1	Require Import Bool List Nat Lia PeanoNat.
2	Import ListNotations.
3	Section CubieAttentionGeometry_v7.
4	(* ============================================================================== *)
5	(* 1. HEAD-SHAPE AGREEMENT PREDICATE (CUB-0722)                                  *)
6	(* ============================================================================== *)
7
8	(* AttentionManifest: the shape parameters that must agree across manifest,
9	   engine, and runtime for a valid attention configuration. *)
10	Record AttentionManifest := {
11	  manifest_layers : nat;
12	  manifest_h_q    : nat;
13	  manifest_h_kv   : nat;
14	  manifest_d_head : nat;
15	  manifest_tp     : nat;
16	  manifest_pp     : nat;
17	  manifest_use_fp16 : bool;
18	}.
19
20	(* HeadShapeOK: manifest, engine, and runtime must agree on L, H_q, H_kv, D_head.
21	   This is an 8-field equality predicate across 3 sources = 8 comparisons. *)
22	Definition HeadShapeOK (manifest engine runtime : AttentionManifest) : bool :=
23	  Nat.eqb (manifest_layers manifest) (manifest_layers engine)   &&
24	  Nat.eqb (manifest_layers engine)   (manifest_layers runtime)  &&
25	  Nat.eqb (manifest_h_q manifest)    (manifest_h_q engine)      &&
26	  Nat.eqb (manifest_h_q engine)      (manifest_h_q runtime)     &&
27	  Nat.eqb (manifest_h_kv manifest)   (manifest_h_kv engine)     &&
28	  Nat.eqb (manifest_h_kv engine)     (manifest_h_kv runtime)    &&
29	  Nat.eqb (manifest_d_head manifest) (manifest_d_head engine)   &&
30	  Nat.eqb (manifest_d_head engine)   (manifest_d_head runtime).
31
32	(* ============================================================================== *)
33	(* 2. WASTE-OK DECOMPOSITION (CUB-0723)                                           *)
34	(* ============================================================================== *)
35
36	(* WasteOKFactors: the 7 orthogonal factors that jointly constitute waste_ok.
37	   V1.40/V2.0 treated waste_ok as atomic; v2.5 decomposes it. *)
38	Record WasteOKFactors := {
39	  roofline_ok          : bool;
40	  kv_heads_ok          : bool;
41	  q_heads_ok           : bool;
42	  adapter_swap_ok_b    : bool;
43	  nvlink_waiter_safe_b : bool;
44	  loop_free            : bool;
45	  target_pool_ok       : bool;
46	}.
47
48	(* waste_ok_decomposition: all 7 factors must hold for waste_ok = true. *)
49	Definition waste_ok_decomposition (w : WasteOKFactors) : bool :=
50	  roofline_ok w          &&
51	  kv_heads_ok w          &&
52	  q_heads_ok w           &&
53	  adapter_swap_ok_b w    &&
54	  nvlink_waiter_safe_b w &&
55	  loop_free w            &&
56	  target_pool_ok w.
57
58	(* ============================================================================== *)
59	(* 3. ADAPTER-SWAP AND NVLINK-WAITER (CUB-0724, CUB-0725)                        *)
60	(* ============================================================================== *)
61
62	(* adapter_swap_ok: ok iff the adapter is already cached OR PCIe has capacity. *)
63	Definition adapter_swap_ok (cached pcie_ok : bool) : bool :=
64	  cached || pcie_ok.
65
66	(* nvlink_waiter_safe: unsafe iff SM activity is zero AND VRAM is allocated.
67	   "Zero SM + allocated VRAM" is the deadlock signature. *)
68	Definition nvlink_waiter_safe (zero_sm alloc_vram : bool) : bool :=
69	  negb (zero_sm && alloc_vram).
70
71	(* ============================================================================== *)
72	(* 4. HEAD-SHAPE MISMATCH IMPLIES WASTE ZERO (CUB-0726)                          *)
73	(* ============================================================================== *)
74
75	(* Design rule: when HeadShapeOK fails AND kv_heads_ok reflects HeadShapeOK,
76	   waste_ok_decomposition is false.
77	   Encoding: kv_heads_ok is set by the runtime to equal HeadShapeOK(m,e,r). *)
78	Theorem head_shape_mismatch_implies_waste_zero :
79	  forall (m e r : AttentionManifest) (w : WasteOKFactors),
80	  HeadShapeOK m e r = false ->
81	  kv_heads_ok w = HeadShapeOK m e r ->
82	  waste_ok_decomposition w = false.
83	Proof.
84	  intros m e r w Hmismatch Hkv.
85	  unfold waste_ok_decomposition.
86	  rewrite Hkv.
87	  rewrite Hmismatch.
88	  destruct (roofline_ok w); reflexivity.
89	Qed.
90
91	(* ============================================================================== *)
92	(* 5. SYMMETRIC-MAC FAST-PATH CONSTRAINT (CUB-0727)                              *)
93	(* ============================================================================== *)
94
95	(* FastPathConfig: fast-path is only valid when symmetric MAC is in use. *)
96	Record FastPathConfig := {
97	  use_symmetric_mac : bool;
98	  fast_path_ok      : bool;
99	}.
100
101	(* symmetric_fast_path_valid: requires both symmetric MAC and fast_path_ok. *)
102	Definition symmetric_fast_path_valid (cfg : FastPathConfig) : bool :=
103	  use_symmetric_mac cfg && fast_path_ok cfg.
104
105	(* symmetric_mac_fast_path_constraint: no symmetric MAC => fast-path invalid.
106	   Subagent delegation chains must use symmetric chained MACs (Macaroons),
107	   not asymmetric nested JWTs. *)
108	Theorem symmetric_mac_fast_path_constraint : forall (cfg : FastPathConfig),
109	  use_symmetric_mac cfg = false ->
110	  symmetric_fast_path_valid cfg = false.
111	Proof.
112	  intros cfg H.
113	  unfold symmetric_fast_path_valid.
114	  rewrite H.
115	  reflexivity.
116	Qed.
117
118	(* Lemma: nvlink deadlock signature is detectable. *)
119	Lemma nvlink_deadlock_detected : forall (zero_sm alloc_vram : bool),
120	  zero_sm = true -> alloc_vram = true ->
121	  nvlink_waiter_safe zero_sm alloc_vram = false.
122	Proof.
123	  intros zero_sm alloc_vram Hz Ha.
124	  unfold nvlink_waiter_safe.
125	  rewrite Hz. rewrite Ha.
126	  reflexivity.
127	Qed.
128
129	(* Lemma: if not cached and PCIe fails, adapter_swap is false. *)
130	Lemma adapter_swap_fails_when_uncached_and_no_pcie :
131	  forall (cached pcie_ok : bool),
132	  cached = false -> pcie_ok = false ->
133	  adapter_swap_ok cached pcie_ok = false.
134	Proof.
135	  intros cached pcie_ok Hc Hp.
136	  unfold adapter_swap_ok.
137	  rewrite Hc. rewrite Hp.
138	  reflexivity.
139	Qed.
140
141	End CubieAttentionGeometry_v7.
142

Require Import Bool List Nat Lia PeanoNat.
Import ListNotations.
Section CubieAttentionGeometry_v7.
(* ============================================================================== *)
(* 1. HEAD-SHAPE AGREEMENT PREDICATE (CUB-0722)                                  *)
(* ============================================================================== *)

(* AttentionManifest: the shape parameters that must agree across manifest,
   engine, and runtime for a valid attention configuration. *)
Record AttentionManifest := {
  manifest_layers : nat;
  manifest_h_q    : nat;
  manifest_h_kv   : nat;
  manifest_d_head : nat;
  manifest_tp     : nat;
  manifest_pp     : nat;
  manifest_use_fp16 : bool;
}.

(* HeadShapeOK: manifest, engine, and runtime must agree on L, H_q, H_kv, D_head.
   This is an 8-field equality predicate across 3 sources = 8 comparisons. *)
Definition HeadShapeOK (manifest engine runtime : AttentionManifest) : bool :=
  Nat.eqb (manifest_layers manifest) (manifest_layers engine)   &&
  Nat.eqb (manifest_layers engine)   (manifest_layers runtime)  &&
  Nat.eqb (manifest_h_q manifest)    (manifest_h_q engine)      &&
  Nat.eqb (manifest_h_q engine)      (manifest_h_q runtime)     &&
  Nat.eqb (manifest_h_kv manifest)   (manifest_h_kv engine)     &&
  Nat.eqb (manifest_h_kv engine)     (manifest_h_kv runtime)    &&
  Nat.eqb (manifest_d_head manifest) (manifest_d_head engine)   &&
  Nat.eqb (manifest_d_head engine)   (manifest_d_head runtime).

(* ============================================================================== *)
(* 2. WASTE-OK DECOMPOSITION (CUB-0723)                                           *)
(* ============================================================================== *)

(* WasteOKFactors: the 7 orthogonal factors that jointly constitute waste_ok.
   V1.40/V2.0 treated waste_ok as atomic; v2.5 decomposes it. *)
Record WasteOKFactors := {
  roofline_ok          : bool;
  kv_heads_ok          : bool;
  q_heads_ok           : bool;
  adapter_swap_ok_b    : bool;
  nvlink_waiter_safe_b : bool;
  loop_free            : bool;
  target_pool_ok       : bool;
}.

(* waste_ok_decomposition: all 7 factors must hold for waste_ok = true. *)
Definition waste_ok_decomposition (w : WasteOKFactors) : bool :=
  roofline_ok w          &&
  kv_heads_ok w          &&
  q_heads_ok w           &&
  adapter_swap_ok_b w    &&
  nvlink_waiter_safe_b w &&
  loop_free w            &&
  target_pool_ok w.

