --mode exploratory --workspace-veir PATH` may warn about a workspace mismatch. This output must - not be used to close Phase 5. + not be used as phase closeout evidence. ## Forbidden Hidden State diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md index 7a09e3f..6b168d2 100644 --- a/docs/harness/SOURCES.md +++ b/docs/harness/SOURCES.md @@ -7,7 +7,7 @@ Last reviewed: 2026-06-10 | Source | Ref or retrieval | Use | |---|---:|---| | `docs/phases/PHASE-01-pins-and-repro.md` | local file, 2026-06-05 | Phase 1 objective, artifacts, gates, done criteria | -| Accepted VeIR pin | `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953` | Dependency commit consumed by llzk-lean | +| Accepted VeIR pin | `8e9c08925fce1caf8d6eb1d69239aae263629802` | Dependency commit consumed by llzk-lean | | Accepted VeIR branch | `felt-review-structural-close` | Remote branch containing the accepted commit | | Accepted VeIR remote | `https://github.com/project-llzk/veir.git` | Canonical source repository for the accepted pin | | `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | @@ -27,16 +27,20 @@ Last reviewed: 2026-06-10 | `docs/harness/FELT_OP_GAPS.md` | local file, 2026-06-06 | Phase 3 accepted Felt operation coverage and gap ledger | | `docs/phases/PHASE-04-strategy-a-differential.md` | local file, 2026-06-09 | Phase 4 Strategy A differential objective, artifacts, gates, and done criteria | | `docs/phases/PHASE-05-strategy-a-pin-and-corpus.md` | local file, 2026-06-10 | Completed Phase 5 clean-pin consumption and corpus-expansion objective, artifacts, gates, and done criteria | -| `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` | local file, 2026-06-10 | Phase 6 divergence burn-down objective, artifacts, gates, and done criteria | +| `docs/phases/PHASE-06-strategy-a-divergence-burndown.md` | local file, 2026-06-10 | Completed Phase 6 divergence burn-down objective, artifacts, gates, and done criteria | +| `docs/phases/PHASE-07-strategy-a-modular-reduction.md` | local file, 2026-06-10 | Completed Phase 7 registered-field modular-reduction objective, artifacts, gates, and done criteria | +| `docs/phases/PHASE-08-strategy-a-field-preconditions.md` | local file, 2026-06-10 | Active Phase 8 field-precondition objective, artifacts, gates, and done criteria | | `differential/run-differential.sh` | local file, 2026-06-09 | llzk-lean corpus wrapper around the consumed VeIR diff script | | `differential/corpus/` | local files, 2026-06-09 | Current Strategy A corpus and expected-divergence classification | -| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support; Phase 6 canonical mode runs `felt-combine,dce` | +| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support; Phase 6 canonical mode runs `felt-combine,dce`, and the accepted Phase 7 pin includes registered-field fold-result reduction | | Workspace VeIR `scripts/llzk-diff.sh` | `../veir/scripts/llzk-diff.sh`, local file, 2026-06-09 | Phase 4 canonicalization-aware driver used explicitly through `VEIR_DIFF=../veir/scripts/llzk-diff.sh` | | Phase 4 canonical differential evidence | `reviews/PHASE-04/evidence/differential-canonicalize.txt` | Reviewed workspace Strategy A seed evidence; not clean-pin acceptance | | Phase 4 fresh adversarial review evidence | `reviews/PHASE-04/evidence/adversarial-review-fresh.txt` | Confirms Phase 4 wrapper findings were resolved before Phase 5 | | Phase 5 clean-pin canonical differential evidence | `reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt` | Expanded corpus canonical run through the default clean dependency driver | | Phase 5 exact-polarity guard evidence | `reviews/PHASE-05/evidence/polarity-guard.txt` | Proves a canonical `EXPECTED-DIVERGE` input fails on the wrong LLZK failure mode | -| Phase 6 review workspace | `reviews/PHASE-06/` | Active Phase 6 request, findings, disposition, adversarial review, implementation evidence, and burn-down disposition | +| Phase 6 review workspace | `reviews/PHASE-06/` | Completed Phase 6 request, findings, disposition, adversarial review, implementation evidence, and burn-down disposition | +| Phase 7 review workspace | `reviews/PHASE-07/` | Completed Phase 7 request, findings, disposition, adversarial review, implementation evidence, and modular-reduction target | +| Phase 8 review workspace | `reviews/PHASE-08/` | Active Phase 8 request, findings, disposition, adversarial review, bootstrap evidence, and field-precondition target | | Accepted local `llzk-opt` binary | `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt` | LLZK executable for Strategy A differential testing | | Local LLVM/MLIR checkout | `/home/alh/llvm-project` at `49f12af164138123589263fe75ea5f1d356e8780` | Source and build tree for local MLIR/LLVM testing support | | Local `mlir-opt` | `/home/alh/llvm-project/build/bin/mlir-opt`, version `23.0.0git` | Local MLIR tool available for Strategy A testing | diff --git a/docs/phases/PHASE-01-pins-and-repro.md b/docs/phases/PHASE-01-pins-and-repro.md index 5f0f5fa..95f08e3 100644 --- a/docs/phases/PHASE-01-pins-and-repro.md +++ b/docs/phases/PHASE-01-pins-and-repro.md @@ -1,6 +1,6 @@ # Phase 1: Reproducible Pins -Status: active +Status: completed; superseded by Phase 2 Last reviewed: 2026-06-05 Repository: llzk-lean Companion phase file: ../../../veir/docs/phases/PHASE-01-pins-and-repro.md diff --git a/docs/phases/PHASE-02-llzk-source-truth.md b/docs/phases/PHASE-02-llzk-source-truth.md index 1e6c34a..235bb47 100644 --- a/docs/phases/PHASE-02-llzk-source-truth.md +++ b/docs/phases/PHASE-02-llzk-source-truth.md @@ -1,6 +1,6 @@ # Phase 2: LLZK Source Truth And Field Registry Parity -Status: active +Status: completed; superseded by Phase 3 Last reviewed: 2026-06-06 Repository: llzk-lean Companion phase file: ../../../veir/docs/phases/PHASE-02-llzk-source-truth.md diff --git a/docs/phases/PHASE-03-felt-op-gap-ledger.md b/docs/phases/PHASE-03-felt-op-gap-ledger.md index 5c4566e..b6de322 100644 --- a/docs/phases/PHASE-03-felt-op-gap-ledger.md +++ b/docs/phases/PHASE-03-felt-op-gap-ledger.md @@ -1,6 +1,6 @@ # Phase 3: Felt Operation Semantics Gap Ledger -Status: active +Status: completed; superseded by Phase 4 Last reviewed: 2026-06-06 Repository: llzk-lean Companion phase file: ../../../veir/docs/phases/PHASE-03-felt-op-gap-ledger.md @@ -62,7 +62,8 @@ fresh without expanding the certificate catalog or differential corpus yet. ## Gates To Implement -- `scripts/harness/check-doc-freshness.sh` fails if Phase 3 is not active, if +- `scripts/harness/check-doc-freshness.sh` fails if Phase 3 docs or review + workspace files are missing, if `docs/harness/FELT_OP_GAPS.md` is missing, or if the ledger omits any accepted LLZK Felt mnemonic. - `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to diff --git a/docs/phases/PHASE-06-strategy-a-divergence-burndown.md b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md index 867ee2b..de31d56 100644 --- a/docs/phases/PHASE-06-strategy-a-divergence-burndown.md +++ b/docs/phases/PHASE-06-strategy-a-divergence-burndown.md @@ -1,6 +1,6 @@ # Phase 6: Strategy A Divergence Burn-Down -Status: active +Status: completed; superseded by Phase 7 Last reviewed: 2026-06-10 Repository: llzk-lean Companion phase file: ../../../veir/docs/phases/PHASE-06-strategy-a-divergence-burndown.md diff --git a/docs/phases/PHASE-07-strategy-a-modular-reduction.md b/docs/phases/PHASE-07-strategy-a-modular-reduction.md new file mode 100644 index 0000000..fc3d65a --- /dev/null +++ b/docs/phases/PHASE-07-strategy-a-modular-reduction.md @@ -0,0 +1,141 @@ +# Phase 7: Strategy A Modular Reduction + +Status: completed; superseded by Phase 8 +Last reviewed: 2026-06-10 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-07-strategy-a-modular-reduction.md + +## Objective + +Bootstrap the next Strategy A burn-down after Phase 6's DCE-only closeout: +make registered-field modular reduction the explicit implementation target +while preserving the clean-pin differential baseline and exact +`EXPECTED-*` polarity rules. + +Phase 7 starts from the Phase 6 clean dependency pin and the 21-input canonical +corpus. The first target is the pair of registered-field modular-reduction +divergences where LLZK canonicalization reduces through the accepted field +modulus but VeIR emitted the raw folded integer at bootstrap. + +## Starting State + +- llzk-lean HEAD at Phase 7 bootstrap: + `17ad33a335683ae5831288741542abf5f9a6c68a`. +- Workspace VeIR HEAD at Phase 7 bootstrap: + `8036fadd1a36ee202416aa9d6f0e0e388c686b25`. +- Consumed VeIR dependency pin at Phase 7 bootstrap: + `a0bb2fc8e6d38ab068247dfc6506ba63f5feb953`. +- Accepted LLZK source commit remains: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Phase 6 closed the DCE-only burn-down with 7 PASS cases, 13 + `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` + parser/verifier gap over 21 inputs. +- Phase 6 adversarial review found no remaining implementation findings after + the clean-pin `felt-combine,dce` baseline was refreshed. + +## Phase 7 Implementation Update + +- Registered-field reduction VeIR commit: + `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- llzk-lean now consumes that clean VeIR pin through Lake metadata and a clean + `.lake/packages/VeIR` checkout. +- VeIR registered-field constant folds now reduce through the accepted field + registry, aligning the Phase 7 target cases with LLZK's `Field::reduce` + behavior. +- The clean-pin corpus still has 21 inputs and `0 fail`, but the classification + is now 9 PASS cases, 11 `EXPECTED-DIVERGE` canonical cases, and + 1 `EXPECTED-LLZK-FAIL` named-field parser/verifier gap. +- Reclassified positives: + `felt/registered_add_wrap.llzk` and `felt/constant_fold_neg.llzk`. + +## Target Cases + +- `differential/corpus/felt/registered_add_wrap.llzk` + records a registered-field add fold where LLZK reduces modulo babybear and + VeIR now emits the reduced integer. +- `differential/corpus/felt/constant_fold_neg.llzk` + records a registered-field neg fold where LLZK reduces modulo babybear and + VeIR now emits the reduced integer. + +These were the first Phase 7 implementation targets. They are reclassified to +the positive Felt corpus after VeIR-side registered-field reduction evidence. +The remaining algebraic canonicalization divergences stay outside this Phase 7 +target until their implementation behavior is reviewed independently. + +## Non-Goals + +- Do not claim full Strategy A acceptance from the current 21-input corpus. +- Do not change the accepted LLZK source commit or field-registry facts. +- Do not treat the workspace VeIR HEAD as clean-pin evidence. +- Do not reclassify nonconstant algebraic rewrite divergences as positives + without a reviewed implementation change and exact clean-pin evidence. +- Do not implement Strategy E certificates or runtime MLIR matching in this + phase bootstrap. + +## Artifacts To Create Or Update + +- `docs/phases/PHASE-07-strategy-a-modular-reduction.md`: Phase 7 bootstrap. +- `docs/phases/PHASE-06-strategy-a-divergence-burndown.md`: mark Phase 6 + completed. +- `docs/harness/CURRENT.md`: move the active phase to Phase 7 and record the + modular-reduction target. +- `docs/harness/SOURCES.md`: record the Phase 7 phase file and review + workspace while preserving Phase 6 closeout evidence. +- `docs/harness/GATES.md`: document the Phase 7 bootstrap and modular-reduction + target gates. +- `scripts/harness/check-doc-freshness.sh`: require Phase 7 to be active while + preserving Phase 2 through Phase 6 evidence checks. +- `scripts/harness/doctor.sh`: require Phase 7 docs and review workspace. +- `reviews/PHASE-07/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + Phase 7 review workspace. + +## Gates To Implement + +- Bootstrap freshness: + `scripts/harness/check-doc-freshness.sh` passes only when Phase 7 is active, + the Phase 7 review workspace exists, Phase 6 is marked complete, and Phase 6 + clean-pin closeout evidence remains present. +- Source truth: + `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to + pass with only the known stale-worktree warning. +- Pin verification: + `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass + against the clean accepted VeIR dependency pin. +- Strict doctor: + `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- Build: + `lake build` succeeds. +- Certificate smoke: + `scripts/harness/cert-smoke.sh` passes against + `certs/felt-combine.cert.json`, including the Phase 7 `constant_fold_add` + parity change to `aligned`. +- Strategy A baseline: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` + reports `21 pass (incl. expected-diverge), 0 fail` with 9 PASS cases, + 11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. +- Target guard: + the Phase 7 docs and adversarial evidence identify `registered_add_wrap.llzk` + and `constant_fold_neg.llzk` as exact modular-reduction targets and preserve + their reclassification evidence. + +## Review Requirements + +- The reviewer must verify that Phase 6 findings are closed before Phase 7 + implementation work starts. +- The reviewer must verify that the Phase 7 target is limited to + registered-field modular reduction, not broad Strategy A acceptance. +- The reviewer must verify that expected-divergence polarity remains exact and + marker-driven. +- Every Phase 7 finding must be dispositioned before the phase closes. + +## Done Criteria + +- Phase 7 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- `docs/harness/CURRENT.md` names Phase 7 as active. +- `docs/harness/SOURCES.md` records Phase 7 and the Phase 6 closeout evidence. +- Freshness, source truth, pin verification, strict doctor, skill validation, + `lake build`, certificate smoke, and the clean-pin canonical differential + baseline pass. +- The first Phase 7 implementation target is complete: the registered-field + modular-reduction divergences are burned down without weakening the clean-pin + baseline or broadening unproved Strategy A claims. diff --git a/docs/phases/PHASE-08-strategy-a-field-preconditions.md b/docs/phases/PHASE-08-strategy-a-field-preconditions.md new file mode 100644 index 0000000..d5fe2b4 --- /dev/null +++ b/docs/phases/PHASE-08-strategy-a-field-preconditions.md @@ -0,0 +1,119 @@ +# Phase 8: Strategy A Field Preconditions + +Status: active +Last reviewed: 2026-06-10 +Repository: llzk-lean +Companion phase file: ../../../veir/docs/phases/PHASE-08-strategy-a-field-preconditions.md + +## Objective + +Bootstrap the next Strategy A burn-down after Phase 7's registered-field +modular-reduction closeout: make LLZK field-precondition parity the active +implementation target while preserving the clean-pin differential baseline and +exact `EXPECTED-*` polarity rules. + +Phase 8 starts from the Phase 7 clean dependency pin and the 21-input canonical +corpus. The first target is the remaining field-registry precondition +divergence where LLZK skips a bare `!felt.type` constant fold but VeIR still +folds it under canonicalization. + +## Starting State + +- llzk-lean HEAD at Phase 8 bootstrap: + `17ad33a335683ae5831288741542abf5f9a6c68a`. +- Workspace VeIR HEAD at Phase 8 bootstrap: + `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Consumed VeIR dependency pin: + `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Accepted LLZK source commit remains: + `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. +- Phase 7 closed the registered-field modular-reduction target with 9 PASS + cases, 11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` + parser/verifier gap over 21 inputs. +- Phase 7 adversarial review reports no open findings after certificate smoke, + source-ledger wording, and clean-pin canonical evidence were refreshed. + +## Target Cases + +- `differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk` + records LLZK's registered-field precondition: bare `!felt.type` constants do + not fold because no field name resolves through the accepted registry. VeIR + currently folds the same input. + +This is the first Phase 8 implementation target. The remaining nonconstant +algebraic canonicalization divergences stay classified as `EXPECTED-DIVERGE` +until there is a reviewed LLZK/VeIR behavior change and exact clean-pin +evidence. + +## Non-Goals + +- Do not claim full Strategy A acceptance from the current 21-input corpus. +- Do not change the accepted LLZK source commit or field-registry facts. +- Do not treat the workspace VeIR checkout as clean-pin evidence. +- Do not reclassify nonconstant algebraic rewrite divergences as positives + without a reviewed implementation change and exact clean-pin evidence. +- Do not add Strategy E certificates or runtime MLIR matching in this phase + bootstrap. + +## Artifacts To Create Or Update + +- `docs/phases/PHASE-08-strategy-a-field-preconditions.md`: Phase 8 bootstrap. +- `docs/phases/PHASE-07-strategy-a-modular-reduction.md`: mark Phase 7 + completed. +- `docs/harness/CURRENT.md`: move the active phase to Phase 8 and record the + field-precondition target. +- `docs/harness/SOURCES.md`: record the Phase 8 phase file and review + workspace while preserving Phase 7 closeout evidence. +- `docs/harness/GATES.md`: document the Phase 8 bootstrap and + field-precondition target gates. +- `scripts/harness/check-doc-freshness.sh`: require Phase 8 to be active while + preserving Phase 2 through Phase 7 evidence checks. +- `scripts/harness/doctor.sh`: require Phase 8 docs and review workspace. +- `reviews/PHASE-08/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: + Phase 8 review workspace. + +## Gates To Implement + +- Bootstrap freshness: + `scripts/harness/check-doc-freshness.sh` passes only when Phase 8 is active, + the Phase 8 review workspace exists, Phase 7 is marked complete, and Phase 7 + clean-pin closeout evidence remains present. +- Source truth: + `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` continues to + pass with only the known stale-worktree warning. +- Pin verification: + `scripts/harness/verify-pins.sh --workspace-veir ../veir` continues to pass + against the clean accepted VeIR dependency pin. +- Strict doctor: + `scripts/harness/doctor.sh --workspace-veir ../veir` continues to pass. +- Build: + `lake build` succeeds. +- Strategy A baseline: + `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` + continues to report `21 pass (incl. expected-diverge), 0 fail` with 9 PASS + cases, 11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. +- Target guard: + the Phase 8 docs and adversarial evidence identify `unspecified_add_fold.llzk` + as the exact field-precondition target and preserve all other remaining + canonical divergences. + +## Review Requirements + +- The reviewer must verify that Phase 7 findings are closed before Phase 8 + implementation work starts. +- The reviewer must verify that the Phase 8 target is limited to + field-precondition parity, not broad Strategy A acceptance. +- The reviewer must verify that expected-divergence polarity remains exact and + marker-driven. +- Every Phase 8 finding must be dispositioned before the phase closes. + +## Done Criteria + +- Phase 8 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- `docs/harness/CURRENT.md` names Phase 8 as active. +- `docs/harness/SOURCES.md` records Phase 8 and the Phase 7 closeout evidence. +- Freshness, source truth, pin verification, strict doctor, skill validation, + `lake build`, and the clean-pin canonical differential baseline pass. +- The first Phase 8 implementation target is complete: the bare/unknown-field + fold-precondition divergence is burned down without weakening the clean-pin + baseline or broadening unproved Strategy A claims. diff --git a/docs/strategy-a-oracle.md b/docs/strategy-a-oracle.md index a62c721..4623dbe 100644 --- a/docs/strategy-a-oracle.md +++ b/docs/strategy-a-oracle.md @@ -16,9 +16,10 @@ The harness supports two modes: - canonicalization mode: `llzk-opt --canonicalize` is compared against `veir-opt -p=felt-combine,dce`. -The workspace VeIR script now implements canonicalization mode. Until -llzk-lean bumps its clean VeIR pin, llzk-lean runs this implementation -with an explicit `VEIR_DIFF=../veir/scripts/llzk-diff.sh` override. +The clean llzk-lean VeIR dependency now implements canonicalization mode, so +the default evidence path uses the pinned dependency script without a +`VEIR_DIFF=../veir/scripts/llzk-diff.sh` override. Historical Phase 4 +workspace evidence still records that override as seed implementation context. ### Known alignment caveats (read before adding to the corpus) @@ -49,11 +50,11 @@ claims to `llzk-lib` commit outer-typed named-field `FeltConstAttr` remains classified as EXPECTED-LLZK-FAIL. -4. **VEIR's folds don't apply modular reduction.** LLZK's - `Field::reduce` in `lib/Util/Field.cpp` normalizes constants - modulo the prime; VEIR's `constant_fold_add` stores the raw - integer. For named-field inputs, this modular-reduction difference - is the expected arithmetic divergence to classify. +4. **Registered-field folds now apply modular reduction.** Phase 7 + aligns VeIR's registered-field add-wrap and negation folds with LLZK's + `Field::reduce` behavior. Phase 8 starts the follow-on + bare/unknown-field fold-precondition burn-down, with + `unspecified_add_fold.llzk` as the first target. The Phase 4 ordering is now: - Re-test the named-field corpus and keep the generic parser edge @@ -61,18 +62,17 @@ The Phase 4 ordering is now: - Enable canonicalization in the diff script and classify the first canonical divergences. - Add field-registry and modular-reduction parity on VEIR's side so - remaining modular-reduction corpus cases can move from expected-divergence - to positive coverage. + closed corpus cases can move from expected-divergence to positive + coverage. Without that ordering, named-field corpus additions will mostly document -the known modular-reduction gap rather than demonstrate alignment. +the known field-registry/precondition gaps rather than demonstrate alignment. When the outputs diverge, the harness reports the diff inline. The divergence is then classified as one of: -1. A canonical-form mismatch (e.g., VEIR's folds don't apply modular - reduction yet — see `../veir/REVIEW.md` VH3 for the current - parity-gap framing). +1. A canonical-form mismatch, such as a remaining field-registry or + rewrite-precondition parity gap. 2. An LLZK bug to file against `llzk-lib`. 3. A spec disagreement to escalate. @@ -120,7 +120,9 @@ Current state (2026-06-09): `docs/REVIEW.md`. - ✅ Clean-pin harness has a canonicalization mode. Phase 6's first burn-down pin runs VeIR `felt-combine,dce`, which reclassifies registered add/sub/mul - constant folds from expected divergence to positive coverage. + constant folds from expected divergence to positive coverage. Phase 7 now + reclassifies registered-field modular reduction for add-wrap and negation. + Phase 8 targets the remaining bare/unknown-field fold-precondition gap. - 🚧 CI workflow stubbed in `.github/workflows/differential.yml`. Skips green if `llzk-opt` not provisioned — CI provisioning is v1 work. @@ -130,7 +132,9 @@ Outstanding work to reach v1: 1. **Continue burning down classified divergences.