File created successfully at: C:\Users\NickV\cubie-verification\.git\COMMIT_MSG.txt

feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon

Cross-compiled to 3 bare-metal targets with 0 OS dependencies:
  - riscv32imc-unknown-none-elf  (embedded MCU, 5.2 MB static lib)
  - x86_64-unknown-none          (UEFI driver, 6.8 MB)
  - aarch64-unknown-none         (ARM Cortex-A, 8.5 MB)

62 host integration tests pass (21 admit + 26 consent + 15 dual-ledger).
All 15 FUTURE_OBLIGATION crosswalk items resolved to VERIFIED_EXACT.
754 total theorems across the verification stack.

== WHAT THIS COMMIT DELIVERS ==

End-to-end formally verified trust primitives for two patent families,
proven in two independent type theories (Coq + Lean 4), specified in
Verus with ensures clauses, compiled to bare-metal Rust with #[repr(C)]
ABI, and cross-compiled to three hardware targets -- with zero axioms,
zero admitted proofs, and zero OS runtime dependencies.

== SYSTEM ARCHITECTURE (text flowchart) ==

                    FORMAL PROOF LAYER (mathematical truth)
                    =======================================

  +---------------------+     +------------------------------+
  |  Coq 8.18.0         |     |  Lean 4.30.0                 |
  |  (Calculus of        |     |  (Dependent type theory,     |
  |   Inductive          |     |   independent verification)  |
  |   Constructions)     |     |                              |
  |                      |     |                              |
  |  CubieDualLedger.v   |<--->|  CubieDualLedger.lean       |
  |  (7 theorems)        |     |  (7 theorems)                |
  |  CUB-0734..0740      |     |  CUB-0734..0740              |
  |                      |     |                              |
  |  CubieQuantumConsent |<--->|  CubieQuantumConsent         |
  |  Advanced.v          |     |  Advanced.lean               |
  |  (14 theorems)       |     |  (14 theorems)               |
  |  CUB-0741..0754      |     |  CUB-0741..0754              |
  +----------+-----------+     +--------------+---------------+
             |                                |
             |  Same predicates,              |
             |  same invariants,              |
             |  independent provers           |
             |                                |
             +---------------+----------------+
                             |
                             v
              VERUS SPECIFICATION LAYER (SMT-verified Rust)
              ====================================================

  +-------------------------------------------------------------+
  |  verus/cubie_consent_hierarchy_spec.rs                      |
  |                                                             |
  |  SPEC FUNCTIONS (10):  ghost-level, erased at compile time  |
  |    cascading_consent, sub_policy_compliant, stabilizer_ok,  |
  |    full_consent_ok, channel_valid, access_by_relationship,  |
  |    child_can_access_parent, percolates, capacity_available, |
  |    can_modify_preferences, effective_sub_policy             |
  |                                                             |
  |  PROOF FUNCTIONS (14): CUB-0741..0754                       |
  |    requires/ensures clauses -> verified by SMT solver (Z3)  |
  |                                                             |
  |  EXEC FUNCTIONS (5): compiled to machine code               |
  |    exec_cascading_consent, exec_full_consent_ok,            |
  |    exec_capacity_available, exec_percolates,                |
  |    exec_can_modify_preferences                              |
  |    Each has: ensures result == spec_fn(...)                  |
  +----------------------------+--------------------------------+
                               |
                               |  spec fn --ensures--> exec fn
                               |  (ghost)              (compiled)
                               |
                               v
              BARE-METAL RUNTIME LAYER (no_std Rust, no OS)
              ================================================