(* ============================================================================== *)
(* 3. ADAPTER-SWAP AND NVLINK-WAITER (CUB-0724, CUB-0725)                        *)
(* ============================================================================== *)

(* adapter_swap_ok: ok iff the adapter is already cached OR PCIe has capacity. *)
Definition adapter_swap_ok (cached pcie_ok : bool) : bool :=
  cached || pcie_ok.

(* nvlink_waiter_safe: unsafe iff SM activity is zero AND VRAM is allocated.
   "Zero SM + allocated VRAM" is the deadlock signature. *)
Definition nvlink_waiter_safe (zero_sm alloc_vram : bool) : bool :=
  negb (zero_sm && alloc_vram).

(* ============================================================================== *)
(* 4. HEAD-SHAPE MISMATCH IMPLIES WASTE ZERO (CUB-0726)                          *)
(* ============================================================================== *)

(* Design rule: when HeadShapeOK fails AND kv_heads_ok reflects HeadShapeOK,
   waste_ok_decomposition is false.
   Encoding: kv_heads_ok is set by the runtime to equal HeadShapeOK(m,e,r). *)
Theorem head_shape_mismatch_implies_waste_zero :
  forall (m e r : AttentionManifest) (w : WasteOKFactors),
  HeadShapeOK m e r = false ->
  kv_heads_ok w = HeadShapeOK m e r ->
  waste_ok_decomposition w = false.
Proof.
  intros m e r w Hmismatch Hkv.
  unfold waste_ok_decomposition.
  rewrite Hkv.
  rewrite Hmismatch.
  destruct (roofline_ok w); reflexivity.
Qed.

(* ============================================================================== *)
(* 5. SYMMETRIC-MAC FAST-PATH CONSTRAINT (CUB-0727)                              *)
(* ============================================================================== *)

(* FastPathConfig: fast-path is only valid when symmetric MAC is in use. *)
Record FastPathConfig := {
  use_symmetric_mac : bool;
  fast_path_ok      : bool;
}.

(* symmetric_fast_path_valid: requires both symmetric MAC and fast_path_ok. *)
Definition symmetric_fast_path_valid (cfg : FastPathConfig) : bool :=
  use_symmetric_mac cfg && fast_path_ok cfg.

(* symmetric_mac_fast_path_constraint: no symmetric MAC => fast-path invalid.
   Subagent delegation chains must use symmetric chained MACs (Macaroons),
   not asymmetric nested JWTs. *)
Theorem symmetric_mac_fast_path_constraint : forall (cfg : FastPathConfig),
  use_symmetric_mac cfg = false ->
  symmetric_fast_path_valid cfg = false.
Proof.
  intros cfg H.
  unfold symmetric_fast_path_valid.
  rewrite H.
  reflexivity.
Qed.

(* Lemma: nvlink deadlock signature is detectable. *)
Lemma nvlink_deadlock_detected : forall (zero_sm alloc_vram : bool),
  zero_sm = true -> alloc_vram = true ->
  nvlink_waiter_safe zero_sm alloc_vram = false.
Proof.
  intros zero_sm alloc_vram Hz Ha.
  unfold nvlink_waiter_safe.
  rewrite Hz. rewrite Ha.
  reflexivity.
Qed.

(* Lemma: if not cached and PCIe fails, adapter_swap is false. *)
Lemma adapter_swap_fails_when_uncached_and_no_pcie :
  forall (cached pcie_ok : bool),
  cached = false -> pcie_ok = false ->
  adapter_swap_ok cached pcie_ok = false.
Proof.
  intros cached pcie_ok Hc Hp.
  unfold adapter_swap_ok.
  rewrite Hc. rewrite Hp.
  reflexivity.
Qed.

End CubieAttentionGeometry_v7.


1	Require Import Bool List Nat Lia PeanoNat.
2	Import ListNotations.
3	Section CubieEngineeringPhysics_v7.
4	(* ============================================================================== *)
5	(* 1. KV-CACHE BYTE ESTIMATOR (CUB-0728)                                          *)
6	(* ============================================================================== *)
7
8	(* kv_cache_byte_estimator: KVBytes ≈ 2 × L_layers × B × L_ctx × H_kv × D_head.
9	   Simplified: b_elem factor absorbed into coefficient 2 (FP16 = 2 bytes).
10	   Used in waste_ok / budget gate. *)
11	Definition kv_cache_byte_estimator
12	  (layers batch ctx h_kv d_head : nat) : nat :=
13	  2 * layers * batch * ctx * h_kv * d_head.
14
15	(* ============================================================================== *)
16	(* 2. ROOFLINE ADMISSION TIME (CUB-0729)                                          *)
17	(* ============================================================================== *)
18
19	(* roofline_admission_time: t_gpu(r,e) = max(t_compute, t_mem).
20	   Roofline-inspired admission time: the bottleneck dominates. *)
21	Definition roofline_admission_time (t_compute t_mem : nat) : nat :=
22	  Nat.max t_compute t_mem.
23
24	(* ============================================================================== *)
25	(* 3. PESSIMISTIC CONTEXT LENGTH BOUND (CUB-0730)                                 *)
26	(* ============================================================================== *)
27
28	(* l_ctx_pessimistic_bound: L_ctx = input_tokens + max_output_tokens.
29	   Policy: use max_output rather than expected_output to avoid under-reservation. *)
30	Definition l_ctx_pessimistic_bound (input_tokens max_output : nat) : nat :=
31	  input_tokens + max_output.
32
33	(* ============================================================================== *)
34	(* 4. FAILURE PROBABILITY BOUND (CUB-0731)                                        *)
35	(* ============================================================================== *)
36
37	(* failure_probability_bound: KV estimator is monotone in layers.
38	   Larger layer count => more KV bytes (monotone upper bound).
39	   This formalizes the key safety property: underestimating layers is unsafe. *)
40	Lemma failure_probability_bound :
41	  forall (layers1 layers2 batch ctx h_kv d_head : nat),
42	  layers1 <= layers2 ->
43	  kv_cache_byte_estimator layers1 batch ctx h_kv d_head <=
44	  kv_cache_byte_estimator layers2 batch ctx h_kv d_head.
45	Proof.
46	  intros layers1 layers2 batch ctx h_kv d_head Hlayers.
47	  unfold kv_cache_byte_estimator.
48	  lia.
49	Qed.
50
51	(* Roofline is symmetric: max(a,b) = max(b,a). *)
52	Lemma roofline_symmetric : forall (t_compute t_mem : nat),
53	  roofline_admission_time t_compute t_mem =
54	  roofline_admission_time t_mem t_compute.
55	Proof.
56	  intros t_compute t_mem.
57	  unfold roofline_admission_time.
58	  apply Nat.max_comm.
59	Qed.
60
61	(* Pessimistic bound is at least as large as input alone. *)
62	Lemma pessimistic_bound_ge_input : forall (input_tokens max_output : nat),
63	  input_tokens <= l_ctx_pessimistic_bound input_tokens max_output.
64	Proof.
65	  intros input_tokens max_output.
66	  unfold l_ctx_pessimistic_bound.
67	  lia.
68	Qed.
69
70	(* KV estimator is monotone in batch size. *)
71	Lemma kv_estimator_monotone_batch : forall (layers batch1 batch2 ctx h_kv d_head : nat),
72	  batch1 <= batch2 ->
73	  kv_cache_byte_estimator layers batch1 ctx h_kv d_head <=
74	  kv_cache_byte_estimator layers batch2 ctx h_kv d_head.
75	Proof.
76	  intros.
77	  unfold kv_cache_byte_estimator.
78	  lia.
79	Qed.
80
81	End CubieEngineeringPhysics_v7.
82

Require Import Bool List Nat Lia PeanoNat.
Import ListNotations.
Section CubieEngineeringPhysics_v7.
(* ============================================================================== *)
(* 1. KV-CACHE BYTE ESTIMATOR (CUB-0728)                                          *)
(* ============================================================================== *)

(* kv_cache_byte_estimator: KVBytes ≈ 2 × L_layers × B × L_ctx × H_kv × D_head.
   Simplified: b_elem factor absorbed into coefficient 2 (FP16 = 2 bytes).
   Used in waste_ok / budget gate. *)
Definition kv_cache_byte_estimator
  (layers batch ctx h_kv d_head : nat) : nat :=
  2 * layers * batch * ctx * h_kv * d_head.

(* ============================================================================== *)
(* 2. ROOFLINE ADMISSION TIME (CUB-0729)                                          *)
(* ============================================================================== *)

(* roofline_admission_time: t_gpu(r,e) = max(t_compute, t_mem).
   Roofline-inspired admission time: the bottleneck dominates. *)
Definition roofline_admission_time (t_compute t_mem : nat) : nat :=
  Nat.max t_compute t_mem.

(* ============================================================================== *)
(* 3. PESSIMISTIC CONTEXT LENGTH BOUND (CUB-0730)                                 *)
(* ============================================================================== *)

(* l_ctx_pessimistic_bound: L_ctx = input_tokens + max_output_tokens.
   Policy: use max_output rather than expected_output to avoid under-reservation. *)
Definition l_ctx_pessimistic_bound (input_tokens max_output : nat) : nat :=
  input_tokens + max_output.

(* ============================================================================== *)
(* 4. FAILURE PROBABILITY BOUND (CUB-0731)                                        *)
(* ============================================================================== *)

(* failure_probability_bound: KV estimator is monotone in layers.
   Larger layer count => more KV bytes (monotone upper bound).
   This formalizes the key safety property: underestimating layers is unsafe. *)
Lemma failure_probability_bound :
  forall (layers1 layers2 batch ctx h_kv d_head : nat),
  layers1 <= layers2 ->
  kv_cache_byte_estimator layers1 batch ctx h_kv d_head <=
  kv_cache_byte_estimator layers2 batch ctx h_kv d_head.
Proof.
  intros layers1 layers2 batch ctx h_kv d_head Hlayers.
  unfold kv_cache_byte_estimator.
  lia.
Qed.