** The consumed clean pin now invokes both tools with their canonicalize pipelines (`llzk-opt --canonicalize` and `veir-opt -p=felt-combine,dce`). The next - VeIR-side target is modular reduction for registered-field folds. + VeIR-side targets are the remaining classified algebraic and field + precondition divergences, starting with the Phase 8 + `unspecified_add_fold.llzk` target. 2. **Corpus expansion.** Hand-author a Felt corpus that exercises every pattern in VEIR's `Combine.lean` against an equivalent LLZK input. @@ -159,11 +163,9 @@ Outstanding work to reach v1: [`differential/corpus/README.md`](../differential/corpus/README.md) for the polarity convention. -6. **Field-registry parity.** VEIR currently folds constants without - modular reduction; LLZK does. Until VEIR's folds model the accepted - Field registry, named-field constant arithmetic can diverge - textually. Tracked in `../veir/REVIEW.md` VH3 — fix lives upstream - in VEIR, not in llzk-lean. +6. **Field-registry parity.** VEIR now reduces registered-field fold results, + but it still folds bare or unknown-field constants in cases LLZK can leave + unresolved. Phase 8 tracks this as the active field-precondition workstream. ## Effort diff --git a/docs/strategy-e-certificates.md b/docs/strategy-e-certificates.md index a5d8955..aa0d176 100644 --- a/docs/strategy-e-certificates.md +++ b/docs/strategy-e-certificates.md @@ -123,8 +123,8 @@ checker TCB small. {"kind": "attrInRegistry", "pos": "lhs", "attr": "fieldName", "registry": "field"} ], "theoremName": "Veir.Data.Felt.constant_fold_add", - "llzkParityStatus": "aligned-with-caveats", - "description": "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2). Caveat: LLZK applies modular reduction; VEIR's runtime fold stores c1+c2 unreduced." + "llzkParityStatus": "aligned", + "description": "felt.add (felt.const c1) (felt.const c2) → felt.const (c1+c2 reduced through the registered field)." }, ... ] diff --git a/lake-manifest.json b/lake-manifest.json index de4c7dd..7cbc817 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -5,10 +5,10 @@ "type": "git", "subDir": null, "scope": "", - "rev": "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953", + "rev": "8e9c08925fce1caf8d6eb1d69239aae263629802", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953", + "inputRev": "8e9c08925fce1caf8d6eb1d69239aae263629802", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", diff --git a/lakefile.toml b/lakefile.toml index 6af459a..731ed14 100644 --- a/lakefile.toml +++ b/lakefile.toml @@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] [[require]] name = "VeIR" git = "https://github.com/project-llzk/veir.git" -rev = "a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" +rev = "8e9c08925fce1caf8d6eb1d69239aae263629802" [[lean_lib]] name = "LlzkLean" diff --git a/reviews/PHASE-07/adversarial-review.md b/reviews/PHASE-07/adversarial-review.md new file mode 100644 index 0000000..8fc8242 --- /dev/null +++ b/reviews/PHASE-07/adversarial-review.md @@ -0,0 +1,54 @@ +# Phase 7 Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## Scope + +This review closes Phase 6 and covers the Phase 7 registered-field +modular-reduction execution. It verifies that Phase 6's DCE-only burn-down +remains supported by clean-pin evidence, then checks that the two Phase 7 target +cases are reclassified only after the VeIR implementation and clean-pin +differential evidence agree with LLZK. + +## Closeout Checks + +- Confirm Phase 6 findings are resolved and Phase 6 is marked completed. +- Confirm the Phase 6 clean-pin canonical corpus still records + `21 pass (incl. expected-diverge), 0 fail`. +- Confirm the consumed VeIR pin is + `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Confirm expected-divergence polarity remains exact and marker-driven. + +## Implementation Checks + +- Confirm `docs/harness/CURRENT.md` names Phase 7 as active. +- Confirm `docs/harness/SOURCES.md` records the Phase 7 phase file and review + workspace. +- Confirm `docs/harness/GATES.md` documents the Phase 7 burn-down target. +- Confirm Phase 7 targets only the registered-field modular-reduction cases: + `registered_add_wrap.llzk` and `constant_fold_neg.llzk`. +- Confirm those target cases moved from expected-divergence to the positive + corpus after VeIR commit `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Confirm the remaining expected-divergence set keeps exact marker polarity. +- Confirm Phase 7 helper defs do not inflate the Strategy E certificate + coverage count. +- Confirm certificate smoke passes after `constant_fold_add` moved to + `aligned`. +- Confirm Phase 7 is the only phase file still marked active. + +## Result + +The fresh review found one high-severity gate failure and one low-severity +documentation drift in addition to the earlier resolved issues. The high issue +was that `scripts/harness/cert-smoke.sh` failed because the checker snapshot +test still expected `constant_fold_add` to be `AlignedWithCaveats` after the +Phase 7 catalog moved it to `aligned`. The test and Phase 7 freshness evidence +are now updated, and the freshness gate requires certificate-smoke evidence. +The low issue was stale Phase 7 evidence/source-ledger wording; both are now +refreshed. + +The Phase 7 registered-field modular-reduction target is implemented and +verified by the clean-pin canonical corpus, certificate smoke, and the refreshed +phase gates. No Phase 6 closeout blocker or Phase 7 implementation blocker +remains. diff --git a/reviews/PHASE-07/disposition.md b/reviews/PHASE-07/disposition.md new file mode 100644 index 0000000..15df973 --- /dev/null +++ b/reviews/PHASE-07/disposition.md @@ -0,0 +1,31 @@ +# Phase 7 Disposition + +Repository: llzk-lean +Updated: 2026-06-10 + +F7-LLZK-01 is resolved by marking historical Phase 1 through Phase 3 phase +files completed and by gating that Phase 7 is the only active phase file. + +F7-LLZK-02 is resolved by making `#assertCatalogCoverage` filter for +rewrite-pattern-shaped defs instead of counting ordinary helpers under +`Veir.FeltPass`. + +F7-LLZK-03 is resolved by updating the checker snapshot test to expect +`constant_fold_add` as `aligned`, adding Phase 7 certificate-smoke evidence, +and requiring that evidence from `scripts/harness/check-doc-freshness.sh`. + +F7-LLZK-04 is resolved by refreshing the Phase 7 evidence README and source +ledger text so they describe the completed modular-reduction reclassification +instead of the earlier bootstrap state. + +The Phase 7 registered-field modular-reduction target is complete for +`registered_add_wrap.llzk` and `constant_fold_neg.llzk`: llzk-lean consumes +VeIR commit `8e9c08925fce1caf8d6eb1d69239aae263629802`, the two cases are +positive corpus inputs, and clean-pin canonical differential evidence remains +`21 pass (incl. expected-diverge), 0 fail`. + +No Phase 7 findings remain open. + +Phase 6 is closed by preserving the clean-pin `felt-combine,dce` baseline, +keeping exact expected-divergence polarity, and moving the active harness state +to Phase 7. diff --git a/reviews/PHASE-07/evidence/README.md b/reviews/PHASE-07/evidence/README.md new file mode 100644 index 0000000..a56d8dd --- /dev/null +++ b/reviews/PHASE-07/evidence/README.md @@ -0,0 +1,9 @@ +# Phase 7 Evidence + +Repository: llzk-lean +Created: 2026-06-10 + +This directory records the Phase 7 implementation gate outputs. Phase 7 keeps +the Phase 6 clean-pin corpus baseline, reclassifies the registered-field +modular-reduction target cases after the accepted VeIR pin, and records +certificate smoke evidence for the updated `constant_fold_add` parity. diff --git a/reviews/PHASE-07/evidence/adversarial-review.txt b/reviews/PHASE-07/evidence/adversarial-review.txt new file mode 100644 index 0000000..23caa82 --- /dev/null +++ b/reviews/PHASE-07/evidence/adversarial-review.txt @@ -0,0 +1,15 @@ +PASS: Phase 6 is marked completed before Phase 7 starts. +PASS: CURRENT names Phase 7 as active. +PASS: SOURCES records the Phase 7 phase file and review workspace. +PASS: GATES documents the Phase 7 burn-down target. +PASS: Phase 6 clean-pin canonical baseline remains preserved. +PASS: expected-divergence polarity remains exact and marker-driven. +PASS: only Phase 7 phase file remains marked active. +PASS: Phase 7 target is limited to registered-field modular reduction. +PASS: Phase 7 targets registered_add_wrap.llzk and constant_fold_neg.llzk. +PASS: modular-reduction targets are positive corpus cases after implementation. +PASS: cert coverage scanner reports 15 rewrite patterns and excludes helper defs. +PASS: certificate smoke passes after the constant_fold_add parity update. +PASS: Phase 7 evidence README and source ledger describe implemented modular-reduction state. +PASS: Phase 7 docs do not claim full Strategy A acceptance. +PASS: no Phase 7 findings remain open. diff --git a/reviews/PHASE-07/evidence/cert-smoke.txt b/reviews/PHASE-07/evidence/cert-smoke.txt new file mode 100644 index 0000000..c8d6427 --- /dev/null +++ b/reviews/PHASE-07/evidence/cert-smoke.txt @@ -0,0 +1,5 @@ +CERT-SMOKE: ctest schema/loader tests passed +CERT-SMOKE: theorem metadata present for 2/2 certs +CERT-SMOKE: driver cert summary passed +CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs +CERT-SMOKE: schema validation passed diff --git a/reviews/PHASE-07/evidence/check-doc-freshness.txt b/reviews/PHASE-07/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..20af1ca --- /dev/null +++ b/reviews/PHASE-07/evidence/check-doc-freshness.txt @@ -0,0 +1,265 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE-07-strategy-a-modular-reduction.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-04/evidence/README.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-05/evidence/README.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: found reviews/PHASE-06/evidence/README.md +PASS: found reviews/PHASE-07/disposition.md +PASS: found reviews/PHASE-07/findings.md +PASS: found reviews/PHASE-07/request.md +PASS: found reviews/PHASE-07/adversarial-review.md +PASS: found reviews/PHASE-07/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: only Phase 7 phase file is marked active +PASS: Phase 1 phase file is marked completed +PASS: Phase 2 phase file is marked completed +PASS: Phase 3 phase file is marked completed +PASS: Phase 4 phase file is marked completed +PASS: Phase 5 phase file is marked completed +PASS: Phase 6 phase file is marked completed +PASS: CURRENT no longer says corpus expansion is future work +PASS: CURRENT no longer says clean-pin corpus migration is only starting +PASS: CURRENT no longer describes the canonical corpus as seed-only +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES records Phase 4 phase file +PASS: SOURCES records Phase 5 phase file +PASS: SOURCES records Phase 6 phase file +PASS: SOURCES records Phase 7 phase file +PASS: SOURCES records Phase 4 implementation and fresh review evidence +PASS: SOURCES records Strategy A differential wrapper and corpus +PASS: SOURCES records accepted local llzk-opt binary +PASS: SOURCES records local llvm-project test infrastructure +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: Phase 4 disposition exists +PASS: Phase 5 disposition exists +PASS: Phase 6 disposition exists +PASS: Phase 7 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/README.md +PASS: evidence present reviews/PHASE-04/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-04/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-04/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-04/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review-fresh.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-bootstrap.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-canonicalize.txt +PASS: evidence present reviews/PHASE-04/evidence/corpus-classification.txt +PASS: evidence present reviews/PHASE-05/evidence/README.md +PASS: evidence present reviews/PHASE-05/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-05/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-05/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-05/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-05/evidence/skip-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/polarity-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-05/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-06/evidence/README.md +PASS: evidence present reviews/PHASE-06/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-06/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-06/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-06/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-06/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-07/evidence/README.md +PASS: evidence present reviews/PHASE-07/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-07/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-07/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-07/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-07/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-07/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-07/evidence/cert-smoke.txt +PASS: evidence present reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-07/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 4 source evidence reports no failures +PASS: Phase 4 pin evidence reports no failures +PASS: Phase 4 strict doctor evidence reports no failures +PASS: Phase 4 skill evidence reports no failures +PASS: Phase 4 lake build evidence reports success +PASS: Phase 4 adversarial evidence confirms llzk-opt is executable +PASS: Phase 4 adversarial evidence dispositions differential wrapper and corpus edits +PASS: Phase 4 parse/print differential evidence records workspace VeIR script +PASS: Phase 4 parse/print differential evidence reports no failures +PASS: Phase 4 canonical differential evidence records accepted llzk-opt +PASS: Phase 4 canonical differential evidence records canonicalization command +PASS: Phase 4 canonical differential evidence reports no failures +PASS: Phase 4 corpus evidence records canonical expected-divergence cases +PASS: Phase 4 fresh adversarial evidence records clean-pin guard +PASS: Phase 5 source evidence reports no failures +PASS: Phase 5 source evidence captures known stale llzk-lib warning detail +PASS: Phase 5 pin evidence reports no failures +PASS: Phase 5 strict doctor evidence reports no failures +PASS: Phase 5 skill evidence reports no failures +PASS: Phase 5 lake build evidence reports success +PASS: Phase 5 skip guard rejects missing-tool evidence +PASS: Phase 5 polarity guard rejects wrong expected-divergence failure mode +PASS: Phase 5 polarity guard records nonzero exit +PASS: Phase 5 clean-pin canonical evidence records default dependency command +PASS: Phase 5 clean-pin canonical evidence records expanded positive corpus +PASS: Phase 5 clean-pin canonical evidence records expanded expected-divergence corpus +PASS: Phase 5 clean-pin canonical evidence reports no failures +PASS: Phase 5 adversarial evidence records exact polarity guard +PASS: Phase 5 adversarial evidence reports no open findings +PASS: Phase 6 source evidence reports no failures +PASS: Phase 6 pin evidence reports no failures +PASS: Phase 6 strict doctor evidence reports no failures +PASS: Phase 6 skill evidence reports no failures +PASS: Phase 6 lake build evidence reports success +PASS: Phase 6 clean-pin canonical baseline reports no failures +PASS: Phase 6 adversarial evidence records Phase 5 closeout +PASS: Phase 6 adversarial evidence records exact polarity baseline +PASS: Phase 7 source evidence reports no failures +PASS: Phase 7 pin evidence reports no failures +PASS: Phase 7 strict doctor evidence reports no failures +PASS: Phase 7 skill evidence reports no failures +PASS: Phase 7 lake build evidence reports success +PASS: Phase 7 certificate smoke evidence reports success +PASS: Phase 7 certificate smoke evidence validates theorem metadata +PASS: Phase 7 clean-pin canonical baseline reports no failures +PASS: Phase 7 adversarial evidence records Phase 6 closeout +PASS: Phase 7 adversarial evidence records exact polarity baseline +PASS: Phase 7 adversarial evidence records singular active phase +PASS: Phase 7 adversarial evidence records target scope +PASS: Phase 7 adversarial evidence records target cases +PASS: Phase 7 adversarial evidence records certificate-smoke closeout +PASS: differential README records clean-pin expanded corpus status +PASS: differential README documents exact expected-divergence markers +PASS: differential README no longer calls the Phase 5 corpus intentionally small +PASS: differential README no longer calls the Phase 5 corpus a seed +PASS: differential README no longer carries the stale seed bar +PASS: corpus README documents expected LLZK failure polarity +PASS: corpus README documents expected VEIR failure polarity +PASS: corpus README documents exact output-divergence polarity +PASS: Phase 5 docs record clean-pin Strategy A corpus expansion +PASS: Phase 6 docs record divergence burn-down baseline +PASS: Phase 7 docs record modular-reduction target and baseline +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt new file mode 100644 index 0000000..50bffb8 --- /dev/null +++ b/reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt @@ -0,0 +1,23 @@ +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/add_const_swap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_mul.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_neg.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_sub.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/registered_add_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/registered_add_wrap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk + +Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) diff --git a/reviews/PHASE-07/evidence/doctor-workspace.txt b/reviews/PHASE-07/evidence/doctor-workspace.txt new file mode 100644 index 0000000..6cc993e --- /dev/null +++ b/reviews/PHASE-07/evidence/doctor-workspace.txt @@ -0,0 +1,87 @@ +PASS: tool git is available +PASS: tool lake is available +PASS: optional tool cmake is available +PASS: optional tool ctest is available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD 17ad33a33568 descends from bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE-07-strategy-a-modular-reduction.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: found reviews/PHASE-07/request.md +PASS: found reviews/PHASE-07/findings.md +PASS: found reviews/PHASE-07/disposition.md +PASS: found reviews/PHASE-07/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: 8e9c08925fce1caf8d6eb1d69239aae263629802 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 8e9c08925fce +PASS: lake-manifest.json pins VeIR 8e9c08925fce +PASS: lake-manifest.json inputRev pins VeIR 8e9c08925fce +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 8e9c08925fce +PASS: dependency checkout HEAD is 8e9c08925fce +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 8e9c08925fce + +pin verification summary: 0 fail, 0 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence +PASS: found reviews/PHASE-04/evidence +PASS: found reviews/PHASE-05/evidence +PASS: found reviews/PHASE-06/evidence +PASS: found reviews/PHASE-07/evidence + +doctor summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-07/evidence/lake-build.txt b/reviews/PHASE-07/evidence/lake-build.txt new file mode 100644 index 0000000..2ee66a9 --- /dev/null +++ b/reviews/PHASE-07/evidence/lake-build.txt @@ -0,0 +1,34 @@ +⚠ [39/461] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +ℹ [1234/1240] Replayed LlzkLean.CertValidate +info: LlzkLean/CertValidate.lean:147:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-07/evidence/validate-skills.txt b/reviews/PHASE-07/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-07/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-07/evidence/verify-llzk-source.txt b/reviews/PHASE-07/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..6919d68 --- /dev/null +++ b/reviews/PHASE-07/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is 8e9c08925fce +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned status +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-07/evidence/verify-pins.txt b/reviews/PHASE-07/evidence/verify-pins.txt new file mode 100644 index 0000000..aa12091 --- /dev/null +++ b/reviews/PHASE-07/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: 8e9c08925fce1caf8d6eb1d69239aae263629802 +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR 8e9c08925fce +PASS: lake-manifest.json pins VeIR 8e9c08925fce +PASS: lake-manifest.json inputRev pins VeIR 8e9c08925fce +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR 8e9c08925fce +PASS: dependency checkout HEAD is 8e9c08925fce +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin 8e9c08925fce + +pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-07/findings.md b/reviews/PHASE-07/findings.md new file mode 100644 index 0000000..1cc6b62 --- /dev/null +++ b/reviews/PHASE-07/findings.md @@ -0,0 +1,69 @@ +# Phase 7 Findings + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## F7-LLZK-01: Historical phase files still marked active + +Severity: low +Status: resolved + +After Phase 7 bootstrap, `docs/phases/PHASE-01-pins-and-repro.md`, +`PHASE-02-llzk-source-truth.md`, and +`PHASE-03-felt-op-gap-ledger.md` still said `Status: active`. That left +multiple phase files marked active even though `docs/harness/CURRENT.md` +correctly named Phase 7. + +Resolution: mark Phases 1 through 3 completed and superseded, keep Phase 7 as +the only active phase file, and add a freshness gate that fails if any phase +file other than Phase 7 is marked active. + +## F7-LLZK-02: Certificate coverage scanner counted a helper as a rewrite pattern + +Severity: low +Status: resolved + +After the Phase 7 VeIR pin added `foldedConstProperties`, fresh llzk-lean build +evidence reported 16 `Veir.FeltPass` rewrite-pattern defs instead of the +expected 15. The helper was not a rewrite pattern; the scanner was relying only +on namespace/name heuristics. + +Resolution: tighten `#assertCatalogCoverage` so a candidate pattern def must +have the rewrite-pattern type shape, i.e. its exported type mentions both +`Veir.PatternRewriter` and `Veir.OperationPtr`, before it contributes to the +coverage count. Fresh build evidence again reports 15 patterns, 2 cataloged, +and 13 uncovered. + +## F7-LLZK-03: Certificate smoke failed after the parity reclassification + +Severity: high +Status: resolved + +Phase 7 changed `constant_fold_add` from `aligned-with-caveats` to `aligned` +after registered-field fold results began reducing through the accepted field +registry. The committed certificate snapshot and Lean catalog were updated, but +`checker/tests/test_loader.cpp` still expected `AlignedWithCaveats` for the +committed snapshot. A direct `scripts/harness/cert-smoke.sh` run failed in +`loader_smoke_tests` on `cert[1] parity`. + +Resolution: update the checker snapshot test to expect +`LlzkParityStatus::Aligned` for `constant_fold_add`, record Phase 7 +certificate-smoke evidence, and make the freshness gate require that evidence +so future