Triple-kernel (Coq/Lean/Verus) CUB theorem corpus with in-crate proof-to-code bindings — mixed-snapshot scoped
Scoped
Scope boundary: Mixed-corpus snapshot — closure is per-file / manifest-scoped, NOT a blanket zero-axiom certificate. The proofs are standalone: 0/476 Verus specs import the runtime crates, so the corpus does not formally verify the shipping Rust.
Claim
cubie-tf and cubie-research ship a triple-kernel formal proof corpus (Coq 8.18, Lean 4, Verus) keyed by CUB theorem IDs. The published cubie-tf snapshot (baseline commit c3d4ae27, verified SHA-256 0a60569...fbbd) is a MIXED corpus: coq/ 487 files, lean/ 563 files, verus/ 476 files — containing both closed proofs and statement-form/stub material. It is NOT a blanket zero-axiom / proof-closure certificate; its own published library MANIFEST (/objects/cubie-tf/verified-proofs/2026-07-04/MANIFEST.md) says "Do not cite the full ZIP as uniformly verified evidence" and names known-unclosed files (coq/CUB_2000_CubeObjectSize192.v Admitted; verus/cubie_adversarial_robustness_theorem_spec.rs ensures-true stub). Live re-measured flagged counts on the snapshot: Coq 138/487 files contain an `Admitted` token, Lean 258/563 contain a `sorry` token, Verus 142/476 contain a stub marker (external_body 42, ensures-true 77, assume 51) — but these are coarse file-presence upper bounds: many hits are in comments (e.g. only ~52/563 Lean files have `sorry` on a non-comment line), so genuinely-unclosed file counts are materially lower. The proofs are STANDALONE: 0/476 verus specs import the crates, and CI runs the Verus kernel check with `verus --crate-type lib` on the spec files STANDALONE (proof-kernel-check.yml over the spec corpus, exit 1 on failure; proof-kernel-verification.yml a hard gate, continue-on-error:false, on the narrow CUB-1940..1966 TEP band proofs/*/tep/CUB_19[4-6][0-9]_*), so the corpus does NOT formally verify the runtime crate code. Proof-to-code binding is by CUB-ID cross-reference plus behavioral Rust tests, not Verus-over-runtime: CUB-1921 (Page-CUSUM aggregator) has coq/CubieCusumAggregator.v + lean/CubieCusumAggregator.lean + verus/cubie_cusum_aggregator_spec.rs (proofs), cubie-tep/src/cusum.rs (code), and cubie-tep/tests/cusum_wiring.rs (behavioral OR-gate wiring test naming CUB-1921). Separately, in-crate `verus! {}` blocks bind directly to the shipping exec fns (cubie-core/src/replay.rs, cubie-platform/src/uah.rs, etc.) — ~62 files / ~429 blocks across the runtime crates, cubie-core the majority — and erase to plain Rust under a normal cargo build. A REPORT-ONLY CI job ('Verus in-crate wiring' in proof-kernel-check.yml, continue-on-error, pinned Verus 0.2026.05.24) runs `verus --crate-type lib` over ~51 wired runtime files; being report-only it SURFACES pass/fail but does NOT block merge, and closure over all in-crate files is partial. Documented locally verified (Verus 0.2026.05.03, `--crate-type lib`, 0 errors): 6 files / 105 obligations — agent_stress.rs 12, cube_topology.rs 21, ising_hamiltonian.rs 5, ramen_corner.rs 17, belnap.rs 32, landauer.rs 18 (docs/audit/2026-07-12_verus_in_crate_binding_evidence.md). Tracked live at the unified registry's meta.in_crate_verus (https://registry.trustfortress.ai). The v6 TEP whitepaper (repo cubie-math revision, 2026-05-26) claims a broader envelope — CUB-0704..CUB-1966 (1,966 unique IDs), 1,145 IDs with full triple-kernel parity, and substantive (no admit/sorry) CI-enforced bodies specifically for the CUB-1940..1966 band; those are whitepaper-revision numbers, not the cubie-tf snapshot's live verified-ID count. cubie-research holds a SEPARATE, tightly-scoped triple-kernel corpus (proofs/coq 36, lean4 22, verus 23; provenance commit 1e8c3e26): CUB-TSP-001–006, 008–012, 014–016 (14 proven in all three kernels) with Coq coqchk `Axioms: <none>`, Lean on 3 standard axioms (no sorry), Verus no assume/admit — but its README explicitly bounds this as a seal over axiom-free Coq DEFINITIONS ("trivial" on definitions), not a P vs NP result.