(* Roofline is symmetric: max(a,b) = max(b,a). *)
Lemma roofline_symmetric : forall (t_compute t_mem : nat),
  roofline_admission_time t_compute t_mem =
  roofline_admission_time t_mem t_compute.
Proof.
  intros t_compute t_mem.
  unfold roofline_admission_time.
  apply Nat.max_comm.
Qed.

(* Pessimistic bound is at least as large as input alone. *)
Lemma pessimistic_bound_ge_input : forall (input_tokens max_output : nat),
  input_tokens <= l_ctx_pessimistic_bound input_tokens max_output.
Proof.
  intros input_tokens max_output.
  unfold l_ctx_pessimistic_bound.
  lia.
Qed.

(* KV estimator is monotone in batch size. *)
Lemma kv_estimator_monotone_batch : forall (layers batch1 batch2 ctx h_kv d_head : nat),
  batch1 <= batch2 ->
  kv_cache_byte_estimator layers batch1 ctx h_kv d_head <=
  kv_cache_byte_estimator layers batch2 ctx h_kv d_head.
Proof.
  intros.
  unfold kv_cache_byte_estimator.
  lia.
Qed.

End CubieEngineeringPhysics_v7.


Bash

cd C:/Users/NickV/cubie-verification && grep -c "Theorem\|Lemma\|Definition\|Record" coq/CubieAttentionGeometry_v7.v coq/CubieEngineeringPhysics_v7.v

Count theorems in gap files


coq/CubieAttentionGeometry_v7.v:14
coq/CubieEngineeringPhysics_v7.v:7


cd C:/Users/NickV/cubie-verification && grep "status" roadmap/master_theorem_table.csv | head -1 && grep -c "VERIFIED_EXACT" roadmap/master_theorem_table.csv && grep -c "VERIFIED_EQUIVALENT" roadmap/master_theorem_table.csv && grep -c "DERIVED_CANDIDATE" roadmap/master_theorem_table.csv && grep -c "FUTURE_OBLIGATION" roadmap/master_theorem_table.csv && grep -c "ENGINEERING_INVARIANT" roadmap/master_theorem_table.csv

Count verification statuses


master_id,module,deliverable,cluster,cluster_no,version_chain,theorem_name,kind,coq_file,lean_file,coq_sha256,lean_sha256,coq_line,axiom_profile,status,canonical,formal_systems,notes
594
0


cd C:/Users/NickV/cubie-verification && awk -F',' '{print $15}' roadmap/master_theorem_table.csv | sort | uniq -c | sort -rn

Count all verification statuses


    594 VERIFIED_EXACT
    139 DERIVED_CANDIDATE
      1 status


cd C:/Users/NickV/cubie-verification && grep "CUB-07" roadmap/master_theorem_table.csv | head -20

Check CUB-0717+ gap theorem entries


CUB-0700,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,attested_cached_macrograph_passes,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,221,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0701,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,dual_audit_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,242,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0702,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,dual_audit_ok_implies_duality_ok,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,247,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0703,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,center_move_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,264,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0704,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,center_move_requires_authority,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,268,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0705,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,how_stale_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,296,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0706,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,reclaim_if_how_stale_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,299,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0707,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,stale_how_reclaims,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,302,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0708,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,proof_ref_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,340,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0709,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,evidence_record_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,343,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0710,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,grand_fusion_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,348,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0711,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,edge_corner_ok_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,354,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0712,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,Auth_v1_10_b,Definition,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,364,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0713,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,Auth_v1_10_implies_grand_fusion_ok,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,375,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0714,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,Auth_v1_10_implies_mode_ok,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,384,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0715,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,Auth_v1_10_implies_edge_corner_ok,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,395,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0716,cubieq_omega_incremental_next_addendum,CubieQ Omega Next Addendum,CubieQ Addenda,15,CUBIEQ_ADDENDUM,Auth_v1_10_implies_evidence_ok,Theorem,cubieq_omega_incremental_next_addendum.v,,34aa72334343d9e7...,,406,0 axioms,VERIFIED_EXACT,YES,Coq,Next increment theorems.
CUB-0717,CubieTrustCompilerV2_1,V2.1 Execution Physics,Cubie V2.1 Execution Physics,16,CTCP_CHAIN,consumed_hash_ledger,Definition,CubieTrustCompilerV2_1.v,CubieTrustCompilerV2_1.lean,ef0bb90b33a73624...,e0860fde7081255b...,16,0 axioms,VERIFIED_EXACT,YES,Coq+Lean+Verus,Whitepaper v2.5 Appendix B. Consumed-hash ledger data structure that records hashes of executed requests to prevent replay. Must be formalized in V2.1 module.
CUB-0718,CubieTrustCompilerV2_1,V2.1 Execution Physics,Cubie V2.1 Execution Physics,16,CTCP_CHAIN,one_time_execution_lease,Definition,CubieTrustCompilerV2_1.v,CubieTrustCompilerV2_1.lean,ef0bb90b33a73624...,e0860fde7081255b...,36,0 axioms,VERIFIED_EXACT,YES,Coq+Lean+Verus,Whitepaper v2.5 Appendix B. One-time execution lease: a lease token bound to a single request hash; cannot be reused after execution. Extends AdmissionLeaseV1 from V2.0.
CUB-0719,CubieTrustCompilerV2_1,V2.1 Execution Physics,Cubie V2.1 Execution Physics,16,CTCP_CHAIN,replay_rejection,Theorem,CubieTrustCompilerV2_1.v,CubieTrustCompilerV2_1.lean,ef0bb90b33a73624...,e0860fde7081255b...,45,0 axioms,VERIFIED_EXACT,YES,Coq+Lean+Verus,"Whitepaper v2.5 Appendix B. Theorem: if request_hash is in consumed_hash_ledger then Admit(r,e) = false. Formally: ∀r, consumed(hash(r)) → ¬Admit(r,e). Must be proven in V2.1 module."


cd C:/Users/NickV/cubie-verification && grep "CUB-07[12][0-9]" roadmap/master_theorem_table.csv | awk -F',' '{print $1, $6, $7, $8, $15}'

Show gap theorem IDs and statuses


CUB-0710 CUBIEQ_ADDENDUM grand_fusion_ok_b Definition VERIFIED_EXACT
CUB-0711 CUBIEQ_ADDENDUM edge_corner_ok_b Definition VERIFIED_EXACT
CUB-0712 CUBIEQ_ADDENDUM Auth_v1_10_b Definition VERIFIED_EXACT
CUB-0713 CUBIEQ_ADDENDUM Auth_v1_10_implies_grand_fusion_ok Theorem VERIFIED_EXACT
CUB-0714 CUBIEQ_ADDENDUM Auth_v1_10_implies_mode_ok Theorem VERIFIED_EXACT
CUB-0715 CUBIEQ_ADDENDUM Auth_v1_10_implies_edge_corner_ok Theorem VERIFIED_EXACT
CUB-0716 CUBIEQ_ADDENDUM Auth_v1_10_implies_evidence_ok Theorem VERIFIED_EXACT
CUB-0717 CTCP_CHAIN consumed_hash_ledger Definition VERIFIED_EXACT
CUB-0718 CTCP_CHAIN one_time_execution_lease Definition VERIFIED_EXACT
CUB-0719 CTCP_CHAIN replay_rejection Theorem VERIFIED_EXACT
CUB-0720 CTCP_CHAIN permission_attenuation Definition VERIFIED_EXACT
CUB-0721 CTCP_CHAIN subagent_containment Proposition VERIFIED_EXACT
CUB-0722 CTCP_CHAIN HeadShapeOK Definition VERIFIED_EXACT
CUB-0723 CTCP_CHAIN waste_ok_decomposition Definition VERIFIED_EXACT
CUB-0724 CTCP_CHAIN adapter_swap_ok Definition VERIFIED_EXACT
CUB-0725 CTCP_CHAIN nvlink_waiter_safe Definition VERIFIED_EXACT
CUB-0726 CTCP_CHAIN head_shape_mismatch_implies_waste_zero Proposition VERIFIED_EXACT
CUB-0727 CTCP_CHAIN symmetric_mac_fast_path_constraint Theorem VERIFIED_EXACT
CUB-0728 CTCP_CHAIN kv_cache_byte_estimator Engineering_Formula VERIFIED_EXACT
CUB-0729 CTCP_CHAIN roofline_admission_time Engineering_Formula VERIFIED_EXACT


cd C:/Users/NickV/cubie-verification && tail -5 roadmap/master_theorem_table.csv | awk -F',' '{print $1, $7, $8, $15}'

Show last entries in master table


CUB-0729 roofline_admission_time Engineering_Formula VERIFIED_EXACT
CUB-0730 l_ctx_pessimistic_bound Engineering_Formula VERIFIED_EXACT
CUB-0731 failure_probability_bound Lemma VERIFIED_EXACT
CUB-0732 cubie_site_tuple Definition VERIFIED_EXACT
CUB-0733 boundary_site_fraction Lemma VERIFIED_EXACT


Good. Now let me also check the Verus spec files to show the exec fn additions.


cd C:/Users/NickV/cubie-verification && for f in verus/*.rs; do echo "=== $(basename $f) ===" ; grep -c "exec fn\|pub fn exec" "$f" 2>/dev/null ; done

Count exec fns per Verus file


=== cubie_attention_geometry_spec.rs ===
2
=== cubie_capacity_spec.rs ===
1
=== cubie_delegation_recursion_spec.rs ===
1
=== cubie_delegation_spec.rs ===
1
=== cubie_engineering_physics_spec.rs ===
3
=== cubie_execution_lease_spec.rs ===
2
=== cubie_geometry_spec.rs ===
2
=== cubie_lease_spec.rs ===
1
=== cubie_per_predicate_spec.rs ===
1
=== cubie_runtime_spec.rs ===
1
=== cubie_site_topology_spec.rs ===
2
=== cubieq_addendum_spec.rs ===
2
=== oai_runtime_spec.rs ===
1
=== omega_bridge_spec.rs ===
2
=== omega_spec.rs ===
1
=== quantum_geometric_spec.rs ===
2
=== ramen_seam_spec.rs ===
2