certificate/checker drift is caught by the phase gate. + +## F7-LLZK-04: Phase 7 evidence wording lagged the implementation + +Severity: low +Status: resolved + +The Phase 7 evidence README still described pre-implementation bootstrap state +and said modular-reduction targets had not been reclassified. The live source +ledger also described the consumed VeIR diff path only in Phase 6 DCE terms, +omitting that the accepted Phase 7 pin carries registered-field fold-result +reduction. + +Resolution: update the Phase 7 evidence README and source ledger so they +describe the implemented Phase 7 state and the accepted pin's registered-field +reduction behavior. + +No Phase 7 findings remain open. diff --git a/reviews/PHASE-07/request.md b/reviews/PHASE-07/request.md new file mode 100644 index 0000000..2297336 --- /dev/null +++ b/reviews/PHASE-07/request.md @@ -0,0 +1,27 @@ +# Phase 7 Review Request + +Repository: llzk-lean +Requested: 2026-06-10 + +Review the Phase 7 Strategy A modular-reduction execution. + +Scope: +- Phase 6 is completed and superseded by Phase 7. +- Phase 7 is active in harness docs and gates. +- The implementation target is limited to registered-field modular reduction + for `registered_add_wrap.llzk` and `constant_fold_neg.llzk`. +- The two target cases are reclassified as positive corpus cases only after + clean-pin evidence shows they match LLZK. +- Certificate smoke passes after the `constant_fold_add` parity + reclassification to `aligned`. +- The clean-pin canonical baseline remains `21 pass (incl. expected-diverge), + 0 fail` after the reclassification. +- Exact `EXPECTED-*` polarity remains required for all expected-divergence + inputs. + +Out of scope: +- Full Strategy A acceptance. +- New Strategy E certificate proof work beyond metadata parity for the closed + `constant_fold_add` caveat. +- Reclassification of nonconstant algebraic rewrite divergences before a + reviewed implementation change lands. diff --git a/reviews/PHASE-08/adversarial-review.md b/reviews/PHASE-08/adversarial-review.md new file mode 100644 index 0000000..3c1102d --- /dev/null +++ b/reviews/PHASE-08/adversarial-review.md @@ -0,0 +1,31 @@ +# Phase 8 Adversarial Review + +Repository: llzk-lean +Reviewed: 2026-06-10 + +## Scope + +This bootstrap review closes Phase 7 and checks that Phase 8 starts from the +clean-pin corpus baseline without claiming broad Strategy A acceptance. It also +checks that the first Phase 8 target is the field-precondition gap recorded by +`unspecified_add_fold.llzk`, not the remaining nonconstant algebraic rewrite +divergences. + +## Checks + +- Confirm Phase 7 findings are resolved and Phase 7 is marked completed. +- Confirm the Phase 7 clean-pin canonical corpus still records + `21 pass (incl. expected-diverge), 0 fail`. +- Confirm the consumed VeIR pin remains + `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Confirm expected-divergence polarity remains exact and marker-driven. +- Confirm `docs/harness/CURRENT.md` names Phase 8 as active. +- Confirm Phase 8 targets only + `expected-divergence/canonical/unspecified_add_fold.llzk`. +- Confirm nonconstant algebraic rewrite divergences remain out of scope until a + reviewed implementation change lands. + +## Result + +Accepted as a Phase 8 bootstrap. No Phase 7 closeout blocker or Phase 8 +bootstrap blocker remains. diff --git a/reviews/PHASE-08/disposition.md b/reviews/PHASE-08/disposition.md new file mode 100644 index 0000000..6a2b67b --- /dev/null +++ b/reviews/PHASE-08/disposition.md @@ -0,0 +1,11 @@ +# Phase 8 Disposition + +Repository: llzk-lean +Updated: 2026-06-10 + +No Phase 8 findings are open at bootstrap. + +Phase 8 starts from the completed Phase 7 registered-field modular-reduction +closeout. The first target is the remaining bare/unknown-field +fold-precondition divergence recorded by +`differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk`. diff --git a/reviews/PHASE-08/evidence/README.md b/reviews/PHASE-08/evidence/README.md new file mode 100644 index 0000000..5245f79 --- /dev/null +++ b/reviews/PHASE-08/evidence/README.md @@ -0,0 +1,8 @@ +# Phase 8 Evidence + +Repository: llzk-lean +Created: 2026-06-10 + +This directory records Phase 8 bootstrap evidence. Phase 8 starts from the +Phase 7 clean-pin corpus baseline and targets the bare/unknown-field +fold-precondition divergence in `unspecified_add_fold.llzk`. diff --git a/reviews/PHASE-08/evidence/adversarial-review.txt b/reviews/PHASE-08/evidence/adversarial-review.txt new file mode 100644 index 0000000..08eafe5 --- /dev/null +++ b/reviews/PHASE-08/evidence/adversarial-review.txt @@ -0,0 +1,12 @@ +PASS: Phase 7 is marked completed before Phase 8 starts. +PASS: CURRENT names Phase 8 as active. +PASS: SOURCES records the Phase 8 phase file and review workspace. +PASS: GATES documents the Phase 8 field-precondition target. +PASS: Phase 7 clean-pin canonical baseline remains preserved. +PASS: expected-divergence polarity remains exact and marker-driven. +PASS: only Phase 8 phase file remains marked active. +PASS: Phase 8 target is limited to bare/unknown-field fold-precondition parity. +PASS: Phase 8 targets unspecified_add_fold.llzk. +PASS: nonconstant algebraic rewrite divergences remain out of scope. +PASS: Phase 8 docs do not claim full Strategy A acceptance. +PASS: no Phase 8 findings are open at bootstrap. diff --git a/reviews/PHASE-08/findings.md b/reviews/PHASE-08/findings.md new file mode 100644 index 0000000..6fa958d --- /dev/null +++ b/reviews/PHASE-08/findings.md @@ -0,0 +1,6 @@ +# Phase 8 Findings + +Repository: llzk-lean +Reviewed: 2026-06-10 + +No Phase 8 findings are open at bootstrap. diff --git a/reviews/PHASE-08/request.md b/reviews/PHASE-08/request.md new file mode 100644 index 0000000..5f62f11 --- /dev/null +++ b/reviews/PHASE-08/request.md @@ -0,0 +1,23 @@ +# Phase 8 Review Request + +Repository: llzk-lean +Requested: 2026-06-10 + +Review the Phase 8 Strategy A field-precondition bootstrap. + +Scope: +- Phase 7 is completed and superseded by Phase 8. +- Phase 8 is active in harness docs and gates. +- The implementation target is limited to bare/unknown-field fold-precondition + parity for `unspecified_add_fold.llzk`. +- The clean-pin canonical baseline remains `21 pass (incl. expected-diverge), + 0 fail` with 9 PASS cases, 11 `EXPECTED-DIVERGE` canonical cases, and + 1 `EXPECTED-LLZK-FAIL`. +- Exact `EXPECTED-*` polarity remains required for all expected-divergence + inputs. + +Out of scope: +- Full Strategy A acceptance. +- Reclassification of nonconstant algebraic rewrite divergences before a + reviewed implementation change lands. +- New Strategy E certificate proof work or runtime MLIR matching. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index f85df5a..cb9e9f0 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -4,7 +4,7 @@ set -u ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" FAIL=0 -ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" +ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" fail() { @@ -87,6 +87,8 @@ require_file docs/phases/PHASE-03-felt-op-gap-ledger.md require_file docs/phases/PHASE-04-strategy-a-differential.md require_file docs/phases/PHASE-05-strategy-a-pin-and-corpus.md require_file docs/phases/PHASE-06-strategy-a-divergence-burndown.md +require_file docs/phases/PHASE-07-strategy-a-modular-reduction.md +require_file docs/phases/PHASE-08-strategy-a-field-preconditions.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md @@ -123,8 +125,18 @@ require_file reviews/PHASE-06/findings.md require_file reviews/PHASE-06/request.md require_file reviews/PHASE-06/adversarial-review.md require_file reviews/PHASE-06/evidence/README.md - -phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-06-strategy-a-divergence-burndown.md" | head -1)" +require_file reviews/PHASE-07/disposition.md +require_file reviews/PHASE-07/findings.md +require_file reviews/PHASE-07/request.md +require_file reviews/PHASE-07/adversarial-review.md +require_file reviews/PHASE-07/evidence/README.md +require_file reviews/PHASE-08/disposition.md +require_file reviews/PHASE-08/findings.md +require_file reviews/PHASE-08/request.md +require_file reviews/PHASE-08/adversarial-review.md +require_file reviews/PHASE-08/evidence/README.md + +phase_date="$(sed -n 's/^Last reviewed: //p' "${ROOT}/docs/phases/PHASE-08-strategy-a-field-preconditions.md" | head -1)" if [[ "$phase_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then ok "phase review date has ISO format" else @@ -140,13 +152,26 @@ for doc in docs/harness/CURRENT.md docs/harness/SOURCES.md docs/harness/GATES.md fi done -if grep -q "Active phase: Phase 6" "${ROOT}/docs/harness/CURRENT.md"; then +if grep -q "Active phase: Phase 8" "${ROOT}/docs/harness/CURRENT.md"; then ok "CURRENT names active phase" else - fail "CURRENT does not name Phase 6 as active" + fail "CURRENT does not name Phase 8 as active" +fi + +active_phase_files="$(grep -Rl '^Status: active$' "${ROOT}/docs/phases"/PHASE-*.md 2>/dev/null | sed "s#${ROOT}/##" | sort)" +if [[ "$active_phase_files" == "docs/phases/PHASE-08-strategy-a-field-preconditions.md" ]]; then + ok "only Phase 8 phase file is marked active" +else + fail "unexpected active phase files: ${active_phase_files:-}" fi +require_contains docs/phases/PHASE-01-pins-and-repro.md "Status: completed; superseded by Phase 2" "Phase 1 phase file is marked completed" +require_contains docs/phases/PHASE-02-llzk-source-truth.md "Status: completed; superseded by Phase 3" "Phase 2 phase file is marked completed" +require_contains docs/phases/PHASE-03-felt-op-gap-ledger.md "Status: completed; superseded by Phase 4" "Phase 3 phase file is marked completed" +require_contains docs/phases/PHASE-04-strategy-a-differential.md "Status: completed; superseded by Phase 5" "Phase 4 phase file is marked completed" require_contains docs/phases/PHASE-05-strategy-a-pin-and-corpus.md "Status: completed; superseded by Phase 6" "Phase 5 phase file is marked completed" +require_contains docs/phases/PHASE-06-strategy-a-divergence-burndown.md "Status: completed; superseded by Phase 7" "Phase 6 phase file is marked completed" +require_contains docs/phases/PHASE-07-strategy-a-modular-reduction.md "Status: completed; superseded by Phase 8" "Phase 7 phase file is marked completed" require_not_contains docs/harness/CURRENT.md "corpus expansion beyond the seed set remains the next" "CURRENT no longer says corpus expansion is future work" require_not_contains docs/harness/CURRENT.md "starts moving the corpus evidence" "CURRENT no longer says clean-pin corpus migration is only starting" @@ -188,6 +213,18 @@ else fail "SOURCES does not record docs/phases/PHASE-06-strategy-a-divergence-burndown.md" fi +if grep -q "docs/phases/PHASE-07-strategy-a-modular-reduction.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 7 phase file" +else + fail "SOURCES does not record docs/phases/PHASE-07-strategy-a-modular-reduction.md" +fi + +if grep -q "docs/phases/PHASE-08-strategy-a-field-preconditions.md" "${ROOT}/docs/harness/SOURCES.md"; then + ok "SOURCES records Phase 8 phase file" +else + fail "SOURCES does not record docs/phases/PHASE-08-strategy-a-field-preconditions.md" +fi + if grep -q "reviews/PHASE-04/evidence/differential-canonicalize.txt" "${ROOT}/docs/harness/SOURCES.md" && grep -q "reviews/PHASE-04/evidence/adversarial-review-fresh.txt" "${ROOT}/docs/harness/SOURCES.md"; then ok "SOURCES records Phase 4 implementation and fresh review evidence" @@ -280,6 +317,18 @@ else fail "Phase 6 disposition is not populated" fi +if grep -q "# Phase 7 Disposition" "${ROOT}/reviews/PHASE-07/disposition.md"; then + ok "Phase 7 disposition exists" +else + fail "Phase 7 disposition is not populated" +fi + +if grep -q "# Phase 8 Disposition" "${ROOT}/reviews/PHASE-08/disposition.md"; then + ok "Phase 8 disposition exists" +else + fail "Phase 8 disposition is not populated" +fi + for evidence in \ reviews/PHASE-02/evidence/llzk-lib-refs.txt \ reviews/PHASE-02/evidence/llzk-field-registry.txt \ @@ -347,6 +396,26 @@ for evidence in \ require_nonempty "$evidence" done +for evidence in \ + reviews/PHASE-07/evidence/README.md \ + reviews/PHASE-07/evidence/check-doc-freshness.txt \ + reviews/PHASE-07/evidence/verify-llzk-source.txt \ + reviews/PHASE-07/evidence/verify-pins.txt \ + reviews/PHASE-07/evidence/doctor-workspace.txt \ + reviews/PHASE-07/evidence/validate-skills.txt \ + reviews/PHASE-07/evidence/lake-build.txt \ + reviews/PHASE-07/evidence/cert-smoke.txt \ + reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt \ + reviews/PHASE-07/evidence/adversarial-review.txt; do + require_nonempty "$evidence" +done + +for evidence in \ + reviews/PHASE-08/evidence/README.md \ + reviews/PHASE-08/evidence/adversarial-review.txt; do + require_nonempty "$evidence" +done + require_contains reviews/PHASE-03/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "verify-llzk-source evidence reports no failures" require_contains reviews/PHASE-03/evidence/verify-pins.txt "pin verification summary: 0 fail" "pin evidence reports no failures" require_contains reviews/PHASE-03/evidence/doctor-workspace.txt "doctor summary: 0 fail" "strict doctor evidence reports no failures" @@ -392,6 +461,25 @@ require_contains reviews/PHASE-06/evidence/lake-build.txt "Build completed succe require_contains reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 6 clean-pin canonical baseline reports no failures" require_contains reviews/PHASE-06/evidence/adversarial-review.txt "PASS: Phase 5 is marked completed before Phase 6 starts." "Phase 6 adversarial evidence records Phase 5 closeout" require_contains reviews/PHASE-06/evidence/adversarial-review.txt "PASS: expected-divergence polarity remains exact and marker-driven." "Phase 6 adversarial evidence records exact polarity baseline" +require_contains reviews/PHASE-07/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "Phase 7 source evidence reports no failures" +require_contains reviews/PHASE-07/evidence/verify-pins.txt "pin verification summary: 0 fail" "Phase 7 pin evidence reports no failures" +require_contains reviews/PHASE-07/evidence/doctor-workspace.txt "doctor summary: 0 fail" "Phase 7 strict doctor evidence reports no failures" +require_contains reviews/PHASE-07/evidence/validate-skills.txt "skill validation summary: 0 fail" "Phase 7 skill evidence reports no failures" +require_contains reviews/PHASE-07/evidence/lake-build.txt "Build completed successfully" "Phase 7 lake build evidence reports success" +require_contains reviews/PHASE-07/evidence/cert-smoke.txt "CERT-SMOKE: schema validation passed" "Phase 7 certificate smoke evidence reports success" +require_contains reviews/PHASE-07/evidence/cert-smoke.txt "CERT-SMOKE: theorem metadata present for 2/2 certs" "Phase 7 certificate smoke evidence validates theorem metadata" +require_contains reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 7 clean-pin canonical baseline reports no failures" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: Phase 6 is marked completed before Phase 7 starts." "Phase 7 adversarial evidence records Phase 6 closeout" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: expected-divergence polarity remains exact and marker-driven." "Phase 7 adversarial evidence records exact polarity baseline" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: only Phase 7 phase file remains marked active." "Phase 7 adversarial evidence records singular active phase" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: Phase 7 target is limited to registered-field modular reduction." "Phase 7 adversarial evidence records target scope" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: Phase 7 targets registered_add_wrap.llzk and constant_fold_neg.llzk." "Phase 7 adversarial evidence records target cases" +require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: certificate smoke passes after the constant_fold_add parity update." "Phase 7 adversarial evidence records certificate-smoke closeout" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 7 is marked completed before Phase 8 starts." "Phase 8 adversarial evidence records Phase 7 closeout" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: expected-divergence polarity remains exact and marker-driven." "Phase 8 adversarial evidence records exact polarity baseline" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: only Phase 8 phase file remains marked active." "Phase 8 adversarial evidence records singular active phase" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 target is limited to bare/unknown-field fold-precondition parity." "Phase 8 adversarial evidence records target scope" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 targets unspecified_add_fold.llzk." "Phase 8 adversarial evidence records target case" require_contains differential/README.md "clean-pin expanded corpus" "differential README records clean-pin expanded corpus status" require_contains differential/README.md "The directory is not a wildcard" "differential README documents exact expected-divergence markers" require_not_contains differential/README.md "still intentionally small" "differential README no longer calls the Phase 5 corpus intentionally small" @@ -415,6 +503,25 @@ else fail "Phase 6 docs do not record divergence burn-down baseline" fi +if grep -q "Phase 7: Strategy A Modular Reduction" "${ROOT}/docs/phases/PHASE-07-strategy-a-modular-reduction.md" && + grep -q "registered-field modular reduction" "${ROOT}/docs/phases/PHASE-07-strategy-a-modular-reduction.md" && + grep -q "registered_add_wrap.llzk" "${ROOT}/docs/phases/PHASE-07-strategy-a-modular-reduction.md" && + grep -q "constant_fold_neg.llzk" "${ROOT}/docs/phases/PHASE-07-strategy-a-modular-reduction.md" && + grep -q "21 pass (incl. expected-diverge), 0 fail" "${ROOT}/docs/phases/PHASE-07-strategy-a-modular-reduction.md"; then + ok "Phase 7 docs record modular-reduction target and baseline" +else + fail "Phase 7 docs do not record modular-reduction target and baseline" +fi + +if grep -q "Phase 8: Strategy A Field Preconditions" "${ROOT}/docs/phases/PHASE-08-strategy-a-field-preconditions.md" && + grep -q "field-precondition" "${ROOT}/docs/phases/PHASE-08-strategy-a-field-preconditions.md" && + grep -q "unspecified_add_fold.llzk" "${ROOT}/docs/phases/PHASE-08-strategy-a-field-preconditions.md" && + grep -q "21 pass (incl. expected-diverge), 0 fail" "${ROOT}/docs/phases/PHASE-08-strategy-a-field-preconditions.md"; then + ok "Phase 8 docs record field-precondition target and baseline" +else + fail "Phase 8 docs do not record field-precondition target and baseline" +fi + if grep -Fq -- "$ACCEPTED_LLZK_REMOTE" "${ROOT}/reviews/PHASE-02/evidence/llzk-lib-refs.txt"; then ok "Phase 2 llzk-lib ref evidence records accepted remote" else diff --git a/scripts/harness/doctor.sh b/scripts/harness/doctor.sh index 85ddc4a..c7807b9 100755 --- a/scripts/harness/doctor.sh +++ b/scripts/harness/doctor.sh @@ -131,6 +131,8 @@ require_file docs/phases/PHASE-03-felt-op-gap-ledger.md require_file docs/phases/PHASE-04-strategy-a-differential.md require_file docs/phases/PHASE-05-strategy-a-pin-and-corpus.md require_file docs/phases/PHASE-06-strategy-a-divergence-burndown.md +require_file docs/phases/PHASE-07-strategy-a-modular-reduction.md +require_file docs/phases/PHASE-08-strategy-a-field-preconditions.md require_file docs/phases/PHASE_TEMPLATE.md require_file docs/harness/CURRENT.md require_file docs/harness/SOURCES.md @@ -167,6 +169,14 @@ require_file reviews/PHASE-06/request.md require_file reviews/PHASE-06/findings.md require_file reviews/PHASE-06/disposition.md require_file reviews/PHASE-06/adversarial-review.md +require_file reviews/PHASE-07/request.md +require_file reviews/PHASE-07/findings.md +require_file reviews/PHASE-07/disposition.md +require_file reviews/PHASE-07/adversarial-review.md +require_file reviews/PHASE-08/request.md +require_file reviews/PHASE-08/findings.md +require_file reviews/PHASE-08/disposition.md +require_file reviews/PHASE-08/adversarial-review.md require_executable scripts/harness/check-doc-freshness.sh require_executable scripts/harness/diff-smoke.sh require_executable scripts/harness/cert-smoke.sh @@ -226,6 +236,18 @@ else fail "missing reviews/PHASE-06/evidence" fi +if [[ -d "${ROOT}/reviews/PHASE-07/evidence" ]]; then + ok "found reviews/PHASE-07/evidence" +else + fail "missing reviews/PHASE-07/evidence" +fi + +if [[ -d "${ROOT}/reviews/PHASE-08/evidence" ]]; then + ok "found reviews/PHASE-08/evidence" +else + fail "missing reviews/PHASE-08/evidence" +fi + echo echo "doctor summary: ${FAIL} fail, ${WARN} warn, mode=${MODE}" if [[ "$FAIL" -ne 0 ]]; then diff --git a/scripts/harness/verify-llzk-source.sh b/scripts/harness/verify-llzk-source.sh index cab96b6..698712e 100755 --- a/scripts/harness/verify-llzk-source.sh +++ b/scripts/harness/verify-llzk-source.sh @@ -9,7 +9,7 @@ ACCEPTED_LLZK_COMMIT="db922857bc5a88a9107627ef6b36a8b5e57bc5c2" ACCEPTED_LLZK_SHORT="${ACCEPTED_LLZK_COMMIT:0:12}" ACCEPTED_LLZK_REF="origin/main" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" -ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" +ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" FIELD_REGISTRY_PATH="lib/Util/Field.cpp" @@ -373,9 +373,9 @@ check_local_text docs/strategy-e-certificates.md '"attrInRegistry"' "Strategy E check_local_text LlzkLean/Cert.lean '(patternId := "constant_fold_add")' "Lean cert catalog contains constant_fold_add" check_local_text LlzkLean/Cert.lean '.sameAttr "fieldName" ["lhs", "rhs"]' "Lean cert catalog requires same fieldName" check_local_text LlzkLean/Cert.lean '.attrInRegistry "lhs" "fieldName" "field"' "Lean cert catalog requires registered fieldName" -check_local_text LlzkLean/Cert.lean '(llzkParityStatus := .alignedWithCaveats)' "Lean cert catalog marks constant_fold_add aligned-with-caveats" +check_local_text LlzkLean/Cert.lean '(llzkParityStatus := .aligned)' "Lean cert catalog marks constant_fold_add aligned" check_local_text certs/felt-combine.cert.json '"patternId":"constant_fold_add"' "cert snapshot contains constant_fold_add" -check_local_text certs/felt-combine.cert.json '"llzkParityStatus":"aligned-with-caveats"' "cert snapshot records aligned-with-caveats" +check_local_text certs/felt-combine.cert.json '"llzkParityStatus":"aligned"' "cert snapshot records aligned status" check_local_text certs/felt-combine.cert.json '"kind":"sameAttr","attr":"fieldName","positions":["lhs","rhs"]' "cert snapshot requires same fieldName" check_local_text certs/felt-combine.cert.json '"kind":"attrInRegistry","pos":"lhs","attr":"fieldName","registry":"field"' "cert snapshot requires registered fieldName" diff --git a/scripts/harness/verify-pins.sh b/scripts/harness/verify-pins.sh index 5362ea0..3904c1c 100755 --- a/scripts/harness/verify-pins.sh +++ b/scripts/harness/verify-pins.sh @@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -ACCEPTED_VEIR_COMMIT="a0bb2fc8e6d38ab068247dfc6506ba63f5feb953" +ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" ACCEPTED_VEIR_REMOTE="https://github.com/project-llzk/veir.git" ACCEPTED_VEIR_BRANCH="felt-review-structural-close" From 4589d1f3777378f76188b5ac59431f26987ab7d5 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 22:29:06 +0100 Subject: [PATCH 11/16] Close Phase 8 field preconditions --- differential/README.md | 15 +- differential/corpus/README.md | 10 +- .../unspecified_add_fold.llzk | 6 +- docs/harness/CURRENT.md | 27 +- docs/harness/FELT_OP_GAPS.md | 4 +- docs/harness/GATES.md | 22 +- docs/harness/PINS.md | 10 +- docs/harness/SOURCES.md | 6 +- ...PHASE-08-strategy-a-field-preconditions.md | 57 ++-- docs/strategy-a-oracle.md | 21 +- lake-manifest.json | 4 +- lakefile.toml | 2 +- reviews/PHASE-08/adversarial-review.md | 23 +- reviews/PHASE-08/disposition.md | 13 +- reviews/PHASE-08/evidence/README.md | 20 +- .../PHASE-08/evidence/adversarial-review.txt | 8 +- reviews/PHASE-08/evidence/cert-smoke.txt | 5 + .../PHASE-08/evidence/check-doc-freshness.txt | 304 ++++++++++++++++++ .../differential-clean-pin-canonicalize.txt | 23 ++ .../PHASE-08/evidence/doctor-workspace.txt | 93 ++++++ reviews/PHASE-08/evidence/lake-build.txt | 37 +++ reviews/PHASE-08/evidence/validate-skills.txt | 22 ++ .../PHASE-08/evidence/verify-llzk-source.txt | 119 +++++++ reviews/PHASE-08/evidence/verify-pins.txt | 15 + reviews/PHASE-08/findings.md | 21 +- reviews/PHASE-08/request.md | 6 +- scripts/harness/check-doc-freshness.sh | 26 +- scripts/harness/verify-llzk-source.sh | 2 +- scripts/harness/verify-pins.sh | 2 +- 29 files changed, 814 insertions(+), 109 deletions(-) rename differential/corpus/{expected-divergence/canonical => felt}/unspecified_add_fold.llzk (53%) create mode 100644 reviews/PHASE-08/evidence/cert-smoke.txt create mode 100644 reviews/PHASE-08/evidence/check-doc-freshness.txt create mode 100644 reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt create mode 100644 reviews/PHASE-08/evidence/doctor-workspace.txt create mode 100644 reviews/PHASE-08/evidence/lake-build.txt create mode 100644 reviews/PHASE-08/evidence/validate-skills.txt create mode 100644 reviews/PHASE-08/evidence/verify-llzk-source.txt create mode 100644 reviews/PHASE-08/evidence/verify-pins.txt diff --git a/differential/README.md b/differential/README.md index 7b82063..ebe7f3f 100644 --- a/differential/README.md +++ b/differential/README.md @@ -12,7 +12,7 @@ specific corpus and reporting. ## Status -**Canonicalization-aware, clean-pin expanded corpus with Phase 8 bootstrap.