Direct downloads (public — lib.trustfortress.ai)
v6 TEP whitepaper (CUB-0704..1966, 1145-ID triple parity, CUB-1940..1966 substantive; cubie-math revision 2026-05-26)
Source evidence (pinned)
cubie-tf coq/ proof dir (487 .v files at snapshot baseline)
🔒 Sourcecubie-tf/coq/CubieCusumAggregator.v@c3d4ae27private repo cubie-tf lean/ proof dir (563 .lean files at snapshot baseline)
🔒 Sourcecubie-tf/lean/CubieCusumAggregator.lean@c3d4ae27private repo cubie-tf verus/ proof dir (476 .rs files; standalone, 0 import crates)
🔒 Sourcecubie-tf/verus/cubie_cusum_aggregator_spec.rs@c3d4ae27private repo CUB-1921 proof-to-code binding: cusum.rs runtime code
🔒 Sourcecubie-tf/cubie-tep/src/cusum.rs@c3d4ae27private repo CUB-1921 behavioral wiring test binding proof-ID to live TepDetector
🔒 Sourcecubie-tf/cubie-tep/tests/cusum_wiring.rs@c3d4ae27private repo In-crate verus! block (erases under cargo build; not CI-verified against runtime)
🔒 Sourcecubie-tf/cubie-core/src/replay.rs@c3d4ae27private repo In-crate proof-to-code verification via the report-only 'Verus in-crate wiring' CI job (proof-kernel-check.yml): `verus --crate-type lib` over ~51 wired runtime files. Documented locally verified: 6 files / 105 obligations, 0 errors (agent_stress 12, cube_topology 21, ising_hamiltonian 5, ramen_corner 17, belnap 32, landauer 18) — docs/audit/2026-07-12_verus_in_crate_binding_evidence.md. Report-only => surfaces pass/fail, not a hard gate; closure over all in-crate files is partial. Live count at registry meta.in_crate_verus.
🔒 Sourcecubie-tf/cubie-core/src/belnap.rs@3ca82b4bprivate repo CI Verus kernel check runs `verus --crate-type lib` on the spec files standalone; proof-kernel-verification.yml is a hard gate (continue-on-error:false) on the CUB-1940..1966 TEP band, and 0/476 specs import the runtime crates — so CI does not formally verify the runtime crate code.
🔒 Sourcecubie-tf/.github/workflows/proof-kernel-verification.yml@88ef7e83private repo Known-unclosed example flagged by manifest (Admitted)
🔒 Sourcecubie-tf/coq/CUB_2000_CubeObjectSize192.v@c3d4ae27private repo Published proof-corpus MANIFEST (scoping: mixed snapshot, not uniformly verified)
Published proof-corpus ZIP snapshot (2723732 bytes, SHA-256 verified live)
Locked IPemail-gated IPsha256 0a60569028a0b6653444510343e435d35b57af9cdf044c39e808cca43a19fbbd cubie-research proofs/coq (36 .v, CUB-TSP band, coqchk Axioms: none on definitions)
🔒 Sourcecubie-research/proofs/coq/CubTsp001.v@1e8c3e26private repo cubie-research proofs/lean4 (22 .lean, 3 standard axioms, no sorry)
🔒 Sourcecubie-research/proofs/lean4/CubTsp001.lean@1e8c3e26private repo cubie-research proofs/verus (23 .rs, no assume/admit)
🔒 Sourcecubie-research/proofs/verus/cub_tsp_001.rs@1e8c3e26private repo cubie-research proof SHA-256 ledger (127 files, provers coq 8.18.0 / lean4 4.31.0 / verus 0.2026.06.28)
🔒 Sourcecubie-research/ledger/proof_hashes.json@1e8c3e26private repo cubie-research canonical verification script
🔒 Sourcecubie-research/tools/verify_proofs.ps1@1e8c3e26private repo Reproduce this result