0	// cubie_attention_geometry_spec.rs — Verus spec for CubieAttentionGeometry_v7
1	//
2	// Covers: HeadShapeOK (CUB-0722), waste_ok_decomposition (CUB-0723),
3	//         adapter_swap_ok (CUB-0724), nvlink_waiter_safe (CUB-0725),
4	//         head_shape_mismatch_implies_waste_zero (CUB-0726),
5	//         symmetric_mac_fast_path_constraint (CUB-0727)
6	//
7	// Design constraints:
8	//   - HeadShapeOK checks 8-field agreement across manifest, engine, runtime.
9	//   - waste_ok decomposes into 7 orthogonal boolean factors.
10	//   - nvlink_waiter_safe detects the GPU deadlock signature (zero SM + VRAM allocated).
11	//   - Asymmetric MACs (JWTs) are BANNED in delegation fast-path.
12
13	#![allow(unused_imports)]
14	use vstd::prelude::*;
15
16	verus! {
17
18	// ---------------------------------------------------------------------------
19	// Structs
20	// ---------------------------------------------------------------------------
21
22	/// Attention geometry manifest: shape parameters that must agree across sources.
23	pub struct AttentionManifest {
24	    pub manifest_layers:   u64,
25	    pub manifest_h_q:      u64,
26	    pub manifest_h_kv:     u64,
27	    pub manifest_d_head:   u64,
28	    pub manifest_tp:       u64,
29	    pub manifest_pp:       u64,

// cubie_attention_geometry_spec.rs — Verus spec for CubieAttentionGeometry_v7
//
// Covers: HeadShapeOK (CUB-0722), waste_ok_decomposition (CUB-0723),
//         adapter_swap_ok (CUB-0724), nvlink_waiter_safe (CUB-0725),
//         head_shape_mismatch_implies_waste_zero (CUB-0726),
//         symmetric_mac_fast_path_constraint (CUB-0727)
//
// Design constraints:
//   - HeadShapeOK checks 8-field agreement across manifest, engine, runtime.
//   - waste_ok decomposes into 7 orthogonal boolean factors.
//   - nvlink_waiter_safe detects the GPU deadlock signature (zero SM + VRAM allocated).
//   - Asymmetric MACs (JWTs) are BANNED in delegation fast-path.

#![allow(unused_imports)]
use vstd::prelude::*;

verus! {

// ---------------------------------------------------------------------------
// Structs
// ---------------------------------------------------------------------------

/// Attention geometry manifest: shape parameters that must agree across sources.
pub struct AttentionManifest {
    pub manifest_layers:   u64,
    pub manifest_h_q:      u64,
    pub manifest_h_kv:     u64,
    pub manifest_d_head:   u64,
    pub manifest_tp:       u64,
    pub manifest_pp:       u64,


Now let me look at the crosswalk and scanning tools to understand the full pipeline.


cd C:/Users/NickV/cubie-verification && python tools/scan_for_unsound_tokens.py 2>&1 | head -30

Run axiom scanner


PASS coq/CubieAttentionGeometry_v7.v
PASS coq/CubieBridgeV1_40.v
PASS coq/CubieDelegationRecursion_v6.v
PASS coq/CubieEngineeringPhysics_v7.v
PASS coq/CubieNonQuantum_v1_10.v
PASS coq/CubieOmegaBridgeV2_3.v
PASS coq/CubieOmegaStage2V2_3.v
PASS coq/cubieq_omega_incremental_append.v
PASS coq/cubieq_omega_incremental_next_addendum.v
PASS coq/CubieQApex.v
PASS coq/CubieQGeometric.v
PASS coq/CubieQuantumConsent.v
PASS coq/CubieQv14.v
PASS coq/CubieSiteTopology_v4.v
PASS coq/CubieTrustCompilerV1_50.v
PASS coq/CubieTrustCompilerV2_0.v
PASS coq/CubieTrustCompilerV2_0_PerPredicate.v
PASS coq/CubieTrustCompilerV2_1.v
PASS coq/OAI_cubie_trust_compiler_theorems.v
PASS coq/OmegaEight.v
PASS coq/OmegaSeven.v
PASS coq/Ramen_v1_17_1.v
PASS coq/Ramen_v1_18.v
PASS coq/Ramen_v1_19.v
PASS coq/RamenCornerConsensus_v1_19_addon.v
PASS coq/RamenCornerConsensusV1191.v
PASS coq/RamenCornerConsensusV1192.v
PASS coq/SemanticCalculus_v1_11.v
PASS coq/TheoremOmega4.v
PASS coq/TheoremOmega6.v


cd C:/Users/NickV/cubie-verification && python tools/scan_for_unsound_tokens.py 2>&1 | tail -20

Rest of scan output


PASS lean/OmegaSeven.lean
PASS lean/Ramen_v1_17_1.lean
PASS lean/Ramen_v1_18.lean
PASS lean/Ramen_v1_19.lean
PASS lean/RamenCornerConsensus_v1_19_addon.lean
PASS lean/RamenCornerConsensusV1191.lean
PASS lean/RamenCornerConsensusV1192.lean
PASS lean/RamenCornerConsensusV1193.lean
PASS lean/SemanticCalculus_v1_11.lean
PASS lean/TheoremOmega4.lean
PASS lean/TheoremOmega6.lean
PASS lean/TheoremOmega_v4_3.lean
PASS lean/TheoremOmega_v5_0.lean
PASS lean/TheoremOmega_v6_0.lean
PASS lean/ToRAdmissionCompilerV1_30.lean
PASS lean/ToRCornerSpoofingV1_31.lean

============================================================
Scanned 69 files.
PASS: all files clean (no Admitted/sorry/unexpected axioms).


cd C:/Users/NickV/cubie-verification && python tools/verify_hashes.py 2>&1 | tail -10

Run hash verification


PASS: OK   v1_10/coq/CubieQv14.v
PASS: OK   v1_10/coq/OmegaSeven.v
FAIL: MISMATCH v1_10/coq/CubieNonQuantum_v1_10.v
  expected: bf57a783ae407bf697938530b9be8ea454485a8755db9414809536a5eed9bb0e
  actual:   41b2f98d8e500dfcf514ae2473a217068463740b2caa73fcf45f966f399ad65a
FAIL: MISMATCH v1_10/lean/CubieNonQuantum_v1_10.lean
  expected: 449bf73f63c2e1545c23603f493176a1acd86d2dae74bd392ca74096cf133e25
  actual:   872ec4d0a9a43336147a2166e88ee3894df1a31ec78ec4cd2de9d1b1101f1b36

63 passed, 0 skipped, 2 failed


Now I have all the data. Let me read the current doc and enhance it significantly with the chronological flow, actual results, and missing context.


0	# Architecture and Rationale — Cubie Trust Compiler
1	### Every design decision, why it was made, and what problem it solves
2
3	---
4
5	## Table of Contents
6
7	1. [Why This Project Exists](#1-why-this-project-exists)
8	2. [The Evidence — Dataset That Drove Hardware Checks](#2-the-evidence)
9	3. [The Cube Model — Six-Face Geometry](#3-the-cube-model)
10	4. [HMAC-SHA256 Capability Verification — The Full Story](#4-hmac-sha256-capability-verification)
11	5. [NVLink Waiter Detection](#5-nvlink-waiter-detection)
12	6. [PCIe Adapter Swap Gate](#6-pcie-adapter-swap-gate)
13	7. [eFuse MMIO Key Material](#7-efuse-mmio-key-material)
14	8. [FIPS 180-4 SHA-256 (Pure Rust, No-Heap)](#8-fips-180-4-sha-256)
15	9. [The Bare-Metal no_std Crate](#9-the-bare-metal-nostd-crate)
16	10. [Mock Layer — Testing Without Hardware](#10-mock-layer)
17	11. [Cycle Counter — Silicon Performance Measurement](#11-cycle-counter)
18	12. [The Admit Gate — How All Checks Compose](#12-the-admit-gate)
19	13. [Formal Verification Stack — Why Coq + Lean 4 + Verus](#13-formal-verification-stack)
20	14. [The Ghost-vs-Exec Problem (Why We Had FUTURE_OBLIGATION Stubs)](#14-the-ghost-vs-exec-problem)
21	15. [Gap Analysis — Why 17 New Theorems Were Needed](#15-gap-analysis)
22	16. [Test Suite — What Each of the 21 Tests Proves](#16-test-suite)
23	17. [Performance Characteristics and What They Mean](#17-performance)
24	18. [Patent Alignment](#18-patent-alignment)
25	19. [Design Decisions With Alternatives Considered](#19-design-decisions)
26	20. [Component Dependency Map](#20-component-dependency-map)
27
28	---
29
30	## 1. Why This Project Exists
31
32	The **Cubie Trust Compiler** is an admission gate that runs before any AI workload is allowed to execute on hardware. The problem it solves: AI infrastructure operators have no reliable, formally-provable way to know whether a workload should be admitted to a given piece of silicon at a given moment.
33
34	Traditional admission control is software-only and policy-level (IAM roles, RBAC). It answers "is this user allowed to run jobs?" but not "is this hardware safe to run on right now?" and not "is this specific request cryptographically authentic?"
35
36	The Cubie gate answers all three questions simultaneously, in one function call, in ~730 ns, before the workload runs.
37
38	**Without this gate, the observed failure mode is:**
39	- 66.85% of fleet compute capacity is consumed by deadlocked NVLink waiters and adjacent workloads that can't proceed because the fabric is frozen
40	- 51.76% of allocated VRAM is locked by processes that are not making progress
41	- 99.5% of AI inference requests on the studied fleet waste more capacity than they produce
42	- Source: Intel GPU telemetry from `UPDATED TF Logs 2 LARGE` + `UPDATED TF Logs 3` datasets, 44.9M rows, 5 real datacenter deployments
43
44	The gate exists to make the admission decision formally correct — not just policy-correct. "Formally correct" means a machine-checked proof exists that the implementation is sound under the stated axioms.
45
46	---
47
48	## 2. The Evidence
49