** +**Canonicalization-aware, clean-pin expanded corpus with Phase 8 burn-down.** `run-differential.sh` wraps VEIR's script, supports parse/print mode and canonicalization mode, and classifies output divergence, LLZK failure, VEIR failure, missing tools, and mode-skipped corpus entries @@ -21,9 +21,10 @@ Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, with registered add/sub/mul constant folds reclassified to PASS after VeIR canonical mode started running `felt-combine,dce`. Phase 7 reclassifies the registered-field add-wrap and negation folds after VeIR began reducing -registered fold results through the accepted field registry. Phase 8 starts -from that baseline and targets the remaining bare/unknown-field fold -precondition gap. This is not full Strategy A acceptance coverage. +registered fold results through the accepted field registry. Phase 8 +reclassifies the bare `!felt.type` add-fold precondition case after VeIR began +skipping folds whose field does not resolve through the accepted registry. This +is not full Strategy A acceptance coverage. ## Running locally @@ -75,7 +76,7 @@ non-zero if any input lands in the FAIL column. ## Corpus expansion targets -Current Phase 8 bootstrap bar: +Current Phase 8 implementation bar: - `corpus/felt/const_identities.mlir` — live const proof-of-life. - `corpus/felt/types_smoke.llzk` — custom-asm lowering smoke. - `corpus/felt/arithmetic_no_fold.llzk` — canonical no-fire arithmetic. @@ -88,8 +89,8 @@ Current Phase 8 bootstrap bar: - `corpus/felt/registered_add_wrap.llzk` and `corpus/felt/constant_fold_neg.llzk` — Phase 7 positives closed by registered-field modular reduction in VeIR folds. -- `corpus/expected-divergence/canonical/unspecified_add_fold.llzk` — Phase 8 - target for unresolved bare/unknown-field fold preconditions. +- `corpus/felt/unspecified_add_fold.llzk` — Phase 8 positive no-fold case for + bare/unknown-field fold preconditions. - The remaining `corpus/expected-divergence/canonical/*` files — classified clean-pin canonicalization gaps for VeIR-only algebraic rewrites. - `corpus/README.md` — the current 21-input inventory and 15-pattern diff --git a/differential/corpus/README.md b/differential/corpus/README.md index cfd74ed..87d2629 100644 --- a/differential/corpus/README.md +++ b/differential/corpus/README.md @@ -84,6 +84,7 @@ produced no parse/print or canonicalization evidence. | `felt/constant_fold_mul.llzk` | PASS | Registered-field multiplication folds to 42; Phase 6 `felt-combine,dce` aligns VeIR with LLZK's dead-input cleanup | | `felt/registered_add_wrap.llzk` | PASS | Registered-field add folds through babybear reduction; Phase 7 aligns VeIR with LLZK's reduced result | | `felt/constant_fold_neg.llzk` | PASS | Registered-field negation folds through babybear reduction; Phase 7 aligns VeIR with LLZK's reduced result | +| `felt/unspecified_add_fold.llzk` | PASS | Bare `!felt.type` add remains unfired; Phase 8 aligns VeIR with LLZK's registered-field fold precondition | | `expected-divergence/named_field_const.mlir` | EXPECTED-LLZK-FAIL | Generic named-field FeltConstAttr still fails on LLZK's parser/verifier path | | `expected-divergence/canonical/add_neg_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x + (-x)` to zero; LLZK leaves the non-constant add/neg pair in place | | `expected-divergence/canonical/add_sub_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x + c) - c` to `x`; LLZK leaves the add/sub pair in place | @@ -95,17 +96,16 @@ produced no parse/print or canonicalization evidence. | `expected-divergence/canonical/right_zero_mul.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x * 0` to zero; LLZK leaves the non-constant multiplication in place | | `expected-divergence/canonical/self_subtraction_to_zero.llzk` | EXPECTED-DIVERGE | VeIR rewrites `x - x` to zero; LLZK leaves the non-constant subtraction in place | | `expected-divergence/canonical/sub_add_const_cancel.llzk` | EXPECTED-DIVERGE | VeIR rewrites `(x - c) + c` to `x`; LLZK leaves the sub/add pair in place | -| `expected-divergence/canonical/unspecified_add_fold.llzk` | EXPECTED-DIVERGE | LLZK skips bare `!felt.type` binary folds; VEIR currently folds them | -The current Phase 8 bootstrap clean-pin canonical corpus records 9 PASS cases, -11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` +The current Phase 8 implementation clean-pin canonical corpus records 10 PASS cases, +10 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap. The run reports: ```text Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) ``` -## Phase 8 bootstrap rewrite-pattern coverage +## Phase 8 implementation rewrite-pattern coverage This matrix tracks coverage against the 15 `Veir.FeltPass` rewrite-pattern definitions. It is not a Strategy A acceptance claim: `EXPECTED-DIVERGE` means @@ -115,7 +115,7 @@ gate. | VeIR pattern | Corpus status | Corpus file | |---|---|---| | `right_identity_zero_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_zero_add.llzk` | -| `constant_fold_add` | PASS | `felt/registered_add_fold.llzk`, `felt/registered_add_wrap.llzk` | +| `constant_fold_add` | PASS | `felt/registered_add_fold.llzk`, `felt/registered_add_wrap.llzk`; no-fire precondition coverage in `felt/unspecified_add_fold.llzk` | | `self_subtraction_to_zero` | EXPECTED-DIVERGE | `expected-divergence/canonical/self_subtraction_to_zero.llzk` | | `assoc_const_fold_add` | EXPECTED-DIVERGE | `expected-divergence/canonical/assoc_const_fold_add.llzk` | | `right_identity_one_mul` | EXPECTED-DIVERGE | `expected-divergence/canonical/right_identity_one_mul.llzk` | diff --git a/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk b/differential/corpus/felt/unspecified_add_fold.llzk similarity index 53% rename from differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk rename to differential/corpus/felt/unspecified_add_fold.llzk index 5a90139..c6256ba 100644 --- a/differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk +++ b/differential/corpus/felt/unspecified_add_fold.llzk @@ -1,8 +1,8 @@ -// EXPECTED-DIVERGE in canonicalization mode. +// Phase 8: bare felt-type binary folds stay unfired. // // LLZK intentionally skips binary Felt folds when either operand has no -// registered field name. VEIR currently folds bare `!felt.type` constants. -// This records the field-registry precondition gap. +// registered field name. VEIR now mirrors that field-precondition behavior, so +// canonicalization leaves this bare `!felt.type` add in place. function.def @no_fold_unspecified_add() -> !felt.type { %a = felt.const 5 diff --git a/docs/harness/CURRENT.md b/docs/harness/CURRENT.md index 9c4c56d..e102e90 100644 --- a/docs/harness/CURRENT.md +++ b/docs/harness/CURRENT.md @@ -12,7 +12,7 @@ Last reviewed: 2026-06-10 ## Accepted VeIR Pin - Accepted VeIR commit: - `8e9c08925fce1caf8d6eb1d69239aae263629802`. + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - Accepted source branch: `felt-review-structural-close`. - Accepted source remote: `https://github.com/project-llzk/veir.git`. - Pin mode: remote commit, consumed through Lake metadata and a clean @@ -78,8 +78,11 @@ the clean dependency checkout remains the source of truth. DCE-only registered add/sub/mul fold cases after the clean VeIR driver began running `felt-combine,dce`. Phase 7 reclassified the registered-field modular-reduction add-wrap and negation cases after VeIR began reducing fold - results through the accepted registry. The corpus covers all 15 current VeIR - Felt rewrite-pattern definitions as PASS or EXPECTED-DIVERGE, plus one + results through the accepted registry. Phase 8 reclassified the bare + `!felt.type` add-fold precondition case after VeIR began skipping folds whose + field name does not resolve through the accepted registry. The corpus covers + all 15 current VeIR Felt rewrite-pattern definitions as PASS or + EXPECTED-DIVERGE, plus one EXPECTED-LLZK-FAIL parser/verifier gap, but this is not full Strategy A acceptance. - The local `../llzk-lib` worktree is behind fetched `origin/main`. Current @@ -92,13 +95,12 @@ the clean dependency checkout remains the source of truth. file-header markers. Phase 6's first burn-down target aligned VeIR's canonical diff path with LLZK's dead-input cleanup by consuming the DCE-enabled VeIR pin. Phase 7 targeted registered-field modular reduction for - `registered_add_wrap.llzk` and `constant_fold_neg.llzk`. Phase 8 starts from - that baseline and targets field-precondition parity for - `unspecified_add_fold.llzk`. + `registered_add_wrap.llzk` and `constant_fold_neg.llzk`. Phase 8 consumed the + VeIR field-precondition pin and reclassified `unspecified_add_fold.llzk`. ## Acceptance Rule -Phase 8 bootstrap is current only when: +Phase 8 implementation state is current only when: - `docs/harness/FELT_OP_GAPS.md` records every accepted LLZK Felt mnemonic and explicitly marks unsupported Strategy A/E coverage as gaps. @@ -116,9 +118,8 @@ Phase 8 bootstrap is current only when: - `scripts/harness/check-doc-freshness.sh` passes. - `scripts/harness/validate-skills.sh` passes. -Phase 8 implementation evidence additionally requires reducing or reclassifying -the bare/unknown-field fold-precondition divergence without weakening the -clean-pin canonical baseline. The current clean-pin canonical run remains -`21 pass (incl. expected-diverge), 0 fail` and records 9 PASS cases, 11 -`EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` -parser/verifier gap. +Phase 8 implementation evidence requires the bare/unknown-field +fold-precondition divergence to be reclassified without weakening the clean-pin +canonical baseline. The current clean-pin canonical run remains `21 pass (incl. +expected-diverge), 0 fail` and records 10 PASS cases, 10 `EXPECTED-DIVERGE` +canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap. diff --git a/docs/harness/FELT_OP_GAPS.md b/docs/harness/FELT_OP_GAPS.md index 9b754ee..303bb88 100644 --- a/docs/harness/FELT_OP_GAPS.md +++ b/docs/harness/FELT_OP_GAPS.md @@ -11,7 +11,7 @@ Last reviewed: 2026-06-10 `git@github.com:project-llzk/llzk-lib.git`. - Consumed VeIR dependency: `.lake/packages/VeIR` at - `8e9c08925fce1caf8d6eb1d69239aae263629802`. + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - Current certificate catalog: `LlzkLean/Cert.lean` and `certs/felt-combine.cert.json`. - Current differential corpus: @@ -31,7 +31,7 @@ and an adversarial review disposition. | LLZK mnemonic | Consumed VeIR semantic status | Strategy A differential status | Strategy E certificate status | Phase 3 status | |---|---|---|---|---| | `const` | Covered baseline in `Data.Felt.const` and `InterpModel.interpretConst` | Smoke corpus only; no acceptance claim | Used by existing cert shapes | Covered baseline | -| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus plus Phase 7 registered-field reduction coverage; Phase 8 targets bare/unknown-field fold preconditions | `right_identity_zero_add` and `constant_fold_add` certs exist | Registered-field fold reduction aligned; bare/unknown-field preconditions remain scoped gaps | +| `add` | Covered baseline in `Data.Felt.add` and `InterpModel.interpretAdd` | Smoke corpus plus Phase 7 registered-field reduction coverage; Phase 8 positive no-fold coverage for bare/unknown-field fold preconditions | `right_identity_zero_add` and `constant_fold_add` certs exist | Registered-field fold reduction and bare/unknown-field preconditions aligned for `constant_fold_add`; broader Strategy A/E coverage remains incomplete | | `sub` | Covered baseline in `Data.Felt.sub` and `InterpModel.interpretSub` | Phase 6 registered-field constant subtraction PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR sub rewrites | Gap in Strategy A/E coverage | | `mul` | Covered baseline in `Data.Felt.mul` and `InterpModel.interpretMul` | Phase 6 registered-field constant multiplication PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR mul rewrites | Gap in Strategy A/E coverage | | `neg` | Covered baseline in `Data.Felt.neg` and `InterpModel.interpretNeg` | Phase 7 registered-field constant negation PASS only; no complete accepted corpus coverage | No committed cert yet for existing VeIR neg rewrites | Gap in Strategy A/E coverage | diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index 0db1405..672e611 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -6,7 +6,7 @@ Last reviewed: 2026-06-10 | Gate | Command | Expected behavior | What it proves | |---|---|---|---| -| Strategy A Phase 8 bootstrap | `scripts/harness/check-doc-freshness.sh` | Passes only when Phase 8 is active, the Phase 8 review workspace exists, Phase 7 is marked completed, exact-polarity guard evidence remains present, and the source ledger records the Phase 8 phase file plus local test infrastructure | Phase 8 starts from the Phase 7 clean-pin exact-polarity corpus without claiming full Strategy A acceptance | +| Strategy A Phase 8 implementation state | `scripts/harness/check-doc-freshness.sh` | Passes only when Phase 8 is active, the Phase 8 review workspace exists, Phase 7 is marked completed, exact-polarity guard evidence remains present, and Phase 8 evidence records the consumed field-precondition pin plus the reclassified target | Phase 8 consumes the bare/unknown-field precondition fix without claiming full Strategy A acceptance | | Felt operation gap ledger | `scripts/harness/check-doc-freshness.sh` | Passes only when the Phase 3 review workspace exists, `docs/harness/FELT_OP_GAPS.md` is present, exactly 18 accepted LLZK Felt mnemonic rows appear, and every unsupported or incomplete Strategy A/E row is still marked as a gap | Phase 8 continues from the complete documented operation-gap map instead of implicit Strategy A/E coverage claims | | LLZK source truth | `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` | Passes only when the accepted LLZK source remote, commit, and `origin/main` match, the source ledger records every gated source file, the accepted Felt op set and representative syntax/fold facts match the ledger, the pinned VeIR dependency's `feltPrime` matches the accepted field registry, and checker/certificate artifacts enumerate the accepted built-ins | Phase 2 source facts are exact-ref and exact-remote based, the consumed VeIR pin mirrors the LLZK registry, and certificate/checker comments match the LLZK source registry | | Pin verification | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | Passes only when Lake file URLs/revs, manifest `type`/`inputRev`, and dependency HEAD agree on the accepted commit, the dependency is clean, and workspace VeIR is either the accepted commit or a descendant used only for metadata context | llzk-lean is not relying on hidden `.lake/packages/VeIR` edits or a spoofed source | @@ -21,7 +21,7 @@ Last reviewed: 2026-06-10 | Phase 5 clean-pin implementation gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` override | The canonicalization-aware diff script has been consumed through a clean dependency pin and supports the Phase 6 divergence burn-down baseline | | Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Reports `21 pass (incl. expected-diverge), 0 fail` with 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap | Confirms Phase 6 reduced the expected-divergence matrix without weakening the clean-pin baseline | | Phase 7 modular-reduction burn-down | `scripts/harness/check-doc-freshness.sh`, `scripts/harness/cert-smoke.sh`, plus the Phase 5 clean-pin implementation gate | Requires Phase 7 docs and evidence to identify `registered_add_wrap.llzk` and `constant_fold_neg.llzk` as the first registered-field modular-reduction targets, preserve the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` after reclassification, and keep the committed Strategy E snapshot loadable after the `constant_fold_add` parity update | Phase 7 closes the narrow modular-reduction target without broadening Strategy A acceptance or leaving checker/catalog drift | -| Phase 8 field-precondition burn-down | `scripts/harness/check-doc-freshness.sh` plus the Phase 5 clean-pin implementation gate | Requires Phase 8 docs and evidence to identify `unspecified_add_fold.llzk` as the first bare/unknown-field precondition target while preserving the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` at bootstrap | Phase 8 starts the next narrow burn-down without reclassifying unrelated algebraic canonicalization divergences | +| Phase 8 field-precondition burn-down | `scripts/harness/check-doc-freshness.sh` plus the Phase 5 clean-pin implementation gate | Requires Phase 8 docs and evidence to identify `unspecified_add_fold.llzk` as the reclassified bare/unknown-field precondition target while preserving the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` after implementation | Phase 8 closes the narrow field-precondition target without reclassifying unrelated algebraic canonicalization divergences | ## Reproducible-Pin Failures @@ -94,9 +94,12 @@ Last reviewed: 2026-06-10 implementation evidence. - Phase 7 evidence omits a passing certificate-smoke run after changing `constant_fold_add` parity or the committed certificate snapshot. -- Phase 8 bootstrap docs claim full Strategy A acceptance, omit the Phase 7 +- Phase 8 docs claim full Strategy A acceptance, omit the Phase 7 closeout baseline, fail to mark Phase 7 completed, or broaden the first implementation target beyond bare/unknown-field fold-precondition parity. +- Phase 8 evidence omits the consumed VeIR field-precondition pin, the + reclassified `unspecified_add_fold.llzk` positive case, or the refreshed + `21 pass (incl. expected-diverge), 0 fail` clean-pin corpus run. `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` must fail if: @@ -119,7 +122,7 @@ Last reviewed: 2026-06-10 `grumpkin`, `babybear`, `goldilocks`, `mersenne31`, and `koalabear` as recorded in `docs/harness/LLZK_SOURCE.md`. - `.lake/packages/VeIR` is missing, not at - `8e9c08925fce1caf8d6eb1d69239aae263629802`, or its + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`, or its `Veir/Passes/Felt/InterpModel.lean` `feltPrime` mirror disagrees with the accepted LLZK field registry. - Checker registry comments omit an accepted built-in field. @@ -131,9 +134,9 @@ Last reviewed: 2026-06-10 `https://github.com/project-llzk/veir.git`. - `lake-manifest.json` does not record VeIR as a `git` dependency. - Either Lake file names a commit other than - `8e9c08925fce1caf8d6eb1d69239aae263629802`. + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - `lake-manifest.json` records a VeIR `inputRev` other than - `8e9c08925fce1caf8d6eb1d69239aae263629802`. + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - `.lake/packages/VeIR` HEAD differs from the manifest rev. - `.lake/packages/VeIR` has any modified, deleted, staged, or untracked file. - A supplied workspace VeIR path neither equals nor descends from the accepted @@ -151,8 +154,9 @@ The current harness does not prove: - CI coverage when external tooling is missing. - Missing Felt operation semantics beyond the registry source facts. - Phase 6 divergence burn-down reduced the DCE-only expected divergences, and - Phase 7 reduced registered-field modular-reduction divergences, but this does + Phase 7 reduced registered-field modular-reduction divergences, and Phase 8 + reduced the bare/unknown-field fold-precondition divergence, but this does not expand certificates, complete all Strategy A corpus coverage, or port missing operations. Phase 4 workspace evidence remains historical seed - evidence; Phase 8 implementation evidence must preserve the clean dependency - baseline while targeting bare/unknown-field fold-precondition parity. + evidence; Phase 8 implementation evidence preserves the clean dependency + baseline while closing the first field-precondition target. diff --git a/docs/harness/PINS.md b/docs/harness/PINS.md index 014f266..89a53af 100644 --- a/docs/harness/PINS.md +++ b/docs/harness/PINS.md @@ -4,8 +4,8 @@ Last reviewed: 2026-06-10 ## Accepted VeIR Pin -- Commit: `8e9c08925fce1caf8d6eb1d69239aae263629802` -- Short ref: `8e9c08925fce` +- Commit: `d899d95004d4bd988c8456d686c33b11a7a5eb4a` +- Short ref: `d899d95004d4` - Remote: `https://github.com/project-llzk/veir.git` - Branch at selection time: `felt-review-structural-close` - Mode: remote commit pinned through Lake metadata and a clean Lake package @@ -18,9 +18,9 @@ the Phase 1 accepted pin `d52917ca4a57c4094b1aa61dd413aca4e1c2a56e`. This pin preserves the Phase 2 VeIR field-registry update and source-truth gate, preserves the Phase 5 canonicalization-aware `scripts/llzk-diff.sh` driver consumed by the default llzk-lean dependency checkout, adds the -Phase 6 DCE-enabled canonical differential path, and adds Phase 7 -registered-field fold-result reduction. Phase 8 starts from the same accepted -pin while targeting bare/unknown-field fold-precondition parity. The script +Phase 6 DCE-enabled canonical differential path, adds Phase 7 +registered-field fold-result reduction, and adds Phase 8 +bare/unknown-field fold-precondition parity. The script uses a built `.lake/build/bin/veir-opt` when present and falls back to `lake exec`. diff --git a/docs/harness/SOURCES.md b/docs/harness/SOURCES.md index 6b168d2..ef16e61 100644 --- a/docs/harness/SOURCES.md +++ b/docs/harness/SOURCES.md @@ -7,7 +7,7 @@ Last reviewed: 2026-06-10 | Source | Ref or retrieval | Use | |---|---:|---| | `docs/phases/PHASE-01-pins-and-repro.md` | local file, 2026-06-05 | Phase 1 objective, artifacts, gates, done criteria | -| Accepted VeIR pin | `8e9c08925fce1caf8d6eb1d69239aae263629802` | Dependency commit consumed by llzk-lean | +| Accepted VeIR pin | `d899d95004d4bd988c8456d686c33b11a7a5eb4a` | Dependency commit consumed by llzk-lean | | Accepted VeIR branch | `felt-review-structural-close` | Remote branch containing the accepted commit | | Accepted VeIR remote | `https://github.com/project-llzk/veir.git` | Canonical source repository for the accepted pin | | `lakefile.toml` | local file, 2026-06-05 | Declared `VeIR` dependency pin | @@ -32,7 +32,7 @@ Last reviewed: 2026-06-10 | `docs/phases/PHASE-08-strategy-a-field-preconditions.md` | local file, 2026-06-10 | Active Phase 8 field-precondition objective, artifacts, gates, and done criteria | | `differential/run-differential.sh` | local file, 2026-06-09 | llzk-lean corpus wrapper around the consumed VeIR diff script | | `differential/corpus/` | local files, 2026-06-09 | Current Strategy A corpus and expected-divergence classification | -| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support; Phase 6 canonical mode runs `felt-combine,dce`, and the accepted Phase 7 pin includes registered-field fold-result reduction | +| Consumed VeIR `scripts/llzk-diff.sh` | `.lake/packages/VeIR/scripts/llzk-diff.sh` at accepted pin | Default clean dependency driver with canonicalization support; Phase 6 canonical mode runs `felt-combine,dce`, the accepted Phase 7 pin includes registered-field fold-result reduction, and the accepted Phase 8 pin skips folds whose field name does not resolve | | Workspace VeIR `scripts/llzk-diff.sh` | `../veir/scripts/llzk-diff.sh`, local file, 2026-06-09 | Phase 4 canonicalization-aware driver used explicitly through `VEIR_DIFF=../veir/scripts/llzk-diff.sh` | | Phase 4 canonical differential evidence | `reviews/PHASE-04/evidence/differential-canonicalize.txt` | Reviewed workspace Strategy A seed evidence; not clean-pin acceptance | | Phase 4 fresh adversarial review evidence | `reviews/PHASE-04/evidence/adversarial-review-fresh.txt` | Confirms Phase 4 wrapper findings were resolved before Phase 5 | @@ -40,7 +40,7 @@ Last reviewed: 2026-06-10 | Phase 5 exact-polarity guard evidence | `reviews/PHASE-05/evidence/polarity-guard.txt` | Proves a canonical `EXPECTED-DIVERGE` input fails on the wrong LLZK failure mode | | Phase 6 review workspace | `reviews/PHASE-06/` | Completed Phase 6 request, findings, disposition, adversarial review, implementation evidence, and burn-down disposition | | Phase 7 review workspace | `reviews/PHASE-07/` | Completed Phase 7 request, findings, disposition, adversarial review, implementation evidence, and modular-reduction target | -| Phase 8 review workspace | `reviews/PHASE-08/` | Active Phase 8 request, findings, disposition, adversarial review, bootstrap evidence, and field-precondition target | +| Phase 8 review workspace | `reviews/PHASE-08/` | Active Phase 8 request, findings, disposition, adversarial review, implementation evidence, and field-precondition target | | Accepted local `llzk-opt` binary | `/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt` | LLZK executable for Strategy A differential testing | | Local LLVM/MLIR checkout | `/home/alh/llvm-project` at `49f12af164138123589263fe75ea5f1d356e8780` | Source and build tree for local MLIR/LLVM testing support | | Local `mlir-opt` | `/home/alh/llvm-project/build/bin/mlir-opt`, version `23.0.0git` | Local MLIR tool available for Strategy A testing | diff --git a/docs/phases/PHASE-08-strategy-a-field-preconditions.md b/docs/phases/PHASE-08-strategy-a-field-preconditions.md index d5fe2b4..ec7c746 100644 --- a/docs/phases/PHASE-08-strategy-a-field-preconditions.md +++ b/docs/phases/PHASE-08-strategy-a-field-preconditions.md @@ -7,15 +7,15 @@ Companion phase file: ../../../veir/docs/phases/PHASE-08-strategy-a-field-precon ## Objective -Bootstrap the next Strategy A burn-down after Phase 7's registered-field -modular-reduction closeout: make LLZK field-precondition parity the active -implementation target while preserving the clean-pin differential baseline and -exact `EXPECTED-*` polarity rules. +Continue the Strategy A burn-down after Phase 7's registered-field +modular-reduction closeout: consume the VeIR field-precondition parity fix +through the clean dependency pin while preserving the clean-pin differential +baseline and exact `EXPECTED-*` polarity rules. Phase 8 starts from the Phase 7 clean dependency pin and the 21-input canonical -corpus. The first target is the remaining field-registry precondition +corpus. The first target was the remaining field-registry precondition divergence where LLZK skips a bare `!felt.type` constant fold but VeIR still -folds it under canonicalization. +folded it under canonicalization. ## Starting State @@ -23,7 +23,7 @@ folds it under canonicalization. `17ad33a335683ae5831288741542abf5f9a6c68a`. - Workspace VeIR HEAD at Phase 8 bootstrap: `8e9c08925fce1caf8d6eb1d69239aae263629802`. -- Consumed VeIR dependency pin: +- Consumed VeIR dependency pin at Phase 8 bootstrap: `8e9c08925fce1caf8d6eb1d69239aae263629802`. - Accepted LLZK source commit remains: `db922857bc5a88a9107627ef6b36a8b5e57bc5c2`. @@ -33,14 +33,29 @@ folds it under canonicalization. - Phase 7 adversarial review reports no open findings after certificate smoke, source-ledger wording, and clean-pin canonical evidence were refreshed. +## Implementation Update + +- Phase 8 consumes VeIR commit + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. +- The accepted dependency pin now preserves Phase 7 registered-field modular + reduction and adds a fold guard for bare or unknown field names. VeIR now + skips constant folds when the `!felt.type` field name cannot resolve through + the accepted registry, matching LLZK's fold precondition. +- `differential/corpus/felt/unspecified_add_fold.llzk` is now a positive + no-fold case. It moved from expected divergence after the clean pin closed + the field-precondition gap. +- The clean-pin canonical corpus remains 21 inputs and now records 10 PASS + cases, 10 `EXPECTED-DIVERGE` canonical cases, and 1 + `EXPECTED-LLZK-FAIL` parser/verifier gap. + ## Target Cases -- `differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk` +- `differential/corpus/felt/unspecified_add_fold.llzk` records LLZK's registered-field precondition: bare `!felt.type` constants do not fold because no field name resolves through the accepted registry. VeIR - currently folds the same input. + now leaves the same input unfired. -This is the first Phase 8 implementation target. The remaining nonconstant +This was the first Phase 8 implementation target. The remaining nonconstant algebraic canonicalization divergences stay classified as `EXPECTED-DIVERGE` until there is a reviewed LLZK/VeIR behavior change and exact clean-pin evidence. @@ -52,29 +67,29 @@ evidence. - Do not treat the workspace VeIR checkout as clean-pin evidence. - Do not reclassify nonconstant algebraic rewrite divergences as positives without a reviewed implementation change and exact clean-pin evidence. -- Do not add Strategy E certificates or runtime MLIR matching in this phase - bootstrap. +- Do not add Strategy E certificates or runtime MLIR matching in this phase. ## Artifacts To Create Or Update -- `docs/phases/PHASE-08-strategy-a-field-preconditions.md`: Phase 8 bootstrap. +- `docs/phases/PHASE-08-strategy-a-field-preconditions.md`: Phase 8 + implementation state. - `docs/phases/PHASE-07-strategy-a-modular-reduction.md`: mark Phase 7 completed. - `docs/harness/CURRENT.md`: move the active phase to Phase 8 and record the field-precondition target. - `docs/harness/SOURCES.md`: record the Phase 8 phase file and review workspace while preserving Phase 7 closeout evidence. -- `docs/harness/GATES.md`: document the Phase 8 bootstrap and +- `docs/harness/GATES.md`: document the Phase 8 implementation and field-precondition target gates. - `scripts/harness/check-doc-freshness.sh`: require Phase 8 to be active while preserving Phase 2 through Phase 7 evidence checks. - `scripts/harness/doctor.sh`: require Phase 8 docs and review workspace. - `reviews/PHASE-08/{request.md,findings.md,disposition.md,adversarial-review.md,evidence/}`: - Phase 8 review workspace. + Phase 8 review workspace and closeout evidence. ## Gates To Implement -- Bootstrap freshness: +- Freshness: `scripts/harness/check-doc-freshness.sh` passes only when Phase 8 is active, the Phase 8 review workspace exists, Phase 7 is marked complete, and Phase 7 clean-pin closeout evidence remains present. @@ -90,12 +105,12 @@ evidence. `lake build` succeeds. - Strategy A baseline: `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` - continues to report `21 pass (incl. expected-diverge), 0 fail` with 9 PASS - cases, 11 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. + continues to report `21 pass (incl. expected-diverge), 0 fail` with 10 PASS + cases, 10 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. - Target guard: the Phase 8 docs and adversarial evidence identify `unspecified_add_fold.llzk` - as the exact field-precondition target and preserve all other remaining - canonical divergences. + as the reclassified field-precondition target and preserve all other + remaining canonical divergences. ## Review Requirements @@ -109,7 +124,7 @@ evidence. ## Done Criteria -- Phase 8 bootstrap docs and review workspace exist in both llzk-lean and VeIR. +- Phase 8 docs and review workspace exist in both llzk-lean and VeIR. - `docs/harness/CURRENT.md` names Phase 8 as active. - `docs/harness/SOURCES.md` records Phase 8 and the Phase 7 closeout evidence. - Freshness, source truth, pin verification, strict doctor, skill validation, diff --git a/docs/strategy-a-oracle.md b/docs/strategy-a-oracle.md index 4623dbe..a0f57db 100644 --- a/docs/strategy-a-oracle.md +++ b/docs/strategy-a-oracle.md @@ -52,9 +52,9 @@ claims to `llzk-lib` commit 4. **Registered-field folds now apply modular reduction.** Phase 7 aligns VeIR's registered-field add-wrap and negation folds with LLZK's - `Field::reduce` behavior. Phase 8 starts the follow-on - bare/unknown-field fold-precondition burn-down, with - `unspecified_add_fold.llzk` as the first target. + `Field::reduce` behavior. Phase 8 aligns VeIR with LLZK's + bare/unknown-field fold precondition for + `unspecified_add_fold.llzk`. The Phase 4 ordering is now: - Re-test the named-field corpus and keep the generic parser edge @@ -122,7 +122,7 @@ Current state (2026-06-09): pin runs VeIR `felt-combine,dce`, which reclassifies registered add/sub/mul constant folds from expected divergence to positive coverage. Phase 7 now reclassifies registered-field modular reduction for add-wrap and negation. - Phase 8 targets the remaining bare/unknown-field fold-precondition gap. + Phase 8 reclassifies the bare/unknown-field fold-precondition gap. - 🚧 CI workflow stubbed in `.github/workflows/differential.yml`. Skips green if `llzk-opt` not provisioned — CI provisioning is v1 work. @@ -132,9 +132,9 @@ Outstanding work to reach v1: 1. **Continue burning down classified divergences.** The consumed clean pin now invokes both tools with their canonicalize pipelines (`llzk-opt --canonicalize` and `veir-opt -p=felt-combine,dce`). The next - VeIR-side targets are the remaining classified algebraic and field - precondition divergences, starting with the Phase 8 - `unspecified_add_fold.llzk` target. + VeIR-side targets are the remaining classified algebraic divergences after + the Phase 8 `unspecified_add_fold.llzk` field-precondition target moved to + positive no-fold coverage. 2. **Corpus expansion.** Hand-author a Felt corpus that exercises every pattern in VEIR's `Combine.lean` against an equivalent LLZK input. @@ -163,9 +163,10 @@ Outstanding work to reach v1: [`differential/corpus/README.md`](../differential/corpus/README.md) for the polarity convention. -6. **Field-registry parity.** VEIR now reduces registered-field fold results, - but it still folds bare or unknown-field constants in cases LLZK can leave - unresolved. Phase 8 tracks this as the active field-precondition workstream. +6. **Field-registry parity.** VEIR now reduces registered-field fold results + and skips bare or unknown-field constant folds in cases LLZK leaves + unresolved. Remaining Strategy A work is the classified nonconstant + algebraic rewrite matrix. ## Effort diff --git a/lake-manifest.json b/lake-manifest.json index 7cbc817..3e7beef 100644 --- a/lake-manifest.json +++ b/lake-manifest.json @@ -5,10 +5,10 @@ "type": "git", "subDir": null, "scope": "", - "rev": "8e9c08925fce1caf8d6eb1d69239aae263629802", + "rev": "d899d95004d4bd988c8456d686c33b11a7a5eb4a", "name": "VeIR", "manifestFile": "lake-manifest.json", - "inputRev": "8e9c08925fce1caf8d6eb1d69239aae263629802", + "inputRev": "d899d95004d4bd988c8456d686c33b11a7a5eb4a", "inherited": false, "configFile": "lakefile.toml"}, {"url": "https://github.com/leanprover-community/mathlib4", diff --git a/lakefile.toml b/lakefile.toml index 731ed14..eb93331 100644 --- a/lakefile.toml +++ b/lakefile.toml @@ -26,7 +26,7 @@ moreServerArgs = ["--tstack=400000"] [[require]] name = "VeIR" git = "https://github.com/project-llzk/veir.git" -rev = "8e9c08925fce1caf8d6eb1d69239aae263629802" +rev = "d899d95004d4bd988c8456d686c33b11a7a5eb4a" [[lean_lib]] name = "LlzkLean" diff --git a/reviews/PHASE-08/adversarial-review.md b/reviews/PHASE-08/adversarial-review.md index 3c1102d..79a06bf 100644 --- a/reviews/PHASE-08/adversarial-review.md +++ b/reviews/PHASE-08/adversarial-review.md @@ -5,27 +5,28 @@ Reviewed: 2026-06-10 ## Scope -This bootstrap review closes Phase 7 and checks that Phase 8 starts from the -clean-pin corpus baseline without claiming broad Strategy A acceptance. It also -checks that the first Phase 8 target is the field-precondition gap recorded by -`unspecified_add_fold.llzk`, not the remaining nonconstant algebraic rewrite -divergences. +This review closes the first Phase 8 field-precondition target and checks that +the new clean VeIR pin preserves the corpus baseline without claiming broad +Strategy A acceptance. It also checks that the reclassified Phase 8 target is +the field-precondition gap recorded by `unspecified_add_fold.llzk`, not the +remaining nonconstant algebraic rewrite divergences. ## Checks - Confirm Phase 7 findings are resolved and Phase 7 is marked completed. - Confirm the Phase 7 clean-pin canonical corpus still records `21 pass (incl. expected-diverge), 0 fail`. -- Confirm the consumed VeIR pin remains - `8e9c08925fce1caf8d6eb1d69239aae263629802`. +- Confirm the consumed VeIR pin is + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - Confirm expected-divergence polarity remains exact and marker-driven. - Confirm `docs/harness/CURRENT.md` names Phase 8 as active. -- Confirm Phase 8 targets only - `expected-divergence/canonical/unspecified_add_fold.llzk`. +- Confirm Phase 8 reclassifies only + `differential/corpus/felt/unspecified_add_fold.llzk`. - Confirm nonconstant algebraic rewrite divergences remain out of scope until a reviewed implementation change lands. ## Result -Accepted as a Phase 8 bootstrap. No Phase 7 closeout blocker or Phase 8 -bootstrap blocker remains. +Accepted as Phase 8 implementation evidence for bare/unknown-field +fold-precondition parity. No Phase 7 closeout blocker or Phase 8 blocker +remains. diff --git a/reviews/PHASE-08/disposition.md b/reviews/PHASE-08/disposition.md index 6a2b67b..1c924dd 100644 --- a/reviews/PHASE-08/disposition.md +++ b/reviews/PHASE-08/disposition.md @@ -3,9 +3,14 @@ Repository: llzk-lean Updated: 2026-06-10 -No Phase 8 findings are open at bootstrap. +No Phase 8 findings are open. Phase 8 starts from the completed Phase 7 registered-field modular-reduction -closeout. The first target is the remaining bare/unknown-field -fold-precondition divergence recorded by -`differential/corpus/expected-divergence/canonical/unspecified_add_fold.llzk`. +closeout. The first target was the remaining bare/unknown-field +fold-precondition divergence recorded by `unspecified_add_fold.llzk`. + +F8-LLZK-01 is resolved by consuming VeIR commit +`d899d95004d4bd988c8456d686c33b11a7a5eb4a`. The target moved to +`differential/corpus/felt/unspecified_add_fold.llzk` as a positive no-fold +case, and the other nonconstant algebraic canonicalization divergences remain +classified as `EXPECTED-DIVERGE`. diff --git a/reviews/PHASE-08/evidence/README.md b/reviews/PHASE-08/evidence/README.md index 5245f79..660fc0a 100644 --- a/reviews/PHASE-08/evidence/README.md +++ b/reviews/PHASE-08/evidence/README.md @@ -1,8 +1,20 @@ # Phase 8 Evidence Repository: llzk-lean -Created: 2026-06-10 +Updated: 2026-06-10 -This directory records Phase 8 bootstrap evidence. Phase 8 starts from the -Phase 7 clean-pin corpus baseline and targets the bare/unknown-field -fold-precondition divergence in `unspecified_add_fold.llzk`. +This directory records Phase 8 implementation evidence. Phase 8 starts from the +Phase 7 clean-pin corpus baseline and consumes the VeIR field-precondition pin +that reclassifies `unspecified_add_fold.llzk` as a positive no-fold case. + +Expected evidence: + +- `check-doc-freshness.txt` +- `verify-llzk-source.txt` +- `verify-pins.txt` +- `doctor-workspace.txt` +- `validate-skills.txt` +- `lake-build.txt` +- `cert-smoke.txt` +- `differential-clean-pin-canonicalize.txt` +- `adversarial-review.txt` diff --git a/reviews/PHASE-08/evidence/adversarial-review.txt b/reviews/PHASE-08/evidence/adversarial-review.txt index 08eafe5..9ec8d08 100644 --- a/reviews/PHASE-08/evidence/adversarial-review.txt +++ b/reviews/PHASE-08/evidence/adversarial-review.txt @@ -6,7 +6,11 @@ PASS: Phase 7 clean-pin canonical baseline remains preserved. PASS: expected-divergence polarity remains exact and marker-driven. PASS: only Phase 8 phase file remains marked active. PASS: Phase 8 target is limited to bare/unknown-field fold-precondition parity. -PASS: Phase 8 targets unspecified_add_fold.llzk. +PASS: Phase 8 consumes VeIR pin d899d95004d4bd988c8456d686c33b11a7a5eb4a. +PASS: Phase 8 reclassifies unspecified_add_fold.llzk as a positive no-fold case. +PASS: Phase 8 clean-pin canonical baseline remains 21 pass (incl. expected-diverge), 0 fail. +PASS: Phase 8 records 10 PASS cases, 10 EXPECTED-DIVERGE canonical cases, and 1 EXPECTED-LLZK-FAIL. PASS: nonconstant algebraic rewrite divergences remain out of scope. PASS: Phase 8 docs do not claim full Strategy A acceptance. -PASS: no Phase 8 findings are open at bootstrap. +PASS: F8-LLZK-01 is resolved. +PASS: no Phase 8 findings remain open. diff --git a/reviews/PHASE-08/evidence/cert-smoke.txt b/reviews/PHASE-08/evidence/cert-smoke.txt new file mode 100644 index 0000000..c8d6427 --- /dev/null +++ b/reviews/PHASE-08/evidence/cert-smoke.txt @@ -0,0 +1,5 @@ +CERT-SMOKE: ctest schema/loader tests passed +CERT-SMOKE: theorem metadata present for 2/2 certs +CERT-SMOKE: driver cert summary passed +CERT-SMOKE: MLIR matcher absent; DefaultMatcher still has W4B TODOs +CERT-SMOKE: schema validation passed diff --git a/reviews/PHASE-08/evidence/check-doc-freshness.txt b/reviews/PHASE-08/evidence/check-doc-freshness.txt new file mode 100644 index 0000000..fbcc27f --- /dev/null +++ b/reviews/PHASE-08/evidence/check-doc-freshness.txt @@ -0,0 +1,304 @@ +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE-07-strategy-a-modular-reduction.md +PASS: found docs/phases/PHASE-08-strategy-a-field-preconditions.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-03/evidence/README.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-04/evidence/README.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-05/evidence/README.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: found reviews/PHASE-06/evidence/README.md +PASS: found reviews/PHASE-07/disposition.md +PASS: found reviews/PHASE-07/findings.md +PASS: found reviews/PHASE-07/request.md +PASS: found reviews/PHASE-07/adversarial-review.md +PASS: found reviews/PHASE-07/evidence/README.md +PASS: found reviews/PHASE-08/disposition.md +PASS: found reviews/PHASE-08/findings.md +PASS: found reviews/PHASE-08/request.md +PASS: found reviews/PHASE-08/adversarial-review.md +PASS: found reviews/PHASE-08/evidence/README.md +PASS: phase review date has ISO format +PASS: docs/harness/CURRENT.md review date agrees with phase +PASS: docs/harness/SOURCES.md review date agrees with phase +PASS: docs/harness/GATES.md review date agrees with phase +PASS: docs/harness/FELT_OP_GAPS.md review date agrees with phase +PASS: docs/harness/LLZK_SOURCE.md review date agrees with phase +PASS: docs/harness/PINS.md review date agrees with phase +PASS: docs/harness/REVIEWS.md review date agrees with phase +PASS: CURRENT names active phase +PASS: only Phase 8 phase file is marked active +PASS: Phase 1 phase file is marked completed +PASS: Phase 2 phase file is marked completed +PASS: Phase 3 phase file is marked completed +PASS: Phase 4 phase file is marked completed +PASS: Phase 5 phase file is marked completed +PASS: Phase 6 phase file is marked completed +PASS: Phase 7 phase file is marked completed +PASS: CURRENT no longer says corpus expansion is future work +PASS: CURRENT no longer says clean-pin corpus migration is only starting +PASS: CURRENT no longer describes the canonical corpus as seed-only +PASS: SOURCES records accepted VeIR pin +PASS: SOURCES records accepted LLZK source commit +PASS: SOURCES records Felt operation gap ledger +PASS: SOURCES records Phase 4 phase file +PASS: SOURCES records Phase 5 phase file +PASS: SOURCES records Phase 6 phase file +PASS: SOURCES records Phase 7 phase file +PASS: SOURCES records Phase 8 phase file +PASS: SOURCES records Phase 4 implementation and fresh review evidence +PASS: SOURCES records Strategy A differential wrapper and corpus +PASS: SOURCES records accepted local llzk-opt binary +PASS: SOURCES records local llvm-project test infrastructure +PASS: SOURCES and LLZK_SOURCE record accepted LLZK remote +PASS: PINS records accepted VeIR commit +PASS: FELT_OP_GAPS has exactly 18 operation rows +PASS: FELT_OP_GAPS records const exactly once +PASS: FELT_OP_GAPS records add exactly once +PASS: FELT_OP_GAPS records sub exactly once +PASS: FELT_OP_GAPS records mul exactly once +PASS: FELT_OP_GAPS records pow exactly once +PASS: FELT_OP_GAPS records div exactly once +PASS: FELT_OP_GAPS records uintdiv exactly once +PASS: FELT_OP_GAPS records sintdiv exactly once +PASS: FELT_OP_GAPS records umod exactly once +PASS: FELT_OP_GAPS records smod exactly once +PASS: FELT_OP_GAPS records neg exactly once +PASS: FELT_OP_GAPS records inv exactly once +PASS: FELT_OP_GAPS records bit_and exactly once +PASS: FELT_OP_GAPS records bit_or exactly once +PASS: FELT_OP_GAPS records bit_xor exactly once +PASS: FELT_OP_GAPS records bit_not exactly once +PASS: FELT_OP_GAPS records shl exactly once +PASS: FELT_OP_GAPS records shr exactly once +PASS: FELT_OP_GAPS marks sub Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks mul Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks neg Strategy A/E coverage gap +PASS: FELT_OP_GAPS marks pow consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks pow as a gap +PASS: FELT_OP_GAPS marks div consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks div as a gap +PASS: FELT_OP_GAPS marks uintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks uintdiv as a gap +PASS: FELT_OP_GAPS marks sintdiv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks sintdiv as a gap +PASS: FELT_OP_GAPS marks umod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks umod as a gap +PASS: FELT_OP_GAPS marks smod consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks smod as a gap +PASS: FELT_OP_GAPS marks inv consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks inv as a gap +PASS: FELT_OP_GAPS marks bit_and consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_and as a gap +PASS: FELT_OP_GAPS marks bit_or consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_or as a gap +PASS: FELT_OP_GAPS marks bit_xor consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_xor as a gap +PASS: FELT_OP_GAPS marks bit_not consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks bit_not as a gap +PASS: FELT_OP_GAPS marks shl consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shl as a gap +PASS: FELT_OP_GAPS marks shr consumed VeIR semantic model missing +PASS: FELT_OP_GAPS marks shr as a gap +PASS: Phase 2 disposition exists +PASS: Phase 3 disposition exists +PASS: Phase 4 disposition exists +PASS: Phase 5 disposition exists +PASS: Phase 6 disposition exists +PASS: Phase 7 disposition exists +PASS: Phase 8 disposition exists +PASS: evidence present reviews/PHASE-02/evidence/llzk-lib-refs.