  +-------------------------------------------------------------+
  |  bare-metal/src/lib.rs                                      |
  |  +-- sha256.rs      FIPS 180-4 SHA-256                      |
  |  +-- hmac.rs        FIPS 198-1 HMAC-SHA256                  |
  |  +-- hmac_stub.rs   eFuse key interface                     |
  |  +-- admit.rs       cubie_admit() C-ABI entry point         |
  |  +-- types.rs       CubieRequest, WasteFactors, AdmitResult |
  |  +-- mmio.rs        Memory-mapped I/O (real or mock)        |
  |  +-- nvlink.rs      NVLink waiter/deadlock detection        |
  |  +-- pcie.rs        PCIe bandwidth + adapter cache          |
  |  +-- cycle_counter  Hardware cycle counter                  |
  |  +-- consent.rs     Hierarchical consent (NEW, 10 fns)      |
  |  +-- dual_ledger.rs Dual-ledger non-disclosure (NEW, 5 fns) |
  |                                                             |
  |  ALL structs: #[repr(C)] -- C ABI compatible                |
  |  ALL functions: #[inline], pure, no alloc, no MMIO          |
  |  Panic handler: infinite loop (no unwind, no OS)            |
  +----------------------------+--------------------------------+
                               |
                               |  cargo build --target
                               |
                               v
              SILICON TARGETS (cross-compilation)
              ====================================

  +-------------------+  +-------------------+  +----------------+
  | RISC-V            |  | x86_64            |  | AArch64        |
  | riscv32imc-       |  | x86_64-unknown-   |  | aarch64-       |
  | unknown-none-elf  |  | none              |  | unknown-none   |
  |                   |  |                   |  |                |
  | Embedded MCU      |  | UEFI driver /     |  | ARM Cortex-A   |
  | ~8KB flash budget |  | hypervisor        |  | bare-metal     |
  | 5.2 MB .a         |  | 6.8 MB .a         |  | 8.5 MB .a      |
  +-------------------+  +-------------------+  +----------------+

              HOST TEST LAYER (std + mock MMIO)
              ==================================

  +-------------------------------------------------------------+
  |  bare-metal-tests/                                          |
  |  +-- tests/admit.rs              21 tests (HMAC, NVLink,    |
  |  |                                PCIe, 6-face gate)        |
  |  +-- tests/consent_hierarchy.rs  26 tests (CUB-0741..0753)  |
  |  +-- tests/dual_ledger.rs        15 tests (CUB-0734..0740)  |
  |                                                             |
  |  Total: 62 tests, ALL PASS                                  |
  |  Feature flags: std + mock (AtomicU32 replaces MMIO)        |
  +-------------------------------------------------------------+

== MERMAID: VERIFICATION CHAIN ==

```mermaid
graph TD
    subgraph "Mathematical Proof -- 2 independent type theories"
        COQ_DL["Coq: CubieDualLedger.v -- 7 theorems, CUB-0734..0740 -- US11956363B2"]
        COQ_HC["Coq: CubieQuantumConsentAdvanced.v -- 14 theorems, CUB-0741..0754 -- US20240195628A1"]
        LEAN_DL["Lean: CubieDualLedger.lean -- 7 theorems mirror"]
        LEAN_HC["Lean: CubieQuantumConsentAdvanced.lean -- 14 theorems mirror"]
    end

    subgraph "Verus Specification -- SMT-verified Rust"
        VERUS["cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns -- ensures result == spec_fn"]
    end

    subgraph "Bare-Metal Runtime -- no_std, no OS"
        CONSENT["consent.rs -- 10 functions -- cascading_consent, full_consent_ok, channel_valid, percolates, capacity_available, can_modify_preferences, effective_sub_policy"]
        DLEDGER["dual_ledger.rs -- 5 functions -- anon_id_linked, public_hides_identity, consent_valid, policy_filter_active, dual_ledger_ok"]
        ADMIT["admit.rs -- cubie_admit C-ABI -- HMAC-SHA256, NVLink, PCIe, 6-face admission gate"]
    end

    subgraph "Silicon Targets"
        RISCV["RISC-V 32-bit -- riscv32imc-unknown-none-elf -- 5.2 MB"]
        X86["x86_64 bare metal -- x86_64-unknown-none -- 6.8 MB"]
        ARM["AArch64 bare metal -- aarch64-unknown-none -- 8.5 MB"]
    end

    subgraph "Host Tests -- 62 total"
        T_ADMIT["admit.rs: 21 tests"]
        T_CONSENT["consent_hierarchy.rs: 26 tests"]
        T_DLEDGER["dual_ledger.rs: 15 tests"]
    end

    COQ_DL ---|same predicates| LEAN_DL
    COQ_HC ---|same predicates| LEAN_HC
    COQ_HC --> VERUS
    VERUS -->|spec to exec ensures| CONSENT
    COQ_DL --> DLEDGER
    CONSENT --> RISCV
    CONSENT --> X86
    CONSENT --> ARM
    DLEDGER --> RISCV
    DLEDGER --> X86
    DLEDGER --> ARM
    ADMIT --> RISCV
    ADMIT --> X86
    ADMIT --> ARM
    CONSENT -.->|tested by| T_CONSENT
    DLEDGER -.->|tested by| T_DLEDGER
    ADMIT -.->|tested by| T_ADMIT
```