# Architecture and Rationale — Cubie Trust Compiler
### Every design decision, why it was made, and what problem it solves

---

## Table of Contents

1. [Why This Project Exists](#1-why-this-project-exists)
2. [The Evidence — Dataset That Drove Hardware Checks](#2-the-evidence)
3. [The Cube Model — Six-Face Geometry](#3-the-cube-model)
4. [HMAC-SHA256 Capability Verification — The Full Story](#4-hmac-sha256-capability-verification)
5. [NVLink Waiter Detection](#5-nvlink-waiter-detection)
6. [PCIe Adapter Swap Gate](#6-pcie-adapter-swap-gate)
7. [eFuse MMIO Key Material](#7-efuse-mmio-key-material)
8. [FIPS 180-4 SHA-256 (Pure Rust, No-Heap)](#8-fips-180-4-sha-256)
9. [The Bare-Metal no_std Crate](#9-the-bare-metal-nostd-crate)
10. [Mock Layer — Testing Without Hardware](#10-mock-layer)
11. [Cycle Counter — Silicon Performance Measurement](#11-cycle-counter)
12. [The Admit Gate — How All Checks Compose](#12-the-admit-gate)
13. [Formal Verification Stack — Why Coq + Lean 4 + Verus](#13-formal-verification-stack)
14. [The Ghost-vs-Exec Problem (Why We Had FUTURE_OBLIGATION Stubs)](#14-the-ghost-vs-exec-problem)
15. [Gap Analysis — Why 17 New Theorems Were Needed](#15-gap-analysis)
16. [Test Suite — What Each of the 21 Tests Proves](#16-test-suite)
17. [Performance Characteristics and What They Mean](#17-performance)
18. [Patent Alignment](#18-patent-alignment)
19. [Design Decisions With Alternatives Considered](#19-design-decisions)
20. [Component Dependency Map](#20-component-dependency-map)

---

## 1. Why This Project Exists

The **Cubie Trust Compiler** is an admission gate that runs before any AI workload is allowed to execute on hardware. The problem it solves: AI infrastructure operators have no reliable, formally-provable way to know whether a workload should be admitted to a given piece of silicon at a given moment.

Traditional admission control is software-only and policy-level (IAM roles, RBAC). It answers "is this user allowed to run jobs?" but not "is this hardware safe to run on right now?" and not "is this specific request cryptographically authentic?"

The Cubie gate answers all three questions simultaneously, in one function call, in ~730 ns, before the workload runs.

**Without this gate, the observed failure mode is:**
- 66.85% of fleet compute capacity is consumed by deadlocked NVLink waiters and adjacent workloads that can't proceed because the fabric is frozen
- 51.76% of allocated VRAM is locked by processes that are not making progress
- 99.5% of AI inference requests on the studied fleet waste more capacity than they produce
- Source: Intel GPU telemetry from `UPDATED TF Logs 2 LARGE` + `UPDATED TF Logs 3` datasets, 44.9M rows, 5 real datacenter deployments

The gate exists to make the admission decision formally correct — not just policy-correct. "Formally correct" means a machine-checked proof exists that the implementation is sound under the stated axioms.

---

## 2. The Evidence


Now I'll rewrite the document comprehensively, adding the chronological build phases, actual test/scan results, and all the missing context about what we did after Coq/Lean/Verus.