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-field-registry.txt +PASS: evidence present reviews/PHASE-02/evidence/llzk-felt-ops.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-llzk-source-after.txt +PASS: evidence present reviews/PHASE-02/evidence/verify-pins-after.txt +PASS: evidence present reviews/PHASE-02/evidence/lake-build-after.txt +PASS: evidence present reviews/PHASE-02/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-03/evidence/README.md +PASS: evidence present reviews/PHASE-03/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-03/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-03/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-03/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-03/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-03/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/README.md +PASS: evidence present reviews/PHASE-04/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-04/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-04/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-04/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-04/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-04/evidence/adversarial-review-fresh.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-bootstrap.txt +PASS: evidence present reviews/PHASE-04/evidence/differential-canonicalize.txt +PASS: evidence present reviews/PHASE-04/evidence/corpus-classification.txt +PASS: evidence present reviews/PHASE-05/evidence/README.md +PASS: evidence present reviews/PHASE-05/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-05/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-05/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-05/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-05/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-05/evidence/skip-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/polarity-guard.txt +PASS: evidence present reviews/PHASE-05/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-05/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-06/evidence/README.md +PASS: evidence present reviews/PHASE-06/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-06/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-06/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-06/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-06/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-06/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-06/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-07/evidence/README.md +PASS: evidence present reviews/PHASE-07/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-07/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-07/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-07/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-07/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-07/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-07/evidence/cert-smoke.txt +PASS: evidence present reviews/PHASE-07/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-07/evidence/adversarial-review.txt +PASS: evidence present reviews/PHASE-08/evidence/README.md +PASS: evidence present reviews/PHASE-08/evidence/check-doc-freshness.txt +PASS: evidence present reviews/PHASE-08/evidence/verify-llzk-source.txt +PASS: evidence present reviews/PHASE-08/evidence/verify-pins.txt +PASS: evidence present reviews/PHASE-08/evidence/doctor-workspace.txt +PASS: evidence present reviews/PHASE-08/evidence/validate-skills.txt +PASS: evidence present reviews/PHASE-08/evidence/lake-build.txt +PASS: evidence present reviews/PHASE-08/evidence/cert-smoke.txt +PASS: evidence present reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt +PASS: evidence present reviews/PHASE-08/evidence/adversarial-review.txt +PASS: verify-llzk-source evidence reports no failures +PASS: pin evidence reports no failures +PASS: strict doctor evidence reports no failures +PASS: skill evidence reports no failures +PASS: lake build evidence reports success +PASS: lake build evidence records expected certificate coverage gap +PASS: adversarial evidence confirms missing-op semantics were not added +PASS: adversarial evidence confirms no Strategy E/A implementation changes +PASS: Phase 4 source evidence reports no failures +PASS: Phase 4 pin evidence reports no failures +PASS: Phase 4 strict doctor evidence reports no failures +PASS: Phase 4 skill evidence reports no failures +PASS: Phase 4 lake build evidence reports success +PASS: Phase 4 adversarial evidence confirms llzk-opt is executable +PASS: Phase 4 adversarial evidence dispositions differential wrapper and corpus edits +PASS: Phase 4 parse/print differential evidence records workspace VeIR script +PASS: Phase 4 parse/print differential evidence reports no failures +PASS: Phase 4 canonical differential evidence records accepted llzk-opt +PASS: Phase 4 canonical differential evidence records canonicalization command +PASS: Phase 4 canonical differential evidence reports no failures +PASS: Phase 4 corpus evidence records canonical expected-divergence cases +PASS: Phase 4 fresh adversarial evidence records clean-pin guard +PASS: Phase 5 source evidence reports no failures +PASS: Phase 5 source evidence captures known stale llzk-lib warning detail +PASS: Phase 5 pin evidence reports no failures +PASS: Phase 5 strict doctor evidence reports no failures +PASS: Phase 5 skill evidence reports no failures +PASS: Phase 5 lake build evidence reports success +PASS: Phase 5 skip guard rejects missing-tool evidence +PASS: Phase 5 polarity guard rejects wrong expected-divergence failure mode +PASS: Phase 5 polarity guard records nonzero exit +PASS: Phase 5 clean-pin canonical evidence records default dependency command +PASS: Phase 5 clean-pin canonical evidence records expanded positive corpus +PASS: Phase 5 clean-pin canonical evidence records expanded expected-divergence corpus +PASS: Phase 5 clean-pin canonical evidence reports no failures +PASS: Phase 5 adversarial evidence records exact polarity guard +PASS: Phase 5 adversarial evidence reports no open findings +PASS: Phase 6 source evidence reports no failures +PASS: Phase 6 pin evidence reports no failures +PASS: Phase 6 strict doctor evidence reports no failures +PASS: Phase 6 skill evidence reports no failures +PASS: Phase 6 lake build evidence reports success +PASS: Phase 6 clean-pin canonical baseline reports no failures +PASS: Phase 6 adversarial evidence records Phase 5 closeout +PASS: Phase 6 adversarial evidence records exact polarity baseline +PASS: Phase 7 source evidence reports no failures +PASS: Phase 7 pin evidence reports no failures +PASS: Phase 7 strict doctor evidence reports no failures +PASS: Phase 7 skill evidence reports no failures +PASS: Phase 7 lake build evidence reports success +PASS: Phase 7 certificate smoke evidence reports success +PASS: Phase 7 certificate smoke evidence validates theorem metadata +PASS: Phase 7 clean-pin canonical baseline reports no failures +PASS: Phase 7 adversarial evidence records Phase 6 closeout +PASS: Phase 7 adversarial evidence records exact polarity baseline +PASS: Phase 7 adversarial evidence records singular active phase +PASS: Phase 7 adversarial evidence records target scope +PASS: Phase 7 adversarial evidence records target cases +PASS: Phase 7 adversarial evidence records certificate-smoke closeout +PASS: Phase 8 adversarial evidence records Phase 7 closeout +PASS: Phase 8 adversarial evidence records exact polarity baseline +PASS: Phase 8 adversarial evidence records singular active phase +PASS: Phase 8 source evidence reports no failures +PASS: Phase 8 pin evidence reports no failures +PASS: Phase 8 strict doctor evidence reports no failures +PASS: Phase 8 skill evidence reports no failures +PASS: Phase 8 lake build evidence reports success +PASS: Phase 8 certificate smoke evidence reports success +PASS: Phase 8 certificate smoke evidence validates theorem metadata +PASS: Phase 8 differential evidence records reclassified target +PASS: Phase 8 clean-pin canonical baseline reports no failures +PASS: Phase 8 adversarial evidence records target scope +PASS: Phase 8 adversarial evidence records consumed pin +PASS: Phase 8 adversarial evidence records reclassified target case +PASS: Phase 8 adversarial evidence records clean-pin baseline +PASS: Phase 8 adversarial evidence reports no open findings +PASS: differential README records clean-pin expanded corpus status +PASS: differential README documents exact expected-divergence markers +PASS: differential README no longer calls the Phase 5 corpus intentionally small +PASS: differential README no longer calls the Phase 5 corpus a seed +PASS: differential README no longer carries the stale seed bar +PASS: corpus README documents expected LLZK failure polarity +PASS: corpus README documents expected VEIR failure polarity +PASS: corpus README documents exact output-divergence polarity +PASS: corpus README records Phase 8 PASS count +PASS: corpus README records Phase 8 expected-divergence count +PASS: Phase 5 docs record clean-pin Strategy A corpus expansion +PASS: Phase 6 docs record divergence burn-down baseline +PASS: Phase 7 docs record modular-reduction target and baseline +PASS: Phase 8 docs record field-precondition target and baseline +PASS: Phase 2 llzk-lib ref evidence records accepted remote + +doc freshness summary: 0 fail diff --git a/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt new file mode 100644 index 0000000..096af8d --- /dev/null +++ b/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt @@ -0,0 +1,23 @@ +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/neg_neg_to_self.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_one_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_identity_zero_add.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/right_zero_mul.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/self_subtraction_to_zero.llzk +EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/sub_add_const_cancel.llzk +EXPECTED-LLZK-FAIL: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/named_field_const.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/add_const_swap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/arithmetic_no_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/const_identities.mlir +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_mul.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_neg.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/constant_fold_sub.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/registered_add_fold.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/registered_add_wrap.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/types_smoke.llzk +PASS: /home/alh/LLZK/llzk-lean/differential/corpus/felt/unspecified_add_fold.llzk + +Summary: 21 pass (incl. expected-diverge), 0 fail (over 21 inputs) diff --git a/reviews/PHASE-08/evidence/doctor-workspace.txt b/reviews/PHASE-08/evidence/doctor-workspace.txt new file mode 100644 index 0000000..78a47b5 --- /dev/null +++ b/reviews/PHASE-08/evidence/doctor-workspace.txt @@ -0,0 +1,93 @@ +PASS: tool git is available +PASS: tool lake is available +PASS: optional tool cmake is available +PASS: optional tool ctest is available +PASS: git root is /home/alh/LLZK/llzk-lean +PASS: llzk-lean HEAD bb836ca1862b descends from bootstrap input 617702beadfb +PASS: found AGENTS.md +PASS: found docs/phases/PHASE-00-harness-reset.md +PASS: found docs/phases/PHASE-01-pins-and-repro.md +PASS: found docs/phases/PHASE-02-llzk-source-truth.md +PASS: found docs/phases/PHASE-03-felt-op-gap-ledger.md +PASS: found docs/phases/PHASE-04-strategy-a-differential.md +PASS: found docs/phases/PHASE-05-strategy-a-pin-and-corpus.md +PASS: found docs/phases/PHASE-06-strategy-a-divergence-burndown.md +PASS: found docs/phases/PHASE-07-strategy-a-modular-reduction.md +PASS: found docs/phases/PHASE-08-strategy-a-field-preconditions.md +PASS: found docs/phases/PHASE_TEMPLATE.md +PASS: found docs/harness/CURRENT.md +PASS: found docs/harness/SOURCES.md +PASS: found docs/harness/GATES.md +PASS: found docs/harness/FELT_OP_GAPS.md +PASS: found docs/harness/LLZK_SOURCE.md +PASS: found docs/harness/PINS.md +PASS: found docs/harness/REVIEWS.md +PASS: found reviews/PHASE-00/request.md +PASS: found reviews/PHASE-00/findings.md +PASS: found reviews/PHASE-00/disposition.md +PASS: found reviews/PHASE-00/adversarial-review.md +PASS: found reviews/PHASE-01/request.md +PASS: found reviews/PHASE-01/findings.md +PASS: found reviews/PHASE-01/disposition.md +PASS: found reviews/PHASE-01/adversarial-review.md +PASS: found reviews/PHASE-02/request.md +PASS: found reviews/PHASE-02/findings.md +PASS: found reviews/PHASE-02/disposition.md +PASS: found reviews/PHASE-02/adversarial-review.md +PASS: found reviews/PHASE-03/request.md +PASS: found reviews/PHASE-03/findings.md +PASS: found reviews/PHASE-03/disposition.md +PASS: found reviews/PHASE-03/adversarial-review.md +PASS: found reviews/PHASE-04/request.md +PASS: found reviews/PHASE-04/findings.md +PASS: found reviews/PHASE-04/disposition.md +PASS: found reviews/PHASE-04/adversarial-review.md +PASS: found reviews/PHASE-05/request.md +PASS: found reviews/PHASE-05/findings.md +PASS: found reviews/PHASE-05/disposition.md +PASS: found reviews/PHASE-05/adversarial-review.md +PASS: found reviews/PHASE-06/request.md +PASS: found reviews/PHASE-06/findings.md +PASS: found reviews/PHASE-06/disposition.md +PASS: found reviews/PHASE-06/adversarial-review.md +PASS: found reviews/PHASE-07/request.md +PASS: found reviews/PHASE-07/findings.md +PASS: found reviews/PHASE-07/disposition.md +PASS: found reviews/PHASE-07/adversarial-review.md +PASS: found reviews/PHASE-08/request.md +PASS: found reviews/PHASE-08/findings.md +PASS: found reviews/PHASE-08/disposition.md +PASS: found reviews/PHASE-08/adversarial-review.md +PASS: executable scripts/harness/check-doc-freshness.sh +PASS: executable scripts/harness/diff-smoke.sh +PASS: executable scripts/harness/cert-smoke.sh +PASS: executable scripts/harness/verify-pins.sh +PASS: executable scripts/harness/verify-llzk-source.sh +PASS: executable scripts/harness/validate-skills.sh +accepted VeIR pin: d899d95004d4bd988c8456d686c33b11a7a5eb4a +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d899d95004d4 +PASS: lake-manifest.json pins VeIR d899d95004d4 +PASS: lake-manifest.json inputRev pins VeIR d899d95004d4 +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d899d95004d4 +PASS: dependency checkout HEAD is d899d95004d4 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d899d95004d4 + +pin verification summary: 0 fail, 0 warn, mode=strict +PASS: pin verification passed +PASS: found reviews/PHASE-00/evidence +PASS: found reviews/PHASE-01/evidence +PASS: found reviews/PHASE-02/evidence +PASS: found reviews/PHASE-03/evidence +PASS: found reviews/PHASE-04/evidence +PASS: found reviews/PHASE-05/evidence +PASS: found reviews/PHASE-06/evidence +PASS: found reviews/PHASE-07/evidence +PASS: found reviews/PHASE-08/evidence + +doctor summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-08/evidence/lake-build.txt b/reviews/PHASE-08/evidence/lake-build.txt new file mode 100644 index 0000000..0c6734c --- /dev/null +++ b/reviews/PHASE-08/evidence/lake-build.txt @@ -0,0 +1,37 @@ +⚠ [39/619] Replayed Veir.Verifier +warning: Veir/Verifier.lean:2107:23: This simp argument is unused: + throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw,̵ ̵t̵h̵r̵o̵w̵The, MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:30: This simp argument is unused: + throwThe + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, t̵h̵r̵o̵w̵T̵h̵e̵,̵ ̵MonadExceptOf.throw, pure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +warning: Veir/Verifier.lean:2107:40: This simp argument is unused: + MonadExceptOf.throw + +Hint: Omit it from the simp argument list. + simp only [Verified, verifyLocalInvariants, ← getOpType!_eq_getOpType, opType, ne_eq, + ̵ ̵ ̵ ̵bind, + ̲ ̲ ̲ ̲Except.bind, throw, throwThe, M̵o̵n̵a̵d̵E̵x̵c̵e̵pt̵O̵f̵.̵t̵h̵r̵o̵w̵,̵ ̵p̵ure, Except.pure, dite_not, + ̵ ̵ ̵ ̵ite_not] at opVerify + +Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +✔ [1236/1240] Built Veir.Passes.Felt.RewriteLemmas (1.8s) +✔ [1237/1240] Built Veir.Passes.Felt.Combine (1.2s) +ℹ [1238/1240] Built LlzkLean.CertValidate (2.4s) +info: LlzkLean/CertValidate.lean:147:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] +✔ [1239/1240] Built LlzkLean (1.2s) +Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-08/evidence/validate-skills.txt b/reviews/PHASE-08/evidence/validate-skills.txt new file mode 100644 index 0000000..3e6aaec --- /dev/null +++ b/reviews/PHASE-08/evidence/validate-skills.txt @@ -0,0 +1,22 @@ +PASS: skills/cert-checker-review/SKILL.md has title +PASS: skills/cert-checker-review/SKILL.md has usage trigger +PASS: skills/cert-checker-review/SKILL.md has validation path +PASS: skills/cert-checker-review/SKILL.md points at harness scripts +PASS: skills/lean-axiom-audit/SKILL.md has title +PASS: skills/lean-axiom-audit/SKILL.md has usage trigger +PASS: skills/lean-axiom-audit/SKILL.md has validation path +PASS: skills/lean-axiom-audit/SKILL.md points at harness scripts +PASS: skills/llzk-lean-dependency-audit/SKILL.md has title +PASS: skills/llzk-lean-dependency-audit/SKILL.md has usage trigger +PASS: skills/llzk-lean-dependency-audit/SKILL.md has validation path +PASS: skills/llzk-lean-dependency-audit/SKILL.md points at harness scripts +PASS: skills/mlir-differential/SKILL.md has title +PASS: skills/mlir-differential/SKILL.md has usage trigger +PASS: skills/mlir-differential/SKILL.md has validation path +PASS: skills/mlir-differential/SKILL.md points at harness scripts +PASS: skills/phase-bootstrap/SKILL.md has title +PASS: skills/phase-bootstrap/SKILL.md has usage trigger +PASS: skills/phase-bootstrap/SKILL.md has validation path +PASS: skills/phase-bootstrap/SKILL.md points at harness scripts + +skill validation summary: 0 fail over 5 skills diff --git a/reviews/PHASE-08/evidence/verify-llzk-source.txt b/reviews/PHASE-08/evidence/verify-llzk-source.txt new file mode 100644 index 0000000..d27be55 --- /dev/null +++ b/reviews/PHASE-08/evidence/verify-llzk-source.txt @@ -0,0 +1,119 @@ +PASS: llzk-lib path is /home/alh/LLZK/llzk-lib +PASS: found docs/harness/LLZK_SOURCE.md +PASS: LLZK source ledger records db922857bc5a +PASS: LLZK source ledger records accepted remote git@github.com:project-llzk/llzk-lib.git +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Ops.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Types.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/Attrs.td +PASS: LLZK source ledger records include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: LLZK source ledger records lib/Dialect/Felt/IR/Ops.cpp +PASS: LLZK source ledger records lib/Util/Field.cpp +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_arith_fail.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_const_fold.llzk +PASS: LLZK source ledger records test/Dialect/Felt/felt_spec_pass.llzk +PASS: LLZK source ledger records test/Dialect/Felt/types_pass.llzk +PASS: LLZK source ledger records unittests/IR/FeltFoldTests.cpp +accepted LLZK source: db922857bc5a88a9107627ef6b36a8b5e57bc5c2 (origin/main, git@github.com:project-llzk/llzk-lib.git) +PASS: llzk-lib origin remote matches git@github.com:project-llzk/llzk-lib.git +PASS: accepted LLZK commit exists locally +PASS: origin/main equals accepted LLZK source db922857bc5a +WARN: llzk-lib worktree HEAD 30b0fa1eb77de154ff60c13fa88ef286d8b01c65 differs; gate reads db922857bc5a88a9107627ef6b36a8b5e57bc5c2 with git show +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Ops.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Types.