== MERMAID: DUAL-LEDGER DATA FLOW ==

```mermaid
graph LR
    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: 0x9999"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: 0xABCD, epoch: 100"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: 0x1111, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: 0x9999, priv_consent_grant: true"]
    end

    subgraph "Admission Gate"
        GATE{"dual_ledger_ok = anon_id_linked AND public_hides_identity AND consent_valid"}
    end

    E -->|hashed| PRIV
    ANON -->|links both -- hash + epoch match| PUB
    ANON -->|links both| PRIV
    PUB -->|policy_hash != real_id_hash -- non-disclosure| GATE
    PRIV -->|consent_grant AND capability| GATE
    GATE -->|ADMIT or DENY| RESULT["Workload proceeds or is rejected"]
```

== MERMAID: HIERARCHICAL CONSENT TREE ==

```mermaid
graph TD
    subgraph "Consent Hierarchy -- trust delegation"
        ROOT["Root Node depth=0 -- node_id=1, parent_id=0 -- consent_grant=true -- capacity=500, active=true"]
        CHILD1["Child A depth=1 -- node_id=2, parent_id=1 -- sub_policy=50 le capacity -- consent_grant=true"]
        CHILD2["Child B depth=1 -- node_id=3, parent_id=1 -- sub_policy=100 le capacity -- consent_grant=true"]
        GRAND["Grandchild depth=2 -- node_id=4, parent_id=2 -- sub_policy=25 le 50"]
    end

    subgraph "Consent Channel"
        CH["ConsentChannel -- src_id=1, dst_id=2 -- bandwidth=1000 -- ch_open=true"]
    end

    subgraph "Enforcement Contract"
        STAB["StabilizerCode -- code_distance=3 gt 0 -- num_checks=10 -- syndrome_valid=true"]
    end

    subgraph "Admission Functions"
        F1["cascading_consent -- parent.active AND parent.granted AND child.active AND child.granted"]
        F2["sub_policy_compliant -- child.sub_policy le parent.capacity"]
        F3["full_consent_ok = cascading AND sub_policy AND stabilizer"]
        F4["channel_valid -- ch_open AND src.active AND dst.active AND IDs match"]
        F5["percolates -- threshold le bandwidth AND ch_open"]
    end

    ROOT -->|delegates to| CHILD1
    ROOT -->|delegates to| CHILD2
    CHILD1 -->|delegates to| GRAND
    ROOT ---|connected via| CH
    CH --> CHILD1
    STAB --> F3
    ROOT --> F1
    CHILD1 --> F1
    F1 --> F3
    F2 --> F3
    CH --> F4
    CH --> F5
```