580
581	### What Was Wrong With the Original Verus Files
582
583	The 17 original Verus spec files contained only `spec fn` declarations:
584
585	```rust
586	verus! {
587	    pub open spec fn admit(req: &CubieRequest, ...) -> bool { ... }
588	    proof fn gpu_failure_implies_denial(...) { ... }
589	}
590	```
591
592	`spec fn` in Verus is **ghost code** — it exists only during verification and is completely erased from the compiled binary. A Verus file containing only `spec fn` proves mathematical properties but **produces no compiled code**. The deployed firmware binary is unchanged.
593
594	This means: you could have 17 perfectly verified Verus files and the actual Rust code running on silicon could do anything. The proofs would be correct but irrelevant to the deployed binary.
595
596	### The Fix: exec fn with ensures
597
598	```rust
599	pub fn exec_admit(req: &CubieRequest, topology_ok: bool, policy_ok: bool) -> (result: bool)
600	    ensures result == admit(req, topology_ok, policy_ok),  // spec fn
601	{
602	    exec_gpu_corner_pass(req) && exec_deployment_corner_pass(req) && topology_ok && policy_ok
603	}
604	```
605
606	An `exec fn` **is compiled** into the binary. The `ensures` clause is a post-condition that Verus verifies: for every possible input, the function's actual return value must equal what the spec function says it should be. Verus uses Z3 to check this at compile time.
607
608	If the `exec fn` body doesn't match the spec, Verus produces a compile error. The proof is now about the deployed code, not a parallel mathematical model.
609
610	### All 17 Verus Specs Were Updated
611
612	Every spec file was updated with `exec fn` wrappers. The pattern is consistent:
613	1. `spec fn` — defines what the function should do mathematically
614	2. `proof fn` — proves properties about the `spec fn`
615	3. `exec fn` — the compiled implementation, with `ensures result == spec_fn(args)`
616
617	---
618
619	## 15. Gap Analysis
620
621	### How We Found the 17 Missing Theorems
622
623	The gap analysis compared:
624	1. **Whitepaper v2.5** `§7.2` hardware check specifications (HMAC, NVLink, PCIe)
625	2. **master_theorem_table.csv** — the existing 716 theorems
626
627	The hardware checks were specified in the whitepaper but had no corresponding formal theorems. They were marked `FUTURE_OBLIGATION` in the crosswalk. The gap analysis script (`tools/gap_analysis_to_excel.py`) surfaced these as unfilled obligations.
628
629	### The 17 New Theorems (V2.5 Gap Theorems, CUB-0717 to CUB-0733)
630
631	| ID Range | Cluster | Topic |
632	|----------|---------|-------|
633	| CUB-0717–0721 | HMAC Integrity | HMAC mismatch implies denial, HMAC truncation soundness, key slot independence |
634	| CUB-0722–0726 | NVLink Safety | Waiter signature implies denial, SM-active implies safety, VRAM-zero implies safety |
635	| CUB-0727–0731 | PCIe Gate | Cache hit implies allow, BW threshold correctness, congested implies denial, adapter ID sentinel |
636	| CUB-0732–0733 | Composition | Hardware checks compose with logical checks, admit_inner decomposition |
637
638	These 17 theorems are in `coq/Cubie*_v7.v` (5 files) and mirrored in `lean/`.
639
640	---
641
642	## 16. Test Suite
643
644	### The 21 Integration Tests (bare-metal-tests/tests/admit.rs)
645
646	The tests run on host hardware with mock MMIO. They cover every gate condition that can cause DENY:
647
648	| Test | What It Proves | Gate Condition |
649	|------|---------------|----------------|
650	| `allow_all_conditions_pass` | Happy path — all checks pass → Allow | Full gate |
651	| `deny_null_pointer` | Null ptr → Deny, no dereference | Null guard |
652	| `deny_who_false` | who_pass=false → Deny | GPU corner |
653	| `deny_what_false` | what_pass=false → Deny | GPU corner |
654	| `deny_how_false` | how_pass=false → Deny | GPU corner |
655	| `deny_where_false` | where_pass=false → Deny | Deployment corner |
656	| `deny_when_false` | when_pass=false → Deny | Deployment corner |
657	| `deny_why_false` | why_pass=false → Deny | Deployment corner |
658	| `deny_lease_invalid` | has_valid_lease=false → Deny | Lease |
659	| `deny_epoch_stale` | epoch_fresh=false → Deny | Epoch |
660	| `deny_hmac_mismatch` | capability_hmac +1 → Deny | HMAC integrity |
661	| `deny_hmac_wrong_key_slot` | key_slot=1 (key is zeros) → Deny | HMAC key selection |
662	| `deny_hmac_wrong_request_hash` | request_hash +1 → Deny | HMAC message binding |
663	| `allow_hmac_exact_match` | Recomputed HMAC for different hash → Allow | HMAC end-to-end |
664	| `deny_nvlink_waiter_sm_zero_vram_held` | SM=0 + VRAM=512 → Deny | NVLink waiter |
665	| `allow_nvlink_sm_active_vram_held` | SM=50 + VRAM=512 → Allow | NVLink: active compute |
666	| `allow_nvlink_sm_zero_no_vram` | SM=0 + VRAM=0 → Allow | NVLink: genuinely idle |
667	| `deny_pcie_congested_cache_miss` | BW=1024 MB/s → Deny | PCIe bandwidth |
668	| `allow_pcie_good_bandwidth` | BW=4096 MB/s → Allow | PCIe at threshold |
669	| `allow_pcie_cache_hit_bypasses_bw_check` | Cache hit, BW=100 → Allow | PCIe cache fast path |
670	| `deny_zero_adapter_id_sentinel` | adapter_id=0 → Deny | Sentinel guard |
671
672	### Why Cover All 9 Conditions Separately?
673
674	The `&&` short-circuit in `admit_inner` means: failing condition N prevents condition N+1 from being evaluated. If we only test `deny_who_false` but not `deny_why_false`, we can't know whether `why_pass` is actually wired into the gate — maybe it's always true and the `&&` chain never reaches it. Covering each condition independently in isolation proves the entire `&&` chain is actually hooked up.
675
676	---
677
678	## 17. Performance
679
680	### Measured Numbers (Intel Core Ultra 9 285HX @ ~3.07 GHz)
681
682	| Operation | Wall ns/call | Cycles/call | Calls/sec |
683	|-----------|-------------|-------------|-----------|
684	| Full gate (cache miss) | ~730 | ~2,242 | ~1.37M |
685	| Full gate (cache hit) | ~730 | ~2,242 | ~1.37M |
686	| HMAC-SHA256 only | ~785 | ~2,352 | ~1.27M |
687	| NVLink check only | < 1 | 1 | > 1B |
688	| PCIe cache hit | < 1 | 1 | > 1B |
689
690	**Key insight**: HMAC-SHA256 dominates. The gate time is 97%+ crypto, < 3% everything else. NVLink and PCIe checks are sub-nanosecond because they hit the L1 cache on the second call (AtomicU32 loads with Relaxed ordering — single instruction, no fence needed).
691
692	### Why the Cache-Miss Path Also Shows ~730 ns
693
694	A "cache miss" forces a PCIe BW register read (MMIO). On the mock build, MMIO is an AtomicU32 load — also < 1 ns. On real hardware, MMIO reads take 100–400 ns depending on the platform (eFuse MMIO tends to be slower; PCIe bandwidth registers tend to be faster). The mock measurement shows the floor — real silicon will be higher.
695
696	### Silicon Projections
697
698	At `N` GHz, with 2,352 cycles for HMAC:
699	- RISC-V @ 1 GHz: 2,352 cycles ÷ 1,000 MHz = **2.4 µs/call** (~416K admits/sec)
700	- ARM @ 1.8 GHz: 2,352 cycles ÷ 1,800 MHz = **1.3 µs/call** (~750K admits/sec)
701
702	Add 100–400 ns for eFuse MMIO read latency on real hardware (this is the actual silicon read, not cached).
703
704	### The RDTSC Calibration Method
705
706	The speedtest binary measures TSC frequency using:
707	1. Sleep 200ms (wall clock via `std::time::Instant`)
708	2. Measure RDTSC delta over that 200ms window
709	3. `tsc_hz = delta_cycles × 1_000_000_000 / elapsed_ns`
710
711	This gives the invariant TSC frequency (not the boost frequency — modern Intel CPUs run the TSC at a fixed rate independent of power states). On the test machine: 3.07 GHz invariant TSC vs 3.07 GHz nominal clock.
712
713	---
714
715	## 18. Patent Alignment
716
717	| Patent | Status | Theorems |
718	|--------|--------|---------|
719	| US11956363B2 | Granted | Core Cubie Trust Compiler claims — cube geometry, corner decomposition |
720	| US12073439B2 | Granted | Cubie geometry + corner model — 54-facelet space, seam strings |
721	| US20240195628A1 | Pending | V2.0-PP per-predicate corollaries — 54 oriented facelet denial theorems |
722
723	The `PatentClaim` column in `roadmap/master_theorem_table.csv` maps each of the 733 theorems to the specific patent claim it supports.
724
725	The 54 per-predicate corollaries (V2.0-PP) are particularly important for US20240195628A1: the patent claims that each of the 54 oriented facelets of the cube has an independently verifiable admission predicate. The 54 Coq theorems are the machine-checked proof of that claim.
726
727	### Why Patent Alignment Matters for a Proof Stack
728
729	Patents protect inventions. The proof stack proves the inventions work as claimed. Without the proofs, a patent challenge can argue the claims are inoperable ("the method doesn't actually work"). With machine-checked proofs, the challenge must attack the axioms or the formal model — a much higher bar.
730
731	---
732
733	## 19. Design Decisions With Alternatives Considered
734
735	### Decision: 8-byte truncated HMAC vs. full 32-byte MAC
736
737	**Chose**: 8-byte `u64` truncation in `CubieRequest.capability_hmac`
738
739	**Alternative considered**: Full 32-byte `[u8; 32]` field
740
741	**Why 8 bytes**: The `CubieRequest` struct is `repr(C)` and passed by pointer across a C ABI. Adding a 32-byte field would grow the struct from ~56 bytes to ~80 bytes. The critical path for the gate is copying this struct from the caller's stack — smaller is faster. 64-bit security against forgery is sufficient; NIST 800-107 allows truncation to 32 bits for most use cases.
742
743	**Tradeoff**: 8 bytes provides 2^64 security; 32 bytes provides 2^256. For an admission gate (not a long-term archive), 2^64 is overkill — an attacker who can make 2^64 guesses in real time can do far worse things to the hardware directly.
744
745	### Decision: FIFO Cache Eviction vs. LRU
746
747	**Chose**: Overwrite slot 0 when cache is full (FIFO)
748
749	**Alternative considered**: LRU with access timestamps
750
751	**Why FIFO**: LRU requires tracking timestamps, which requires either an atomic counter (more BSS) or a timestamp read (more cycles). On bare metal with a stable GPU pool (adapter IDs don't change), the cache reaches steady state after startup and never needs eviction. FIFO is correct and simpler. LRU would only matter if adapter IDs churned faster than 16 per steady-state window.
752
753	### Decision: Spin-loop Panic Handler vs. Reset Register
754
755	**Chose**: `loop {}` in panic handler
756
757	**Alternative considered**: Write to platform reset register (e.g., SiFive PRCI)
758
759	**Why loop**: Platform-specific reset requires knowing the platform register address at compile time. The bare-metal crate targets RISC-V, x86_64, and AArch64 — three different reset mechanisms. A loop is universally correct and gives the watchdog timer time to trigger. Shipping a platform-specific reset in the generic crate would require feature flags per platform.
760
761	### Decision: Parallel Coq + Lean 4 vs. Coq Only
762
763	**Chose**: Both Coq and Lean 4 for every theorem
764
765	**Alternative considered**: Coq only (reduce proof maintenance burden)
766
767	**Why both**: The patent application explicitly claims the proof is in both Coq and Lean 4. Two independent type checkers reduce the probability of a soundness bug. The Lean 4 files are machine-generated mirrors of the Coq files — maintenance burden is low once the Coq proof exists.
768
769	### Decision: Static `[u64; 16]` Cache vs. Heap-Allocated HashMap
770
771	**Chose**: Fixed-size BSS array
772
773	**Alternative considered**: `BTreeMap<u64, ()>` via `alloc` crate
774
775	**Why static**: No heap. The `alloc` crate requires a global allocator (`#[global_allocator]`). On bare metal with no OS, there is no allocator unless you write one. A fixed-size BSS array is zero-cost at startup, requires no allocator, and a 16-entry linear scan is O(1) in practice (16 iterations).
776
777	---
778
779	## 20. Component Dependency Map
780
781	```
782	cubie_admit (admit.rs)
783	├── CubieRequest (types.rs)          — struct definition, repr(C)
784	├── capability_hmac_verify (hmac_stub.rs)
785	│   ├── read_efuse_key (mmio.rs)     — MMIO read or mock AtomicU32
786	│   └── hmac_sha256 (hmac.rs)
787	│       └── sha256 (sha256.rs)       — FIPS 180-4 compress loop
788	├── nvlink_waiter_safe (nvlink.rs)
789	│   └── read_nvlink_sm/vram (mmio.rs)
790	└── adapter_swap_ok (pcie.rs)
791	    └── read_pcie_bw_mbs (mmio.rs)
792
793	Verus specs (verus/*.rs) — formally verify admit logic, ghost code only
794	Coq proofs (coq/*.v)     — machine-checked math, independent of Rust
795	Lean 4 proofs (lean/*.lean) — independent type theory check
796	```
797
798	### Test Stack
799
800	```
801	bare-metal-tests/tests/admit.rs    — 21 integration tests
802	bare-metal-tests/benches/admit_bench.rs — 6 Criterion benchmarks
803	bare-metal-tests/src/speedtest.rs  — RDTSC + CPUID silicon speed test
804	  └── cubie_bare_metal (features: std, mock)
805	      └── All production code + mock MMIO cells
806	```
807
808	---
809
810	## Appendix: File Inventory
811
812	| File | Size | Purpose |
813	|------|------|---------|
814	| `bare-metal/src/lib.rs` | ~40 lines | Crate root, feature gates, panic handler |
815	| `bare-metal/src/admit.rs` | ~65 lines | Top-level admit gate, C ABI entry point |
816	| `bare-metal/src/types.rs` | ~43 lines | CubieRequest, WasteFactors, AdmitResult |
817	| `bare-metal/src/sha256.rs` | ~120 lines | FIPS 180-4 SHA-256 |
818	| `bare-metal/src/hmac.rs` | ~58 lines | FIPS 198-1 HMAC-SHA256 + ct_eq_32 |
819	| `bare-metal/src/hmac_stub.rs` | ~62 lines | capability_hmac_verify — eFuse + HMAC |
820	| `bare-metal/src/mmio.rs` | ~195 lines | MMIO reads + mock cells + setters |
821	| `bare-metal/src/nvlink.rs` | ~39 lines | NVLink waiter-signature detection |
822	| `bare-metal/src/pcie.rs` | ~112 lines | PCIe adapter cache + BW gate |
823	| `bare-metal/src/cycle_counter.rs` | ~55 lines | RISC-V/x86/AArch64 cycle read |
824	| `bare-metal-tests/tests/admit.rs` | ~265 lines | 21 integration tests |
825	| `bare-metal-tests/benches/admit_bench.rs` | ~90 lines | 6 Criterion benchmarks |
826	| `bare-metal-tests/src/speedtest.rs` | ~226 lines | CPUID + RDTSC silicon speed test |
827	| `verus/cubie_runtime_spec.rs` | ~203 lines | Top-level Verus spec + exec fn |
828	| `verus/cubie_per_predicate_spec.rs` | ~varies | 54 per-predicate corollaries |
829	| `coq/` | 35 files | 733 Coq theorems |
830	| `lean/` | 34 files | 733 Lean 4 mirrors |
831	| `roadmap/master_theorem_table.csv` | 733 rows | Full theorem inventory |
832
833	---
834
835	*Document reflects the state of `cubie-verification` at tag `v1.1-bare-metal`, session date 2026-05-06.*
836

### What Was Wrong With the Original Verus Files

The 17 original Verus spec files contained only `spec fn` declarations:

```rust
verus! {
    pub open spec fn admit(req: &CubieRequest, ...) -> bool { ... }
    proof fn gpu_failure_implies_denial(...) { ... }
}
```

`spec fn` in Verus is **ghost code** — it exists only during verification and is completely erased from the compiled binary. A Verus file containing only `spec fn` proves mathematical properties but **produces no compiled code**. The deployed firmware binary is unchanged.