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/Attrs.td +PASS: accepted source contains include/llzk/Dialect/Felt/IR/OpInterfaces.td +PASS: accepted source contains lib/Dialect/Felt/IR/Ops.cpp +PASS: accepted source contains lib/Util/Field.cpp +PASS: accepted source contains test/Dialect/Felt/felt_arith_pass.llzk +PASS: accepted source contains test/Dialect/Felt/felt_arith_fail.llzk +PASS: accepted source contains test/Dialect/Felt/felt_const_fold.llzk +PASS: accepted source contains test/Dialect/Felt/felt_spec_pass.llzk +PASS: accepted source contains test/Dialect/Felt/types_pass.llzk +PASS: accepted source contains unittests/IR/FeltFoldTests.cpp +PASS: accepted Felt op mnemonics match Phase 2 ledger +PASS: registry declares bn128 +PASS: registry declares bn254 +PASS: registry declares grumpkin +PASS: registry declares babybear +PASS: registry declares goldilocks +PASS: registry declares mersenne31 +PASS: registry declares koalabear +PASS: registry maps bn128 to accepted prime +PASS: registry maps bn254 to accepted prime +PASS: registry maps grumpkin to accepted prime +PASS: registry maps babybear to accepted prime +PASS: registry maps goldilocks to accepted prime +PASS: registry maps mersenne31 to accepted prime +PASS: registry maps koalabear to accepted prime +PASS: Felt type source defines !felt.type +PASS: Felt type source carries optional field-name parameter +PASS: Felt attrs source defines FeltConstAttr +PASS: Felt attrs source defines const mnemonic +PASS: Felt attrs source defines FieldSpecAttr +PASS: Felt attrs source defines field mnemonic +PASS: Felt attrs source exposes getFieldName +PASS: Felt attrs source lists grumpkin as built-in +PASS: Felt attrs source lists koalabear as built-in +PASS: Felt op interface source defines binary interface +PASS: Felt op interface source exposes getLhs +PASS: Felt op interface source exposes getRhs +PASS: Felt folder source has binary fold data helper +PASS: Felt folder source resolves registered fields +PASS: Felt folder source reduces add folds +PASS: Felt verifier-failure test rejects unknown fields +PASS: Felt fold test covers add wrap-around +PASS: Felt fold test covers signed division +PASS: Felt field-spec test covers custom field syntax +PASS: Felt type test covers bare felt type syntax +PASS: Felt unit tests cover unspecified-field no-fold +PASS: checker registry comment block mentions bn128 +PASS: checker registry comment block mentions bn254 +PASS: checker registry comment block mentions grumpkin +PASS: checker registry comment block mentions babybear +PASS: checker registry comment block mentions goldilocks +PASS: checker registry comment block mentions mersenne31 +PASS: checker registry comment block mentions koalabear +PASS: Strategy A registered-field source claim mentions bn128 +PASS: Strategy A registered-field source claim mentions bn254 +PASS: Strategy A registered-field source claim mentions grumpkin +PASS: Strategy A registered-field source claim mentions babybear +PASS: Strategy A registered-field source claim mentions goldilocks +PASS: Strategy A registered-field source claim mentions mersenne31 +PASS: Strategy A registered-field source claim mentions koalabear +PASS: LLZK source ledger mentions bn128 +PASS: LLZK source ledger mentions bn254 +PASS: LLZK source ledger mentions grumpkin +PASS: LLZK source ledger mentions babybear +PASS: LLZK source ledger mentions goldilocks +PASS: LLZK source ledger mentions mersenne31 +PASS: LLZK source ledger mentions koalabear +PASS: pinned VeIR dependency HEAD is d899d95004d4 +PASS: pinned VeIR dependency feltPrime cites current LLZK registry path +PASS: pinned VeIR dependency feltPrime mentions bn128 +PASS: pinned VeIR dependency feltPrime mentions bn254 +PASS: pinned VeIR dependency feltPrime mentions grumpkin +PASS: pinned VeIR dependency feltPrime mentions babybear +PASS: pinned VeIR dependency feltPrime mentions goldilocks +PASS: pinned VeIR dependency feltPrime mentions mersenne31 +PASS: pinned VeIR dependency feltPrime mentions koalabear +PASS: pinned VeIR dependency feltPrime maps bn254 to accepted prime +PASS: pinned VeIR dependency feltPrime maps bn128 to accepted prime +PASS: pinned VeIR dependency feltPrime maps grumpkin to accepted prime +PASS: pinned VeIR dependency feltPrime maps babybear to accepted prime +PASS: pinned VeIR dependency feltPrime maps goldilocks to accepted prime +PASS: pinned VeIR dependency feltPrime maps mersenne31 to accepted prime +PASS: pinned VeIR dependency feltPrime maps koalabear to accepted prime +PASS: Strategy E documents sameAttr side condition +PASS: Strategy E documents attrInRegistry side condition +PASS: Lean cert catalog contains constant_fold_add +PASS: Lean cert catalog requires same fieldName +PASS: Lean cert catalog requires registered fieldName +PASS: Lean cert catalog marks constant_fold_add aligned +PASS: cert snapshot contains constant_fold_add +PASS: cert snapshot records aligned status +PASS: cert snapshot requires same fieldName +PASS: cert snapshot requires registered fieldName + +LLZK source verification summary: 0 fail, 1 warn diff --git a/reviews/PHASE-08/evidence/verify-pins.txt b/reviews/PHASE-08/evidence/verify-pins.txt new file mode 100644 index 0000000..dd1e633 --- /dev/null +++ b/reviews/PHASE-08/evidence/verify-pins.txt @@ -0,0 +1,15 @@ +accepted VeIR pin: d899d95004d4bd988c8456d686c33b11a7a5eb4a +accepted VeIR source: https://github.com/project-llzk/veir.git felt-review-structural-close +PASS: lakefile.toml uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lakefile.toml pins VeIR d899d95004d4 +PASS: lake-manifest.json pins VeIR d899d95004d4 +PASS: lake-manifest.json inputRev pins VeIR d899d95004d4 +PASS: lake-manifest.json uses accepted VeIR remote https://github.com/project-llzk/veir.git +PASS: lake-manifest.json records VeIR as a git dependency +PASS: Lake files agree on VeIR d899d95004d4 +PASS: dependency checkout HEAD is d899d95004d4 +PASS: dependency checkout HEAD equals manifest rev +PASS: dependency checkout is clean +PASS: workspace VeIR HEAD equals accepted pin d899d95004d4 + +pin verification summary: 0 fail, 0 warn, mode=strict diff --git a/reviews/PHASE-08/findings.md b/reviews/PHASE-08/findings.md index 6fa958d..6fee0f5 100644 --- a/reviews/PHASE-08/findings.md +++ b/reviews/PHASE-08/findings.md @@ -3,4 +3,23 @@ Repository: llzk-lean Reviewed: 2026-06-10 -No Phase 8 findings are open at bootstrap. +No Phase 8 findings are open. + +## F8-LLZK-01: Bare Felt Constant Fold Ignored LLZK Field Preconditions + +- Severity: medium +- Status: resolved +- Area: Strategy A canonical differential, VeIR Felt folding + +At Phase 8 bootstrap, `unspecified_add_fold.llzk` documented a narrow +field-precondition divergence: LLZK left a bare `!felt.type` add unfired +because no registered field name resolved, while VeIR folded the same constants +under canonicalization. + +Resolution: VeIR commit +`d899d95004d4bd988c8456d686c33b11a7a5eb4a` makes constant-fold and associative +constant-fold helpers return no rewrite when the field name cannot resolve +through the accepted registry. The case moved to +`differential/corpus/felt/unspecified_add_fold.llzk` as a positive no-fold +case, and the clean-pin canonical corpus remains +`21 pass (incl. expected-diverge), 0 fail`. diff --git a/reviews/PHASE-08/request.md b/reviews/PHASE-08/request.md index 5f62f11..cd51e18 100644 --- a/reviews/PHASE-08/request.md +++ b/reviews/PHASE-08/request.md @@ -3,7 +3,7 @@ Repository: llzk-lean Requested: 2026-06-10 -Review the Phase 8 Strategy A field-precondition bootstrap. +Review the Phase 8 Strategy A field-precondition implementation closeout. Scope: - Phase 7 is completed and superseded by Phase 8. @@ -11,8 +11,10 @@ Scope: - The implementation target is limited to bare/unknown-field fold-precondition parity for `unspecified_add_fold.llzk`. - The clean-pin canonical baseline remains `21 pass (incl. expected-diverge), - 0 fail` with 9 PASS cases, 11 `EXPECTED-DIVERGE` canonical cases, and + 0 fail` with 10 PASS cases, 10 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. +- The consumed VeIR pin is + `d899d95004d4bd988c8456d686c33b11a7a5eb4a`. - Exact `EXPECTED-*` polarity remains required for all expected-divergence inputs. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index cb9e9f0..4619c91 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -4,7 +4,7 @@ set -u ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" FAIL=0 -ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" +ACCEPTED_VEIR_COMMIT="d899d95004d4bd988c8456d686c33b11a7a5eb4a" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" fail() { @@ -412,6 +412,14 @@ done for evidence in \ reviews/PHASE-08/evidence/README.md \ + reviews/PHASE-08/evidence/check-doc-freshness.txt \ + reviews/PHASE-08/evidence/verify-llzk-source.txt \ + reviews/PHASE-08/evidence/verify-pins.txt \ + reviews/PHASE-08/evidence/doctor-workspace.txt \ + reviews/PHASE-08/evidence/validate-skills.txt \ + reviews/PHASE-08/evidence/lake-build.txt \ + reviews/PHASE-08/evidence/cert-smoke.txt \ + reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt \ reviews/PHASE-08/evidence/adversarial-review.txt; do require_nonempty "$evidence" done @@ -478,8 +486,20 @@ require_contains reviews/PHASE-07/evidence/adversarial-review.txt "PASS: certifi require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 7 is marked completed before Phase 8 starts." "Phase 8 adversarial evidence records Phase 7 closeout" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: expected-divergence polarity remains exact and marker-driven." "Phase 8 adversarial evidence records exact polarity baseline" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: only Phase 8 phase file remains marked active." "Phase 8 adversarial evidence records singular active phase" +require_contains reviews/PHASE-08/evidence/verify-llzk-source.txt "LLZK source verification summary: 0 fail" "Phase 8 source evidence reports no failures" +require_contains reviews/PHASE-08/evidence/verify-pins.txt "pin verification summary: 0 fail" "Phase 8 pin evidence reports no failures" +require_contains reviews/PHASE-08/evidence/doctor-workspace.txt "doctor summary: 0 fail" "Phase 8 strict doctor evidence reports no failures" +require_contains reviews/PHASE-08/evidence/validate-skills.txt "skill validation summary: 0 fail" "Phase 8 skill evidence reports no failures" +require_contains reviews/PHASE-08/evidence/lake-build.txt "Build completed successfully" "Phase 8 lake build evidence reports success" +require_contains reviews/PHASE-08/evidence/cert-smoke.txt "CERT-SMOKE: schema validation passed" "Phase 8 certificate smoke evidence reports success" +require_contains reviews/PHASE-08/evidence/cert-smoke.txt "CERT-SMOKE: theorem metadata present for 2/2 certs" "Phase 8 certificate smoke evidence validates theorem metadata" +require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt "differential/corpus/felt/unspecified_add_fold.llzk" "Phase 8 differential evidence records reclassified target" +require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 8 clean-pin canonical baseline reports no failures" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 target is limited to bare/unknown-field fold-precondition parity." "Phase 8 adversarial evidence records target scope" -require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 targets unspecified_add_fold.llzk." "Phase 8 adversarial evidence records target case" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 consumes VeIR pin d899d95004d4bd988c8456d686c33b11a7a5eb4a." "Phase 8 adversarial evidence records consumed pin" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 reclassifies unspecified_add_fold.llzk as a positive no-fold case." "Phase 8 adversarial evidence records reclassified target case" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 clean-pin canonical baseline remains 21 pass (incl. expected-diverge), 0 fail." "Phase 8 adversarial evidence records clean-pin baseline" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: no Phase 8 findings remain open." "Phase 8 adversarial evidence reports no open findings" require_contains differential/README.md "clean-pin expanded corpus" "differential README records clean-pin expanded corpus status" require_contains differential/README.md "The directory is not a wildcard" "differential README documents exact expected-divergence markers" require_not_contains differential/README.md "still intentionally small" "differential README no longer calls the Phase 5 corpus intentionally small" @@ -488,6 +508,8 @@ require_not_contains differential/README.md "Current seed bar" "differential REA require_contains differential/corpus/README.md 'EXPECTED-LLZK-FAIL' "corpus README documents expected LLZK failure polarity" require_contains differential/corpus/README.md 'EXPECTED-VEIR-FAIL' "corpus README documents expected VEIR failure polarity" require_contains differential/corpus/README.md 'with `EXPECTED-DIVERGE` marker' "corpus README documents exact output-divergence polarity" +require_contains differential/corpus/README.md "10 PASS cases" "corpus README records Phase 8 PASS count" +require_contains differential/corpus/README.md '10 `EXPECTED-DIVERGE` canonical cases' "corpus README records Phase 8 expected-divergence count" if grep -q "Phase 5 implementation gate" "${ROOT}/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md" && grep -q "Clean-pin expanded corpus evidence covers the 15 VeIR Felt rewrite-pattern" "${ROOT}/docs/phases/PHASE-05-strategy-a-pin-and-corpus.md"; then diff --git a/scripts/harness/verify-llzk-source.sh b/scripts/harness/verify-llzk-source.sh index 698712e..7eccad5 100755 --- a/scripts/harness/verify-llzk-source.sh +++ b/scripts/harness/verify-llzk-source.sh @@ -9,7 +9,7 @@ ACCEPTED_LLZK_COMMIT="db922857bc5a88a9107627ef6b36a8b5e57bc5c2" ACCEPTED_LLZK_SHORT="${ACCEPTED_LLZK_COMMIT:0:12}" ACCEPTED_LLZK_REF="origin/main" ACCEPTED_LLZK_REMOTE="git@github.com:project-llzk/llzk-lib.git" -ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" +ACCEPTED_VEIR_COMMIT="d899d95004d4bd988c8456d686c33b11a7a5eb4a" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" FIELD_REGISTRY_PATH="lib/Util/Field.cpp" diff --git a/scripts/harness/verify-pins.sh b/scripts/harness/verify-pins.sh index 3904c1c..d9e19dd 100755 --- a/scripts/harness/verify-pins.sh +++ b/scripts/harness/verify-pins.sh @@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" MODE="strict" WORKSPACE_VEIR="" -ACCEPTED_VEIR_COMMIT="8e9c08925fce1caf8d6eb1d69239aae263629802" +ACCEPTED_VEIR_COMMIT="d899d95004d4bd988c8456d686c33b11a7a5eb4a" ACCEPTED_VEIR_SHORT="${ACCEPTED_VEIR_COMMIT:0:12}" ACCEPTED_VEIR_REMOTE="https://github.com/project-llzk/veir.git" ACCEPTED_VEIR_BRANCH="felt-review-structural-close" From 69c685bde3067026225747c6a1d399004b1c18a0 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 22:46:28 +0100 Subject: [PATCH 12/16] Harden Phase 8 clean-pin differential evidence --- differential/README.md | 13 +-- differential/run-differential.sh | 54 +++++++++++- docs/harness/GATES.md | 6 +- ...PHASE-08-strategy-a-field-preconditions.md | 2 +- reviews/PHASE-08/adversarial-review.md | 4 + reviews/PHASE-08/disposition.md | 6 ++ reviews/PHASE-08/evidence/README.md | 4 + .../PHASE-08/evidence/adversarial-review.txt | 5 ++ .../PHASE-08/evidence/check-doc-freshness.txt | 5 ++ .../differential-clean-pin-canonicalize.txt | 2 + .../PHASE-08/evidence/doctor-workspace.txt | 2 +- reviews/PHASE-08/evidence/lake-build.txt | 86 ++++++++++++++++++- reviews/PHASE-08/findings.md | 32 +++++++ scripts/harness/check-doc-freshness.sh | 5 ++ 14 files changed, 210 insertions(+), 16 deletions(-) diff --git a/differential/README.md b/differential/README.md index ebe7f3f..6ec0c6a 100644 --- a/differential/README.md +++ b/differential/README.md @@ -43,12 +43,13 @@ VEIR_DIFF=../veir/scripts/llzk-diff.sh \ ./differential/run-differential.sh --canonicalize ``` -**First-run cost.** The differential script prefers -`.lake/packages/VeIR/.lake/build/bin/veir-opt` when that executable is -present. On a cold checkout it falls back to `lake exec veir-opt` inside -`.lake/packages/VeIR/`, which builds VEIR (the Felt port + the IR machinery) -and its Mathlib dependency. Expect a multi-minute build the first time; -subsequent runs use the built executable and finish in seconds. +**First-run cost.** The llzk-lean wrapper refreshes the default clean +dependency executable with `lake build veir-opt` inside `.lake/packages/VeIR/` +before running the corpus. That keeps a stale `.lake/build/bin/veir-opt` from +becoming acceptance evidence. On a cold checkout this builds VEIR (the Felt +port + the IR machinery) and its Mathlib dependency. Expect a multi-minute +build the first time; subsequent runs use the refreshed executable and finish +in seconds. If you already have VEIR built elsewhere on the filesystem (say, `~/veir`), you can skip the wait by reusing the existing build: diff --git a/differential/run-differential.sh b/differential/run-differential.sh index 6e1c137..a4987ad 100755 --- a/differential/run-differential.sh +++ b/differential/run-differential.sh @@ -10,9 +10,12 @@ # ./differential/run-differential.sh --canonicalize # canonical Phase 4 mode # # Requires: -# - VEIR built (via `lake build`); used through `lake exec veir-opt`. -# First-run cost is the VEIR + Mathlib build inside .lake/packages/VeIR/ -# (~10 min). To reuse a pre-built VEIR checkout, symlink it in: +# - VEIR can build its `veir-opt` executable. The default clean dependency +# path refreshes `.lake/packages/VeIR/.lake/build/bin/veir-opt` with +# `lake build veir-opt` before comparing, so stale executable artifacts do +# not become acceptance evidence. First-run cost is the VEIR + Mathlib build +# inside .lake/packages/VeIR/ (~10 min). To reuse a pre-built VEIR checkout, +# symlink it in: # ln -sf /path/to/veir/.lake/build \ # .lake/packages/VeIR/.lake/build # - llzk-opt on $PATH or via $LLZK_OPT. @@ -36,7 +39,13 @@ CORPUS="${ROOT}/differential/corpus" # Locate VEIR's diff script in the Lake-managed dependency tree. After # `lake update`, the VEIR source lives under `.lake/packages/VeIR/`. VEIR_PACKAGE="${ROOT}/.lake/packages/VeIR" -DIFF="${VEIR_DIFF:-${VEIR_PACKAGE}/scripts/llzk-diff.sh}" +if [[ -n "${VEIR_DIFF:-}" ]]; then + DIFF="${VEIR_DIFF}" + CLEAN_DEPENDENCY_DIFF=0 +else + DIFF="${VEIR_PACKAGE}/scripts/llzk-diff.sh" + CLEAN_DEPENDENCY_DIFF=1 +fi if [[ ! -x "${DIFF}" ]]; then echo "ERROR: VEIR diff script not found at ${DIFF}" >&2 @@ -97,6 +106,41 @@ if [[ "${CANONICALIZE:-0}" == "1" ]] && ! grep -Fq -- "--canonicalize" "${DIFF}" exit 2 fi +refresh_clean_dependency_veir_opt() { + if [[ "${CLEAN_DEPENDENCY_DIFF}" != "1" ]]; then + return 0 + fi + + if [[ -n "${VEIR_OPT:-}" ]]; then + echo "ERROR: VEIR_OPT override is incompatible with default clean dependency evidence." >&2 + echo "Unset VEIR_OPT for clean-pin evidence, or set VEIR_DIFF for an explicit workspace run." >&2 + return 2 + fi + + if [[ ! -d "${VEIR_PACKAGE}" ]]; then + echo "ERROR: VEIR package checkout missing at ${VEIR_PACKAGE}" >&2 + return 2 + fi + + local build_log + build_log="$(mktemp -t llzk-veir-opt-build-XXXXXX)" || return 2 + if (cd "${VEIR_PACKAGE}" && lake build veir-opt >"${build_log}" 2>&1); then + rm -f "${build_log}" + else + echo "ERROR: failed to refresh pinned VeIR veir-opt with 'lake build veir-opt'" >&2 + sed 's/^/ /' "${build_log}" >&2 + rm -f "${build_log}" + return 2 + fi + + if [[ ! -x "${VEIR_PACKAGE}/.lake/build/bin/veir-opt" ]]; then + echo "ERROR: lake build veir-opt did not produce an executable at ${VEIR_PACKAGE}/.lake/build/bin/veir-opt" >&2 + return 2 + fi + + echo "CLEAN-VEIR-OPT: lake build veir-opt succeeded for ${VEIR_PACKAGE}" +} + expand_arg() { local a="$1" if [[ -f "$a" ]]; then @@ -125,6 +169,8 @@ if (( ${#TARGETS[@]} == 0 )); then exit 2 fi +refresh_clean_dependency_veir_opt || exit 2 + # Common flags for every input. Per-file flags are added in the loop below. DIFF_ARGS=() if [[ "${CANONICALIZE:-0}" == "1" ]]; then diff --git a/docs/harness/GATES.md b/docs/harness/GATES.md index 672e611..55f8767 100644 --- a/docs/harness/GATES.md +++ b/docs/harness/GATES.md @@ -18,7 +18,7 @@ Last reviewed: 2026-06-10 | Certificate smoke | `scripts/harness/cert-smoke.sh` | Builds the checker smoke binaries, loads the committed certificate snapshot, checks schema metadata and parity dispatch, and reports whether MLIR matcher support is active or absent | Strategy E snapshot/checker drift is caught without claiming runtime MLIR rewrite verification | | Skill validation | `scripts/harness/validate-skills.sh` | Passes when repo-local skills have required sections | Repo-local skills remain auditable | | Phase 4 workspace differential gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt VEIR_DIFF=../veir/scripts/llzk-diff.sh ./differential/run-differential.sh --canonicalize differential/corpus` | Runs workspace VeIR's canonicalization-aware diff script over the reviewed seed corpus | Initial Phase 4 evidence exists, but remains workspace evidence until the clean VeIR dependency pin consumes the updated script | -| Phase 5 clean-pin implementation gate | `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` override | The canonicalization-aware diff script has been consumed through a clean dependency pin and supports the Phase 6 divergence burn-down baseline | +| Phase 5 clean-pin implementation gate | `env -u VEIR_DIFF -u VEIR_OPT LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` | Runs the canonical differential through the default clean `.lake/packages/VeIR` dependency script with no `VEIR_DIFF` or `VEIR_OPT` override, after refreshing the pinned dependency `veir-opt` executable | The canonicalization-aware diff script and executable have been consumed through a clean dependency pin and support the Phase 6 divergence burn-down baseline | | Phase 6 divergence burn-down baseline | same as Phase 5 clean-pin implementation gate | Reports `21 pass (incl. expected-diverge), 0 fail` with 7 PASS cases, 13 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL` parser/verifier gap | Confirms Phase 6 reduced the expected-divergence matrix without weakening the clean-pin baseline | | Phase 7 modular-reduction burn-down | `scripts/harness/check-doc-freshness.sh`, `scripts/harness/cert-smoke.sh`, plus the Phase 5 clean-pin implementation gate | Requires Phase 7 docs and evidence to identify `registered_add_wrap.llzk` and `constant_fold_neg.llzk` as the first registered-field modular-reduction targets, preserve the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` after reclassification, and keep the committed Strategy E snapshot loadable after the `constant_fold_add` parity update | Phase 7 closes the narrow modular-reduction target without broadening Strategy A acceptance or leaving checker/catalog drift | | Phase 8 field-precondition burn-down | `scripts/harness/check-doc-freshness.sh` plus the Phase 5 clean-pin implementation gate | Requires Phase 8 docs and evidence to identify `unspecified_add_fold.llzk` as the reclassified bare/unknown-field precondition target while preserving the canonical corpus result `21 pass (incl. expected-diverge), 0 fail` after implementation | Phase 8 closes the narrow field-precondition target without reclassifying unrelated algebraic canonicalization divergences | @@ -100,6 +100,10 @@ Last reviewed: 2026-06-10 - Phase 8 evidence omits the consumed VeIR field-precondition pin, the reclassified `unspecified_add_fold.llzk` positive case, or the refreshed `21 pass (incl. expected-diverge), 0 fail` clean-pin corpus run. +- Phase 8 differential evidence omits the exact `env -u VEIR_DIFF -u VEIR_OPT` + clean-pin command, omits the accepted `LLZK_OPT` path, or omits the + `CLEAN-VEIR-OPT` marker proving the pinned dependency executable was + refreshed before the run. `scripts/harness/verify-llzk-source.sh --llzk-lib ../llzk-lib` must fail if: diff --git a/docs/phases/PHASE-08-strategy-a-field-preconditions.md b/docs/phases/PHASE-08-strategy-a-field-preconditions.md index ec7c746..4641d9d 100644 --- a/docs/phases/PHASE-08-strategy-a-field-preconditions.md +++ b/docs/phases/PHASE-08-strategy-a-field-preconditions.md @@ -104,7 +104,7 @@ evidence. - Build: `lake build` succeeds. - Strategy A baseline: - `LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` + `env -u VEIR_DIFF -u VEIR_OPT LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus` continues