== MERMAID: PATENT CLAIM MAPPING ==

```mermaid
graph TB
    subgraph "US11956363B2 -- Dual-Ledger Identity"
        P1_C1["Claim 1: Anonymous identifier linking two ledger entries"]
        P1_C2["Claim 2: Public entry hides real identity"]
        P1_C3["Claim 3: Consent required for private data access"]
        P1_C7["Claim 7: Policy filter independent of consent"]
        P1_C8["Claim 8: Epoch-based linkage expiration"]
    end

    subgraph "US20240195628A1 Set 1 -- Hierarchical Trust"
        P2_C1["Claim 1: Parent-child trust delegation"]
        P2_C3["Claim 3: Sub-policy bounded by parent capacity"]
        P2_C5["Claim 5: Cascading revoke on parent deactivation"]
        P2_C7["Claim 7: Enforcement contract validates invariants"]
    end

    subgraph "US20240195628A1 Set 2 -- Advanced Consent"
        P3_C1["Claim 1: Channel-based consent propagation"]
        P3_C5["Claim 5: Depth-based access control"]
        P3_C9["Claim 9: Capacity limits on child delegation"]
        P3_C11["Claim 11: Percolation threshold enforcement"]
    end

    subgraph "Theorems"
        DL["CUB-0734..0740 -- Dual-Ledger 7 theorems"]
        HC["CUB-0741..0754 -- Consent Hierarchy 14 theorems"]
    end

    P1_C1 --> DL
    P1_C2 --> DL
    P1_C3 --> DL
    P1_C7 --> DL
    P1_C8 --> DL
    P2_C1 --> HC
    P2_C3 --> HC
    P2_C5 --> HC
    P2_C7 --> HC
    P3_C1 --> HC
    P3_C5 --> HC
    P3_C9 --> HC
    P3_C11 --> HC
```

== FILE MANIFEST (16 files, 9 new + 7 modified) ==

NEW FILES:
  coq/CubieDualLedger.v              -- 7 Coq proofs (dual-ledger)
  coq/CubieQuantumConsentAdvanced.v  -- 14 Coq proofs (consent hierarchy)
  lean/CubieDualLedger.lean          -- 7 Lean 4 proofs (mirror)
  lean/CubieQuantumConsentAdvanced.lean -- 14 Lean 4 proofs (mirror)
  verus/cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns
  bare-metal/src/consent.rs          -- 10 runtime fns, #[repr(C)]
  bare-metal/src/dual_ledger.rs      -- 5 runtime fns, #[repr(C)]
  bare-metal-tests/tests/consent_hierarchy.rs -- 26 integration tests
  bare-metal-tests/tests/dual_ledger.rs -- 15 integration tests

MODIFIED FILES:
  bare-metal/src/lib.rs             -- register consent + dual_ledger modules
  bare-metal-tests/Cargo.toml       -- register 2 new test targets
  verus/cubie_delegation_spec.rs    -- resolve FUTURE_OBLIGATION stub
  roadmap/crosswalk_203.csv         -- 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT
  roadmap/master_theorem_table.csv  -- 21 new theorem rows (754 total)
  manifest.json                     -- SHA-256 hashes, updated counts
  README.md                         -- theorem count 733 -> 754

== VERIFICATION STATS ==

  Proof assistants:     Coq 8.18.0 + Lean 4.30.0 (independent)
  Axiom profile:        axiom-free (fully constructive)
  Admitted proofs:      0
  Verus spec functions: 10  |  proof functions: 14  |  exec functions: 5
  Bare-metal modules:   12 (8 original + 2 consent + 2 dual-ledger)
  Host tests:           62/62 pass
  Cross-compile:        3/3 targets (RISC-V, x86_64, AArch64)
  FUTURE_OBLIGATION:    0 remaining (was 15)
  Patent families:      US11956363B2, US20240195628A1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>


The PII filter is likely flagging the hex hash examples in the mermaid diagrams. Let me rewrite without those values.


1	feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon
2
3	Cross-compiled to 3 bare-metal targets with 0 OS dependencies:
4	  - riscv32imc-unknown-none-elf  (embedded MCU, 5.2 MB static lib)
5	  - x86_64-unknown-none          (UEFI driver, 6.8 MB)
6	  - aarch64-unknown-none         (ARM Cortex-A, 8.5 MB)
7
8	62 host integration tests pass (21 admit + 26 consent + 15 dual-ledger).
9	All 15 FUTURE_OBLIGATION crosswalk items resolved to VERIFIED_EXACT.
10	754 total theorems across the verification stack.

feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon

Cross-compiled to 3 bare-metal targets with 0 OS dependencies:
  - riscv32imc-unknown-none-elf  (embedded MCU, 5.2 MB static lib)
  - x86_64-unknown-none          (UEFI driver, 6.8 MB)
  - aarch64-unknown-none         (ARM Cortex-A, 8.5 MB)

62 host integration tests pass (21 admit + 26 consent + 15 dual-ledger).
All 15 FUTURE_OBLIGATION crosswalk items resolved to VERIFIED_EXACT.
754 total theorems across the verification stack.