This means: you could have 17 perfectly verified Verus files and the actual Rust code running on silicon could do anything. The proofs would be correct but irrelevant to the deployed binary.

### The Fix: exec fn with ensures

```rust
pub fn exec_admit(req: &CubieRequest, topology_ok: bool, policy_ok: bool) -> (result: bool)
    ensures result == admit(req, topology_ok, policy_ok),  // spec fn
{
    exec_gpu_corner_pass(req) && exec_deployment_corner_pass(req) && topology_ok && policy_ok
}
```

An `exec fn` **is compiled** into the binary. The `ensures` clause is a post-condition that Verus verifies: for every possible input, the function's actual return value must equal what the spec function says it should be. Verus uses Z3 to check this at compile time.

If the `exec fn` body doesn't match the spec, Verus produces a compile error. The proof is now about the deployed code, not a parallel mathematical model.

### All 17 Verus Specs Were Updated

Every spec file was updated with `exec fn` wrappers. The pattern is consistent:
1. `spec fn` — defines what the function should do mathematically
2. `proof fn` — proves properties about the `spec fn`
3. `exec fn` — the compiled implementation, with `ensures result == spec_fn(args)`

---

## 15. Gap Analysis

### How We Found the 17 Missing Theorems

The gap analysis compared:
1. **Whitepaper v2.5** `§7.2` hardware check specifications (HMAC, NVLink, PCIe)
2. **master_theorem_table.csv** — the existing 716 theorems

The hardware checks were specified in the whitepaper but had no corresponding formal theorems. They were marked `FUTURE_OBLIGATION` in the crosswalk. The gap analysis script (`tools/gap_analysis_to_excel.py`) surfaced these as unfilled obligations.

### The 17 New Theorems (V2.5 Gap Theorems, CUB-0717 to CUB-0733)

| ID Range | Cluster | Topic |
|----------|---------|-------|
| CUB-0717–0721 | HMAC Integrity | HMAC mismatch implies denial, HMAC truncation soundness, key slot independence |
| CUB-0722–0726 | NVLink Safety | Waiter signature implies denial, SM-active implies safety, VRAM-zero implies safety |
| CUB-0727–0731 | PCIe Gate | Cache hit implies allow, BW threshold correctness, congested implies denial, adapter ID sentinel |
| CUB-0732–0733 | Composition | Hardware checks compose with logical checks, admit_inner decomposition |

These 17 theorems are in `coq/Cubie*_v7.v` (5 files) and mirrored in `lean/`.

---

## 16. Test Suite

### The 21 Integration Tests (bare-metal-tests/tests/admit.rs)

The tests run on host hardware with mock MMIO. They cover every gate condition that can cause DENY:

| Test | What It Proves | Gate Condition |
|------|---------------|----------------|
| `allow_all_conditions_pass` | Happy path — all checks pass → Allow | Full gate |
| `deny_null_pointer` | Null ptr → Deny, no dereference | Null guard |
| `deny_who_false` | who_pass=false → Deny | GPU corner |
| `deny_what_false` | what_pass=false → Deny | GPU corner |
| `deny_how_false` | how_pass=false → Deny | GPU corner |
| `deny_where_false` | where_pass=false → Deny | Deployment corner |
| `deny_when_false` | when_pass=false → Deny | Deployment corner |
| `deny_why_false` | why_pass=false → Deny | Deployment corner |
| `deny_lease_invalid` | has_valid_lease=false → Deny | Lease |
| `deny_epoch_stale` | epoch_fresh=false → Deny | Epoch |
| `deny_hmac_mismatch` | capability_hmac +1 → Deny | HMAC integrity |
| `deny_hmac_wrong_key_slot` | key_slot=1 (key is zeros) → Deny | HMAC key selection |
| `deny_hmac_wrong_request_hash` | request_hash +1 → Deny | HMAC message binding |
| `allow_hmac_exact_match` | Recomputed HMAC for different hash → Allow | HMAC end-to-end |
| `deny_nvlink_waiter_sm_zero_vram_held` | SM=0 + VRAM=512 → Deny | NVLink waiter |
| `allow_nvlink_sm_active_vram_held` | SM=50 + VRAM=512 → Allow | NVLink: active compute |
| `allow_nvlink_sm_zero_no_vram` | SM=0 + VRAM=0 → Allow | NVLink: genuinely idle |
| `deny_pcie_congested_cache_miss` | BW=1024 MB/s → Deny | PCIe bandwidth |
| `allow_pcie_good_bandwidth` | BW=4096 MB/s → Allow | PCIe at threshold |
| `allow_pcie_cache_hit_bypasses_bw_check` | Cache hit, BW=100 → Allow | PCIe cache fast path |
| `deny_zero_adapter_id_sentinel` | adapter_id=0 → Deny | Sentinel guard |

### Why Cover All 9 Conditions Separately?

The `&&` short-circuit in `admit_inner` means: failing condition N prevents condition N+1 from being evaluated. If we only test `deny_who_false` but not `deny_why_false`, we can't know whether `why_pass` is actually wired into the gate — maybe it's always true and the `&&` chain never reaches it. Covering each condition independently in isolation proves the entire `&&` chain is actually hooked up.

---

## 17. Performance

### Measured Numbers (Intel Core Ultra 9 285HX @ ~3.07 GHz)

| Operation | Wall ns/call | Cycles/call | Calls/sec |
|-----------|-------------|-------------|-----------|
| Full gate (cache miss) | ~730 | ~2,242 | ~1.37M |
| Full gate (cache hit) | ~730 | ~2,242 | ~1.37M |
| HMAC-SHA256 only | ~785 | ~2,352 | ~1.27M |
| NVLink check only | < 1 | 1 | > 1B |
| PCIe cache hit | < 1 | 1 | > 1B |

**Key insight**: HMAC-SHA256 dominates. The gate time is 97%+ crypto, < 3% everything else. NVLink and PCIe checks are sub-nanosecond because they hit the L1 cache on the second call (AtomicU32 loads with Relaxed ordering — single instruction, no fence needed).

### Why the Cache-Miss Path Also Shows ~730 ns

A "cache miss" forces a PCIe BW register read (MMIO). On the mock build, MMIO is an AtomicU32 load — also < 1 ns. On real hardware, MMIO reads take 100–400 ns depending on the platform (eFuse MMIO tends to be slower; PCIe bandwidth registers tend to be faster). The mock measurement shows the floor — real silicon will be higher.

### Silicon Projections

At `N` GHz, with 2,352 cycles for HMAC:
- RISC-V @ 1 GHz: 2,352 cycles ÷ 1,000 MHz = **2.4 µs/call** (~416K admits/sec)
- ARM @ 1.8 GHz: 2,352 cycles ÷ 1,800 MHz = **1.3 µs/call** (~750K admits/sec)

Add 100–400 ns for eFuse MMIO read latency on real hardware (this is the actual silicon read, not cached).

### The RDTSC Calibration Method

The speedtest binary measures TSC frequency using:
1. Sleep 200ms (wall clock via `std::time::Instant`)
2. Measure RDTSC delta over that 200ms window
3. `tsc_hz = delta_cycles × 1_000_000_000 / elapsed_ns`

This gives the invariant TSC frequency (not the boost frequency — modern Intel CPUs run the TSC at a fixed rate independent of power states). On the test machine: 3.07 GHz invariant TSC vs 3.07 GHz nominal clock.

---

## 18. Patent Alignment

| Patent | Status | Theorems |
|--------|--------|---------|
| US11956363B2 | Granted | Core Cubie Trust Compiler claims — cube geometry, corner decomposition |
| US12073439B2 | Granted | Cubie geometry + corner model — 54-facelet space, seam strings |
| US20240195628A1 | Pending | V2.0-PP per-predicate corollaries — 54 oriented facelet denial theorems |

The `PatentClaim` column in `roadmap/master_theorem_table.csv` maps each of the 733 theorems to the specific patent claim it supports.

The 54 per-predicate corollaries (V2.0-PP) are particularly important for US20240195628A1: the patent claims that each of the 54 oriented facelets of the cube has an independently verifiable admission predicate. The 54 Coq theorems are the machine-checked proof of that claim.

### Why Patent Alignment Matters for a Proof Stack

Patents protect inventions. The proof stack proves the inventions work as claimed. Without the proofs, a patent challenge can argue the claims are inoperable ("the method doesn't actually work"). With machine-checked proofs, the challenge must attack the axioms or the formal model — a much higher bar.

---

## 19. Design Decisions With Alternatives Considered

### Decision: 8-byte truncated HMAC vs. full 32-byte MAC

**Chose**: 8-byte `u64` truncation in `CubieRequest.capability_hmac`

**Alternative considered**: Full 32-byte `[u8; 32]` field

**Why 8 bytes**: The `CubieRequest` struct is `repr(C)` and passed by pointer across a C ABI. Adding a 32-byte field would grow the struct from ~56 bytes to ~80 bytes. The critical path for the gate is copying this struct from the caller's stack — smaller is faster. 64-bit security against forgery is sufficient; NIST 800-107 allows truncation to 32 bits for most use cases.

**Tradeoff**: 8 bytes provides 2^64 security; 32 bytes provides 2^256. For an admission gate (not a long-term archive), 2^64 is overkill — an attacker who can make 2^64 guesses in real time can do far worse things to the hardware directly.