# 1. Verify the published cubie-tf snapshot ZIP hash.
git archive --format=zip -o cubie-tf-verified-proofs-corpus-20260704.zip c3d4ae2783f4de9403dd3a3f02abcc1cc8a53a08 coq/ lean/ verus/
sha256sum cubie-tf-verified-proofs-corpus-20260704.zip # git-archive ZIP container hashes are Git/toolchain-sensitive; use the published object below as canonical
# Download the published object directly and hash it:
curl -sL -o corpus.zip 'https://lib.trustfortress.ai/objects/cubie-tf%2Fverified-proofs%2F2026-07-04%2Fcubie-tf-verified-proofs-corpus-20260704.zip' && sha256sum corpus.zip # must equal 0a60569028a0b6653444510343e435d35b57af9cdf044c39e808cca43a19fbbd
# 2. Re-measure file counts and real-vs-flagged binding counts on the snapshot:
unzip -q corpus.zip -d ex
find ex/coq -name '*.v' | wc -l # 487
find ex/lean -name '*.lean' | wc -l # 563
find ex/verus -name '*.rs' | wc -l # 476
grep -rlE '\bAdmitted\b' ex/coq --include='*.v' | wc -l # 138 files (coarse upper bound; some in comments)
grep -rlE '\bsorry\b' ex/lean --include='*.lean' | wc -l # 258 files raw; ~52 with sorry on a non-comment line
grep -rlE 'external_body|ensures[[:space:]]+true\b|assume\(' ex/verus --include='*.rs' | wc -l # 142 files
grep -rlE 'use +crate::|use +cubie_core|extern crate cubie' ex/verus --include='*.rs' | wc -l # 0 -> standalone, not runtime-wired
# 3. Per-kernel verifier checks on a CLOSED file (scoped, not the whole ZIP):
coqc ex/coq/CubieCusumAggregator.v && coqchk ex/coq/CubieCusumAggregator.vo # expect Axioms: <none> on closed modules
lake env lean ex/lean/CubieCusumAggregator.lean # then '#print axioms <thm>' per theorem
verus --crate-type lib ex/verus/cubie_cusum_aggregator_spec.rs # standalone per-file check in CI; NOT report-only
# 4. cubie-research triple-kernel corpus (clone iamdatanick/cubie-research at 1e8c3e26):
pwsh tools/verify_proofs.ps1 -Build # runs all proofs + coqchk Axioms: <none> audit + SHA-256 ledger integrity
python tools/gen_sha_ledger.py --check # verify ledger/proof_hashes.json root_sha256 7881e3a9...d54
Verification checks
- MANIFEST self-scoping: 'mixed corpus snapshot ... Do not cite the full ZIP as uniformly verified evidence' — status must be scoped/partial, never 'verified'.
- Snapshot SHA-256 reproduced live 2026-07-04: 0a60569028a0b6653444510343e435d35b57af9cdf044c39e808cca43a19fbbd (2723732 bytes) — matches manifest exactly.
- File counts reproduced on the verified ZIP: coq 487, lean 563, verus 476 (match manifest table).
- Flagged-file counts are file-presence UPPER BOUNDS: e.g. Lean raw sorry-in-file=258 but sorry-on-non-comment-line~=52; treat as 'files containing marker', not 'unverified theorems'.
- 0/476 verus specs import crates + CI runs verus --crate-type lib per-file STANDALONE (proof-kernel-verification.yml is a hard gate on the CUB-1940..1966 band) => corpus is standalone; 'proofs verify the runtime' would be overstated. Binding = CUB-ID cross-ref + behavioral tests.
- Whitepaper numbers (1966 IDs, 1145 triple-parity, CUB-1940..1966 substantive) are cubie-math revision 2026-05-26 claims — attribute to whitepaper, do NOT present as cubie-tf snapshot's live verified-ID count.
- cubie-research 'Axioms: <none>' is scoped by its own README to axiom-free Coq DEFINITIONS ('trivial' on definitions); 14 CUB-TSP IDs proven all-three-kernels, no P-vs-NP claim.
Known boundaries / open gaps
- Exact verified-vs-unclosed THEOREM count per kernel on the cubie-tf snapshot is not published as a machine-readable inventory; only file-presence marker counts (measured here) and two named example files are authoritative. A per-theorem coqchk/#print-axioms/verus sweep would be needed to produce true closed-theorem counts; the MANIFEST deliberately declines to make that blanket claim.
- Whitepaper's 1,145-ID triple-kernel-parity and 1,966-unique-ID figures are stated for the cubie-math revision (2026-05-26) and were not re-derivable against the cubie-tf snapshot within this task; the snapshot's live unique-CUB-ID parity count is unmeasured.
- The v6 whitepaper PDF header cites github.com/iamdatanick/cubie-math (frozen/absorbed source-mirror), so its counts predate the cubie-tf monorepo snapshot; treat as historical-revision provenance, not current cubie-tf state.