to report `21 pass (incl. expected-diverge), 0 fail` with 10 PASS cases, 10 `EXPECTED-DIVERGE` canonical cases, and 1 `EXPECTED-LLZK-FAIL`. - Target guard: diff --git a/reviews/PHASE-08/adversarial-review.md b/reviews/PHASE-08/adversarial-review.md index 79a06bf..b6d0c16 100644 --- a/reviews/PHASE-08/adversarial-review.md +++ b/reviews/PHASE-08/adversarial-review.md @@ -22,6 +22,10 @@ remaining nonconstant algebraic rewrite divergences. - Confirm `docs/harness/CURRENT.md` names Phase 8 as active. - Confirm Phase 8 reclassifies only `differential/corpus/felt/unspecified_add_fold.llzk`. +- Confirm the clean-pin differential path refreshes the pinned dependency + `veir-opt` executable and rejects hidden `VEIR_OPT` overrides. +- Confirm the differential evidence records the exact override-clearing command + line and accepted `LLZK_OPT` path. - Confirm nonconstant algebraic rewrite divergences remain out of scope until a reviewed implementation change lands. diff --git a/reviews/PHASE-08/disposition.md b/reviews/PHASE-08/disposition.md index 1c924dd..246d86d 100644 --- a/reviews/PHASE-08/disposition.md +++ b/reviews/PHASE-08/disposition.md @@ -14,3 +14,9 @@ F8-LLZK-01 is resolved by consuming VeIR commit `differential/corpus/felt/unspecified_add_fold.llzk` as a positive no-fold case, and the other nonconstant algebraic canonicalization divergences remain classified as `EXPECTED-DIVERGE`. + +F8-LLZK-02 and F8-LLZK-03 are resolved by strengthening the default clean +dependency differential path and Phase 8 evidence checks. The wrapper refreshes +the pinned dependency `veir-opt` executable before running, rejects hidden +`VEIR_OPT` overrides on the clean path, and the evidence records the exact +override-clearing command. diff --git a/reviews/PHASE-08/evidence/README.md b/reviews/PHASE-08/evidence/README.md index 660fc0a..b28f8c8 100644 --- a/reviews/PHASE-08/evidence/README.md +++ b/reviews/PHASE-08/evidence/README.md @@ -18,3 +18,7 @@ Expected evidence: - `cert-smoke.txt` - `differential-clean-pin-canonicalize.txt` - `adversarial-review.txt` + +The differential evidence must record the exact `env -u VEIR_DIFF -u VEIR_OPT` +clean-pin command and the `CLEAN-VEIR-OPT` marker emitted after refreshing the +pinned dependency executable. diff --git a/reviews/PHASE-08/evidence/adversarial-review.txt b/reviews/PHASE-08/evidence/adversarial-review.txt index 9ec8d08..7dc442c 100644 --- a/reviews/PHASE-08/evidence/adversarial-review.txt +++ b/reviews/PHASE-08/evidence/adversarial-review.txt @@ -10,7 +10,12 @@ PASS: Phase 8 consumes VeIR pin d899d95004d4bd988c8456d686c33b11a7a5eb4a. PASS: Phase 8 reclassifies unspecified_add_fold.llzk as a positive no-fold case. PASS: Phase 8 clean-pin canonical baseline remains 21 pass (incl. expected-diverge), 0 fail. PASS: Phase 8 records 10 PASS cases, 10 EXPECTED-DIVERGE canonical cases, and 1 EXPECTED-LLZK-FAIL. +PASS: clean-pin differential refreshes pinned dependency veir-opt before comparison. +PASS: clean-pin differential rejects hidden VEIR_OPT overrides. +PASS: Phase 8 differential evidence records env -u VEIR_DIFF -u VEIR_OPT and the accepted LLZK_OPT path. PASS: nonconstant algebraic rewrite divergences remain out of scope. PASS: Phase 8 docs do not claim full Strategy A acceptance. PASS: F8-LLZK-01 is resolved. +PASS: F8-LLZK-02 is resolved. +PASS: F8-LLZK-03 is resolved. PASS: no Phase 8 findings remain open. diff --git a/reviews/PHASE-08/evidence/check-doc-freshness.txt b/reviews/PHASE-08/evidence/check-doc-freshness.txt index fbcc27f..1ce0f65 100644 --- a/reviews/PHASE-08/evidence/check-doc-freshness.txt +++ b/reviews/PHASE-08/evidence/check-doc-freshness.txt @@ -278,12 +278,17 @@ PASS: Phase 8 skill evidence reports no failures PASS: Phase 8 lake build evidence reports success PASS: Phase 8 certificate smoke evidence reports success PASS: Phase 8 certificate smoke evidence validates theorem metadata +PASS: Phase 8 differential evidence records exact clean-pin command +PASS: Phase 8 differential evidence records pinned veir-opt refresh PASS: Phase 8 differential evidence records reclassified target PASS: Phase 8 clean-pin canonical baseline reports no failures PASS: Phase 8 adversarial evidence records target scope PASS: Phase 8 adversarial evidence records consumed pin PASS: Phase 8 adversarial evidence records reclassified target case PASS: Phase 8 adversarial evidence records clean-pin baseline +PASS: Phase 8 adversarial evidence records veir-opt refresh +PASS: Phase 8 adversarial evidence records hidden override guard +PASS: Phase 8 adversarial evidence records exact command evidence PASS: Phase 8 adversarial evidence reports no open findings PASS: differential README records clean-pin expanded corpus status PASS: differential README documents exact expected-divergence markers diff --git a/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt b/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt index 096af8d..0eaf0e0 100644 --- a/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt +++ b/reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt @@ -1,3 +1,5 @@ +$ env -u VEIR_DIFF -u VEIR_OPT LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus +CLEAN-VEIR-OPT: lake build veir-opt succeeded for /home/alh/LLZK/llzk-lean/.lake/packages/VeIR EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_neg_to_zero.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/add_sub_const_cancel.llzk EXPECTED-DIVERGE: /home/alh/LLZK/llzk-lean/differential/corpus/expected-divergence/canonical/assoc_const_fold_add.llzk diff --git a/reviews/PHASE-08/evidence/doctor-workspace.txt b/reviews/PHASE-08/evidence/doctor-workspace.txt index 78a47b5..79b699a 100644 --- a/reviews/PHASE-08/evidence/doctor-workspace.txt +++ b/reviews/PHASE-08/evidence/doctor-workspace.txt @@ -3,7 +3,7 @@ PASS: tool lake is available PASS: optional tool cmake is available PASS: optional tool ctest is available PASS: git root is /home/alh/LLZK/llzk-lean -PASS: llzk-lean HEAD bb836ca1862b descends from bootstrap input 617702beadfb +PASS: llzk-lean HEAD 4589d1f37773 descends from bootstrap input 617702beadfb PASS: found AGENTS.md PASS: found docs/phases/PHASE-00-harness-reset.md PASS: found docs/phases/PHASE-01-pins-and-repro.md diff --git a/reviews/PHASE-08/evidence/lake-build.txt b/reviews/PHASE-08/evidence/lake-build.txt index 0c6734c..e611373 100644 --- a/reviews/PHASE-08/evidence/lake-build.txt +++ b/reviews/PHASE-08/evidence/lake-build.txt @@ -1,4 +1,46 @@ -⚠ [39/619] Replayed Veir.Verifier +✔ [1018/1240] Built Veir.IR.OpInfo (388ms) +✔ [1155/1240] Built Veir.Prelude (561ms) +✔ [1156/1240] Built Veir.IR.Simp (773ms) +✔ [1157/1240] Built Veir.Meta.Attrs (812ms) +✔ [1158/1240] Built Veir.Rewriter.WfRewriter.GetSetTactic (1.2s) +✔ [1159/1240] Built Veir.ForLean (1.5s) +✔ [1160/1240] Built Veir.Data.Felt.Basic (1.1s) +✔ [1161/1240] Built Veir.Meta.OpCode (1.1s) +✔ [1162/1240] Built Veir.Passes.Felt.Proofs (1.0s) +✔ [1163/1240] Built Veir.OpCode (2.8s) +✔ [1164/1240] Built Veir.IR.Attribute (5.8s) +✔ [1165/1240] Built Veir.Passes.Felt.InterpModel (281ms) +✔ [1166/1240] Built Veir.Properties (1.6s) +✔ [1167/1240] Built Veir.Dialects.RISCV_Cf.OpInfo (594ms) +✔ [1168/1240] Built Veir.Dialects.LLZK.Felt.Properties (613ms) +✔ [1169/1240] Built Veir.Dialects.ModArith.OpInfo (678ms) +✔ [1170/1240] Built Veir.Dialects.LLZK.Include.Properties (675ms) +✔ [1171/1240] Built Veir.Dialects.Cf.OpInfo (788ms) +✔ [1172/1240] Built Veir.Dialects.LLZK.Function.Properties (739ms) +✔ [1173/1240] Built Veir.Dialects.LLZK.String.Properties (881ms) +✔ [1174/1240] Built Veir.Dialects.LLZK.Bool.Properties (859ms) +✔ [1175/1240] Built Veir.Dialects.LLZK.Global.Properties (980ms) +✔ [1176/1240] Built Veir.Dialects.Comb.OpInfo (1.1s) +✔ [1177/1240] Built Veir.Dialects.LLZK.Include.OpInfo (640ms) +✔ [1178/1240] Built Veir.Dialects.LLZK.Function.OpInfo (477ms) +✔ [1179/1240] Built Veir.Dialects.HW.OpInfo (696ms) +✔ [1180/1240] Built Veir.Dialects.LLZK.String.OpInfo (474ms) +✔ [1181/1240] Built Veir.Dialects.LLZK.Bool.OpInfo (612ms) +✔ [1182/1240] Built Veir.Dialects.LLZK.Felt.OpInfo (978ms) +✔ [1183/1240] Built Veir.Dialects.LLZK.Global.OpInfo (589ms) +✔ [1184/1240] Built Veir.Dialects.Arith.OpInfo (1.7s) +✔ [1185/1240] Built Veir.Dialects.LLVM.OpInfo (2.2s) +✔ [1186/1240] Built Veir.IR.Basic (8.1s) +✔ [1187/1240] Built Veir.Dialects.RISCV.OpInfo (9.5s) +✔ [1188/1240] Built Veir.GlobalOpInfo (11s) +✔ [1189/1240] Built Veir.IR.GetSet (27s) +✔ [1190/1240] Built Veir.IR.InBounds (31s) +✔ [1191/1240] Built Veir.IR.Fields (20s) +✔ [1192/1240] Built Veir.IR.Grind (278ms) +✔ [1193/1240] Built Veir.IR.WellFormed (22s) +✔ [1194/1240] Built Veir.IR (375ms) +✔ [1195/1240] Built Veir.Rewriter.LinkedList.Basic (4.4s) +⚠ [1196/1240] Built Veir.Verifier (9.5s) warning: Veir/Verifier.lean:2107:23: This simp argument is unused: throw @@ -29,9 +71,47 @@ Hint: Omit it from the simp argument list. ̵ ̵ ̵ ̵ite_not] at opVerify Note: This linter can be disabled with `set_option linter.unusedSimpArgs false` +✔ [1197/1240] Built Veir.Pass (763ms) +✔ [1198/1240] Built Veir.Rewriter.InsertPoint (11s) +✔ [1199/1240] Built Veir.Rewriter.LinkedList.GetSet (9.5s) +✔ [1200/1240] Built Veir.IR.DeallocLemmas (14s) +✔ [1201/1240] Built Veir.Rewriter.LinkedList.WellFormed (33s) +✔ [1202/1240] Built Veir.Rewriter.LinkedList (265ms) +✔ [1203/1240] Built Veir.Rewriter.Basic (11s) +✔ [1204/1240] Built Veir.Rewriter.GetSet.CreateRegion (2.1s) +✔ [1205/1240] Built Veir.Rewriter.GetSet.InsertOp (2.4s) +✔ [1206/1240] Built Veir.Rewriter.GetSet.InsertBlock (4.1s) +✔ [1207/1240] Built Veir.Rewriter.GetSet.Results (5.3s) +✔ [1208/1240] Built Veir.Rewriter.GetSet.DetachBlockOperands (5.8s) +✔ [1209/1240] Built Veir.Rewriter.GetSet.DetachOperands (5.9s) +✔ [1210/1240] Built Veir.Rewriter.GetSet.BlockArguments (6.3s) +✔ [1211/1240] Built Veir.Rewriter.GetSet.ReplaceUse (7.4s) +✔ [1212/1240] Built Veir.Rewriter.GetSet.DetachOp (2.9s) +✔ [1213/1240] Built Veir.Rewriter.GetSet.Regions (9.7s) +✔ [1214/1240] Built Veir.Rewriter.GetSet.BlockOperands (12s) +✔ [1215/1240] Built Veir.Rewriter.GetSet.Operands (23s) +✔ [1216/1240] Built Veir.Rewriter.GetSet.CreateOp (58s) +✔ [1217/1240] Built Veir.Rewriter.GetSet (260ms) +✔ [1218/1240] Built Veir.Rewriter.WellFormed.Region (2.6s) +✔ [1219/1240] Built Veir.Rewriter.WellFormed.OpResults (3.5s) +✔ [1220/1240] Built Veir.Rewriter.WellFormed.OpRegion (3.6s) +✔ [1221/1240] Built Veir.Rewriter.WellFormed.BlockArguments (4.1s) +✔ [1222/1240] Built Veir.Rewriter.WellFormed.Block (3.3s) +✔ [1223/1240] Built Veir.Rewriter.WellFormed.Value (7.7s) +✔ [1224/1240] Built Veir.Rewriter.WellFormed.OpOperands (9.2s) +✔ [1225/1240] Built Veir.Rewriter.WellFormed.BlockOperands (26s) +✔ [1226/1240] Built Veir.Rewriter.WellFormed.Operation (22s) +✔ [1227/1240] Built Veir.Rewriter.WellFormed.IRContext (553ms) +✔ [1228/1240] Built Veir.Rewriter.WellFormed.ReplaceOp (1.5s) +✔ [1229/1240] Built Veir.Rewriter.WellFormed (234ms) +✔ [1230/1240] Built Veir.Rewriter.WfRewriter.Basic (839ms) +✔ [1231/1240] Built Veir.Rewriter.WfRewriter.GetSet (3.5s) +✔ [1232/1240] Built Veir.Rewriter.WfRewriter (447ms) +✔ [1233/1240] Built Veir.PatternRewriter.Basic (2.2s) +✔ [1234/1240] Built Veir.Passes.Matching (980ms) +✔ [1235/1240] Built Veir.Passes.Felt.Matching (817ms) ✔ [1236/1240] Built Veir.Passes.Felt.RewriteLemmas (1.8s) ✔ [1237/1240] Built Veir.Passes.Felt.Combine (1.2s) -ℹ [1238/1240] Built LlzkLean.CertValidate (2.4s) +ℹ [1238/1240] Replayed LlzkLean.CertValidate info: LlzkLean/CertValidate.lean:147:0: [#assertCatalogCoverage] 15 VEIR rewrite-pattern defs found in Veir.FeltPass; catalog covers 2 of them; 13 uncovered (stub status; expected 13 today). Uncovered: [assoc_const_fold_add, right_zero_mul, constant_fold_mul, neg_neg_to_self, assoc_const_fold_mul, add_const_swap, right_identity_one_mul, constant_fold_sub, add_sub_const_cancel, self_subtraction_to_zero, add_neg_to_zero, constant_fold_neg, sub_add_const_cancel] -✔ [1239/1240] Built LlzkLean (1.2s) Build completed successfully (1240 jobs). diff --git a/reviews/PHASE-08/findings.md b/reviews/PHASE-08/findings.md index 6fee0f5..1fc0276 100644 --- a/reviews/PHASE-08/findings.md +++ b/reviews/PHASE-08/findings.md @@ -23,3 +23,35 @@ through the accepted registry. The case moved to `differential/corpus/felt/unspecified_add_fold.llzk` as a positive no-fold case, and the clean-pin canonical corpus remains `21 pass (incl. expected-diverge), 0 fail`. + +## F8-LLZK-02: Clean-Pin Differential Could Use Stale veir-opt + +- Severity: high +- Status: resolved +- Area: Strategy A clean dependency evidence + +The default differential path used the clean dependency `scripts/llzk-diff.sh`, +but that script preferred an existing `.lake/build/bin/veir-opt` executable +when present. A pin bump could therefore leave the source checkout at the +accepted commit while the executable still reflected an older build. + +Resolution: `differential/run-differential.sh` now rejects hidden `VEIR_OPT` +overrides on the default clean dependency path, runs `lake build veir-opt` +inside `.lake/packages/VeIR` before comparing, verifies the executable exists, +and emits a `CLEAN-VEIR-OPT` evidence marker. + +## F8-LLZK-03: Differential Evidence Omitted The Exact Clean-Pin Command + +- Severity: medium +- Status: resolved +- Area: Strategy A evidence auditability + +The Phase 8 differential evidence recorded pass/fail output but not the exact +command line. That made it possible for freshness checks to accept an output +that could have been produced with a workspace `VEIR_DIFF` or `VEIR_OPT` +override. + +Resolution: the Phase 8 evidence now records the exact +`env -u VEIR_DIFF -u VEIR_OPT LLZK_OPT=... ./differential/run-differential.sh --canonicalize differential/corpus` +command, and `scripts/harness/check-doc-freshness.sh` requires that command, +the accepted `LLZK_OPT` path, and the `CLEAN-VEIR-OPT` marker. diff --git a/scripts/harness/check-doc-freshness.sh b/scripts/harness/check-doc-freshness.sh index 4619c91..c6e3019 100755 --- a/scripts/harness/check-doc-freshness.sh +++ b/scripts/harness/check-doc-freshness.sh @@ -493,12 +493,17 @@ require_contains reviews/PHASE-08/evidence/validate-skills.txt "skill validation require_contains reviews/PHASE-08/evidence/lake-build.txt "Build completed successfully" "Phase 8 lake build evidence reports success" require_contains reviews/PHASE-08/evidence/cert-smoke.txt "CERT-SMOKE: schema validation passed" "Phase 8 certificate smoke evidence reports success" require_contains reviews/PHASE-08/evidence/cert-smoke.txt "CERT-SMOKE: theorem metadata present for 2/2 certs" "Phase 8 certificate smoke evidence validates theorem metadata" +require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt '$ env -u VEIR_DIFF -u VEIR_OPT LLZK_OPT=/nix/store/awcw2wiypa02sl5vx4xm06qwji68xz3h-llzk-debug-2.0.0/bin/llzk-opt ./differential/run-differential.sh --canonicalize differential/corpus' "Phase 8 differential evidence records exact clean-pin command" +require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt "CLEAN-VEIR-OPT: lake build veir-opt succeeded for /home/alh/LLZK/llzk-lean/.lake/packages/VeIR" "Phase 8 differential evidence records pinned veir-opt refresh" require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt "differential/corpus/felt/unspecified_add_fold.llzk" "Phase 8 differential evidence records reclassified target" require_contains reviews/PHASE-08/evidence/differential-clean-pin-canonicalize.txt "Summary: 21 pass (incl. expected-diverge), 0 fail" "Phase 8 clean-pin canonical baseline reports no failures" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 target is limited to bare/unknown-field fold-precondition parity." "Phase 8 adversarial evidence records target scope" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 consumes VeIR pin d899d95004d4bd988c8456d686c33b11a7a5eb4a." "Phase 8 adversarial evidence records consumed pin" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 reclassifies unspecified_add_fold.llzk as a positive no-fold case." "Phase 8 adversarial evidence records reclassified target case" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 clean-pin canonical baseline remains 21 pass (incl. expected-diverge), 0 fail." "Phase 8 adversarial evidence records clean-pin baseline" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: clean-pin differential refreshes pinned dependency veir-opt before comparison." "Phase 8 adversarial evidence records veir-opt refresh" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: clean-pin differential rejects hidden VEIR_OPT overrides." "Phase 8 adversarial evidence records hidden override guard" +require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: Phase 8 differential evidence records env -u VEIR_DIFF -u VEIR_OPT and the accepted LLZK_OPT path." "Phase 8 adversarial evidence records exact command evidence" require_contains reviews/PHASE-08/evidence/adversarial-review.txt "PASS: no Phase 8 findings remain open." "Phase 8 adversarial evidence reports no open findings" require_contains differential/README.md "clean-pin expanded corpus" "differential README records clean-pin expanded corpus status" require_contains differential/README.md "The directory is not a wildcard" "differential README documents exact expected-divergence markers" From 1cbd16d669a75dc16af67a5d70c1e35485905b7a Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Wed, 10 Jun 2026 23:59:18 +0100 Subject: [PATCH 13/16] Update CI cache action --- .github/workflows/certify.yml | 4 +++- .github/workflows/differential.yml | 5 +++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/certify.yml b/.github/workflows/certify.yml index 3102ce5..e9931f8 100644 --- a/.github/workflows/certify.yml +++ b/.github/workflows/certify.yml @@ -32,7 +32,9 @@ jobs: echo "$HOME/.elan/bin" >> $GITHUB_PATH - name: Cache .lake - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 + # GitHub rejects the old pinned cache SHA; use the maintained v4 + # major until an audited v4 SHA is selected. + uses: actions/cache@v4 with: path: | .lake diff --git a/.github/workflows/differential.yml b/.github/workflows/differential.yml index 29f087b..667d5fc 100644 --- a/.github/workflows/differential.yml +++ b/.github/workflows/differential.yml @@ -43,8 +43,9 @@ jobs: echo "$HOME/.elan/bin" >> $GITHUB_PATH - name: Cache .lake - # actions/cache@v4.0.2 - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 + # GitHub rejects the old pinned cache SHA; use the maintained v4 + # major until an audited v4 SHA is selected. + uses: actions/cache@v4 with: path: | .lake From b091a97126ed6df76e7fb044fc74016dc051c9c0 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Thu, 11 Jun 2026 00:05:37 +0100 Subject: [PATCH 14/16] Avoid mathlib cache fetch in CI update --- .github/workflows/certify.yml | 2 +- .github/workflows/differential.yml | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/certify.yml b/.github/workflows/certify.yml index e9931f8..b000a0e 100644 --- a/.github/workflows/certify.yml +++ b/.github/workflows/certify.yml @@ -43,7 +43,7 @@ jobs: - name: lake update + build run: | - lake update + lake update --no-cache lake build - name: Regenerate certs and compare to committed snapshot diff --git a/.github/workflows/differential.yml b/.github/workflows/differential.yml index 667d5fc..8b81303 100644 --- a/.github/workflows/differential.yml +++ b/.github/workflows/differential.yml @@ -53,13 +53,11 @@ jobs: key: lake-${{ runner.os }}-${{ hashFiles('lake-manifest.json', 'lean-toolchain') }} - name: lake update + build - # `lake update` is a no-op against a SHA-pinned manifest, kept - # for the day we move to a branch pin. `lake build` builds the - # local LlzkLean lib + emit-certs exe; veir-opt builds lazily - # inside .lake/packages/VeIR/ on first `lake exec veir-opt`, - # which the differential script triggers. + # The manifest is SHA-pinned, but CI still needs Lake to hydrate + # dependencies. `--no-cache` avoids failing on the documented + # llzk-lean/mathlib toolchain split before the build starts. run: | - lake update + lake update --no-cache lake build - name: Run differential harness From 19b53cc771db52932a94fb429827874ebaa21617 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Thu, 11 Jun 2026 00:08:16 +0100 Subject: [PATCH 15/16] Disable mathlib cache hook in CI update --- .github/workflows/certify.yml | 2 ++ .github/workflows/differential.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/certify.yml b/.github/workflows/certify.yml index b000a0e..2de7c33 100644 --- a/.github/workflows/certify.yml +++ b/.github/workflows/certify.yml @@ -42,6 +42,8 @@ jobs: key: lake-${{ runner.os }}-${{ hashFiles('lake-manifest.json', 'lean-toolchain') }} - name: lake update + build + env: + MATHLIB_NO_CACHE_ON_UPDATE: "1" run: | lake update --no-cache lake build diff --git a/.github/workflows/differential.yml b/.github/workflows/differential.yml index 8b81303..74251f6 100644 --- a/.github/workflows/differential.yml +++ b/.github/workflows/differential.yml @@ -56,6 +56,8 @@ jobs: # The manifest is SHA-pinned, but CI still needs Lake to hydrate # dependencies. `--no-cache` avoids failing on the documented # llzk-lean/mathlib toolchain split before the build starts. + env: + MATHLIB_NO_CACHE_ON_UPDATE: "1" run: | lake update --no-cache lake build From aa0ceebf6952cd7027d889b5184dba4061687960 Mon Sep 17 00:00:00 2001 From: Alexander Hicks Date: Thu, 11 Jun 2026 00:32:39 +0100 Subject: [PATCH 16/16] Align Lean toolchain with mathlib pin --- docs/REVIEW.md | 4 ++-- lean-toolchain | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/REVIEW.md b/docs/REVIEW.md index f7bdca7..3f8af8a 100644 --- a/docs/REVIEW.md +++ b/docs/REVIEW.md @@ -63,8 +63,8 @@ normalizer. See §8. | Item | Finding | How confirmed | |---|---|---| -| Build | `llzk-lean` builds clean (1244 jobs) under Lean v4.30.0 | full `lake build` | -| Toolchain split | `veir` pins `v4.30.0-rc2`, `llzk-lean` pins `v4.30.0`; did **not** break this build | observed | +| Build | `llzk-lean` builds clean (1240 jobs) under Lean v4.30.0-rc2 | full `lake build` | +| Toolchain alignment | `veir`, `mathlib`, and `llzk-lean` pin `v4.30.0-rc2`; this avoids the mathlib cache hook mismatch seen with mixed pins | observed | | **Stale manifest (H4)** | **RESOLVED by Phase 1.** `lakefile.toml`, `lake-manifest.json`, and `.lake/packages/VeIR` now point at `project-llzk/veir @ d4cc1bf2d31beeca17eb2e8c9c7181d04af013a3`; the gate also checks manifest `url`, `type`, `rev`, and `inputRev`. | `scripts/harness/verify-pins.sh --workspace-veir ../veir` | | 15 theorems | axiom-clean: `[propext, Quot.sound]` only — no `sorryAx` | axiom audit | | 15 patterns + the `Combine` pass | ~~carry `sorryAx`~~ **RESOLVED (F1, 2026-06-02):** all 15 patterns now axiom-clean `[propext, Classical.choice, Quot.sound]` — no `sorryAx`, no `WfIRContext.Dom`. See §3 joint 2. | axiom audit (veir `lake build` + `#print axioms`) | diff --git a/lean-toolchain b/lean-toolchain index 5a8f161..6c7e31f 100644 --- a/lean-toolchain +++ b/lean-toolchain @@ -1 +1 @@ -leanprover/lean4:v4.30.0 \ No newline at end of file +leanprover/lean4:v4.30.0-rc2