### Decision: FIFO Cache Eviction vs. LRU

**Chose**: Overwrite slot 0 when cache is full (FIFO)

**Alternative considered**: LRU with access timestamps

**Why FIFO**: LRU requires tracking timestamps, which requires either an atomic counter (more BSS) or a timestamp read (more cycles). On bare metal with a stable GPU pool (adapter IDs don't change), the cache reaches steady state after startup and never needs eviction. FIFO is correct and simpler. LRU would only matter if adapter IDs churned faster than 16 per steady-state window.

### Decision: Spin-loop Panic Handler vs. Reset Register

**Chose**: `loop {}` in panic handler

**Alternative considered**: Write to platform reset register (e.g., SiFive PRCI)

**Why loop**: Platform-specific reset requires knowing the platform register address at compile time. The bare-metal crate targets RISC-V, x86_64, and AArch64 — three different reset mechanisms. A loop is universally correct and gives the watchdog timer time to trigger. Shipping a platform-specific reset in the generic crate would require feature flags per platform.

### Decision: Parallel Coq + Lean 4 vs. Coq Only

**Chose**: Both Coq and Lean 4 for every theorem

**Alternative considered**: Coq only (reduce proof maintenance burden)

**Why both**: The patent application explicitly claims the proof is in both Coq and Lean 4. Two independent type checkers reduce the probability of a soundness bug. The Lean 4 files are machine-generated mirrors of the Coq files — maintenance burden is low once the Coq proof exists.

### Decision: Static `[u64; 16]` Cache vs. Heap-Allocated HashMap

**Chose**: Fixed-size BSS array

**Alternative considered**: `BTreeMap<u64, ()>` via `alloc` crate

**Why static**: No heap. The `alloc` crate requires a global allocator (`#[global_allocator]`). On bare metal with no OS, there is no allocator unless you write one. A fixed-size BSS array is zero-cost at startup, requires no allocator, and a 16-entry linear scan is O(1) in practice (16 iterations).

---

## 20. Component Dependency Map

```
cubie_admit (admit.rs)
├── CubieRequest (types.rs)          — struct definition, repr(C)
├── capability_hmac_verify (hmac_stub.rs)
│   ├── read_efuse_key (mmio.rs)     — MMIO read or mock AtomicU32
│   └── hmac_sha256 (hmac.rs)
│       └── sha256 (sha256.rs)       — FIPS 180-4 compress loop
├── nvlink_waiter_safe (nvlink.rs)
│   └── read_nvlink_sm/vram (mmio.rs)
└── adapter_swap_ok (pcie.rs)
    └── read_pcie_bw_mbs (mmio.rs)

Verus specs (verus/*.rs) — formally verify admit logic, ghost code only
Coq proofs (coq/*.v)     — machine-checked math, independent of Rust
Lean 4 proofs (lean/*.lean) — independent type theory check
```

### Test Stack

```
bare-metal-tests/tests/admit.rs    — 21 integration tests
bare-metal-tests/benches/admit_bench.rs — 6 Criterion benchmarks
bare-metal-tests/src/speedtest.rs  — RDTSC + CPUID silicon speed test
  └── cubie_bare_metal (features: std, mock)
      └── All production code + mock MMIO cells
```

---

## Appendix: File Inventory

| File | Size | Purpose |
|------|------|---------|
| `bare-metal/src/lib.rs` | ~40 lines | Crate root, feature gates, panic handler |
| `bare-metal/src/admit.rs` | ~65 lines | Top-level admit gate, C ABI entry point |
| `bare-metal/src/types.rs` | ~43 lines | CubieRequest, WasteFactors, AdmitResult |
| `bare-metal/src/sha256.rs` | ~120 lines | FIPS 180-4 SHA-256 |
| `bare-metal/src/hmac.rs` | ~58 lines | FIPS 198-1 HMAC-SHA256 + ct_eq_32 |
| `bare-metal/src/hmac_stub.rs` | ~62 lines | capability_hmac_verify — eFuse + HMAC |
| `bare-metal/src/mmio.rs` | ~195 lines | MMIO reads + mock cells + setters |
| `bare-metal/src/nvlink.rs` | ~39 lines | NVLink waiter-signature detection |
| `bare-metal/src/pcie.rs` | ~112 lines | PCIe adapter cache + BW gate |
| `bare-metal/src/cycle_counter.rs` | ~55 lines | RISC-V/x86/AArch64 cycle read |
| `bare-metal-tests/tests/admit.rs` | ~265 lines | 21 integration tests |
| `bare-metal-tests/benches/admit_bench.rs` | ~90 lines | 6 Criterion benchmarks |
| `bare-metal-tests/src/speedtest.rs` | ~226 lines | CPUID + RDTSC silicon speed test |
| `verus/cubie_runtime_spec.rs` | ~203 lines | Top-level Verus spec + exec fn |
| `verus/cubie_per_predicate_spec.rs` | ~varies | 54 per-predicate corollaries |
| `coq/` | 35 files | 733 Coq theorems |
| `lean/` | 34 files | 733 Lean 4 mirrors |
| `roadmap/master_theorem_table.csv` | 733 rows | Full theorem inventory |

---

*Document reflects the state of `cubie-verification` at tag `v1.1-bare-metal`, session date 2026-05-06.*


Now I have the full picture. Let me rewrite the document with the major additions:

1. **Section 0: Chronological Build Phases** — the exact order of work and what came after what
2. **Enhanced gap analysis** with actual CUB IDs and Coq source
3. **Actual test results** (the full `cargo test` output)
4. **Actual scan results** (the soundness scanner output)
5. **Actual hash verification results**
6. **The 3 FUTURE_OBLIGATION stubs** — what they were before, what they became
7. **Verus exec fn additions per file** with counts
8. **Crosswalk status breakdown** (594 VERIFIED_EXACT, 139 DERIVED_CANDIDATE)


Edit

# Architecture and Rationale — Cubie Trust Compiler
### Every design decision, why it was made, and what problem it solves

---

## Table of Contents

1. [Why This Project Exists](#1-why-this-project-exists)
2. [The Evidence — Dataset That Drove Hardware Checks](#2-the-evidence)
3. [The Cube Model — Six-Face Geometry](#3-the-cube-model)
4. [HMAC-SHA256 Capability Verification — The Full Story](#4-hmac-sha256-capability-verification)
5. [NVLink Waiter Detection](#5-nvlink-waiter-detection)
6. [PCIe Adapter Swap Gate](#6-pcie-adapter-swap-gate)
7. [eFuse MMIO Key Material](#7-efuse-mmio-key-material)
8. [FIPS 180-4 SHA-256 (Pure Rust, No-Heap)](#8-fips-180-4-sha-256)
9. [The Bare-Metal no_std Crate](#9-the-bare-metal-nostd-crate)
10. [Mock Layer — Testing Without Hardware](#10-mock-layer)
11. [Cycle Counter — Silicon Performance Measurement](#11-cycle-counter)
12. [The Admit Gate — How All Checks Compose](#12-the-admit-gate)
13. [Formal Verification Stack — Why Coq + Lean 4 + Verus](#13-formal-verification-stack)
14. [The Ghost-vs-Exec Problem (Why We Had FUTURE_OBLIGATION Stubs)](#14-the-ghost-vs-exec-problem)
15. [Gap Analysis — Why 17 New Theorems Were Needed](#15-gap-analysis)
16. [Test Suite — What Each of the 21 Tests Proves](#16-test-suite)
17. [Performance Characteristics and What They Mean](#17-performance)
18. [Patent Alignment](#18-patent-alignment)
19. [Design Decisions With Alternatives Considered](#19-design-decisions)
20. [Component Dependency Map](#20-component-dependency-map)

# Architecture and Rationale — Cubie Trust Compiler
### Every design decision, why it was made, and what problem it solves

---

## Table of Contents

0. [Chronological Build Phases — What We Did and In What Order](#0-chronological-build-phases)
1. [Why This Project Exists](#1-why-this-project-exists)
2. [The Evidence — Dataset That Drove Hardware Checks](#2-the-evidence)
3. [The Cube Model — Six-Face Geometry](#3-the-cube-model)
4. [HMAC-SHA256 Capability Verification — The Full Story](#4-hmac-sha256-capability-verification)
5. [NVLink Waiter Detection](#5-nvlink-waiter-detection)
6. [PCIe Adapter Swap Gate](#6-pcie-adapter-swap-gate)
7. [eFuse MMIO Key Material](#7-efuse-mmio-key-material)
8. [FIPS 180-4 SHA-256 (Pure Rust, No-Heap)](#8-fips-180-4-sha-256)
9. [The Bare-Metal no_std Crate](#9-the-bare-metal-nostd-crate)
10. [Mock Layer — Testing Without Hardware](#10-mock-layer)
11. [Cycle Counter — Silicon Performance Measurement](#11-cycle-counter)
12. [The Admit Gate — How All Checks Compose](#12-the-admit-gate)
13. [Formal Verification Stack — Why Coq + Lean 4 + Verus](#13-formal-verification-stack)
14. [The Ghost-vs-Exec Problem (Why We Had FUTURE_OBLIGATION Stubs)](#14-the-ghost-vs-exec-problem)
15. [The Three FUTURE_OBLIGATION Stubs — Before and After](#15-the-three-future-obligation-stubs)
16. [Gap Analysis — Why 17 New Theorems Were Needed](#16-gap-analysis)
17. [Test Suite — What Each of the 21 Tests Proves](#17-test-suite)
18. [Actual Test Results](#18-actual-test-results)
19. [Soundness Scanner Results](#19-soundness-scanner-results)
20. [Hash Verification Results](#20-hash-verification-results)
21. [Performance Characteristics and What They Mean](#21-performance)
22. [Crosswalk Status Breakdown](#22-crosswalk-status-breakdown)
23. [Patent Alignment](#23-patent-alignment)
24. [Design Decisions With Alternatives Considered](#24-design-decisions)
25. [Component Dependency Map](#25-component-dependency-map)