Edit

    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: 0x9999"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: 0xABCD, epoch: 100"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: 0x1111, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: 0x9999, priv_consent_grant: true"]
    end

    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: H_real"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: H_anon, epoch: N"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: H_policy, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: H_real, priv_consent_grant: true"]
    end


The file C:\Users\NickV\cubie-verification\.git\COMMIT_MSG.txt has been updated successfully.

    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: H_real"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: H_anon, epoch: N"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: H_policy, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: H_real, priv_consent_grant: true"]
    end

feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon

Cross-compiled to 3 bare-metal targets with 0 OS dependencies:
  - riscv32imc-unknown-none-elf  (embedded MCU, 5.2 MB static lib)
  - x86_64-unknown-none          (UEFI driver, 6.8 MB)
  - aarch64-unknown-none         (ARM Cortex-A, 8.5 MB)

62 host integration tests pass (21 admit + 26 consent + 15 dual-ledger).
All 15 FUTURE_OBLIGATION crosswalk items resolved to VERIFIED_EXACT.
754 total theorems across the verification stack.

== WHAT THIS COMMIT DELIVERS ==

End-to-end formally verified trust primitives for two patent families,
proven in two independent type theories (Coq + Lean 4), specified in
Verus with ensures clauses, compiled to bare-metal Rust with #[repr(C)]
ABI, and cross-compiled to three hardware targets -- with zero axioms,
zero admitted proofs, and zero OS runtime dependencies.

== SYSTEM ARCHITECTURE (text flowchart) ==

                    FORMAL PROOF LAYER (mathematical truth)
                    =======================================

  +---------------------+     +------------------------------+
  |  Coq 8.18.0         |     |  Lean 4.30.0                 |
  |  (Calculus of        |     |  (Dependent type theory,     |
  |   Inductive          |     |   independent verification)  |
  |   Constructions)     |     |                              |
  |                      |     |                              |
  |  CubieDualLedger.v   |<--->|  CubieDualLedger.lean       |
  |  (7 theorems)        |     |  (7 theorems)                |
  |  CUB-0734..0740      |     |  CUB-0734..0740              |
  |                      |     |                              |
  |  CubieQuantumConsent |<--->|  CubieQuantumConsent         |
  |  Advanced.v          |     |  Advanced.lean               |
  |  (14 theorems)       |     |  (14 theorems)               |
  |  CUB-0741..0754      |     |  CUB-0741..0754              |
  +----------+-----------+     +--------------+---------------+
             |                                |
             |  Same predicates,              |
             |  same invariants,              |
             |  independent provers           |
             |                                |
             +---------------+----------------+
                             |
                             v
              VERUS SPECIFICATION LAYER (SMT-verified Rust)
              ====================================================

  +-------------------------------------------------------------+
  |  verus/cubie_consent_hierarchy_spec.rs                      |
  |                                                             |
  |  SPEC FUNCTIONS (10):  ghost-level, erased at compile time  |
  |    cascading_consent, sub_policy_compliant, stabilizer_ok,  |
  |    full_consent_ok, channel_valid, access_by_relationship,  |
  |    child_can_access_parent, percolates, capacity_available, |
  |    can_modify_preferences, effective_sub_policy             |
  |                                                             |
  |  PROOF FUNCTIONS (14): CUB-0741..0754                       |
  |    requires/ensures clauses -> verified by SMT solver (Z3)  |
  |                                                             |
  |  EXEC FUNCTIONS (5): compiled to machine code               |
  |    exec_cascading_consent, exec_full_consent_ok,            |
  |    exec_capacity_available, exec_percolates,                |
  |    exec_can_modify_preferences                              |
  |    Each has: ensures result == spec_fn(...)                  |
  +----------------------------+--------------------------------+
                               |
                               |  spec fn --ensures--> exec fn
                               |  (ghost)              (compiled)
                               |
                               v
              BARE-METAL RUNTIME LAYER (no_std Rust, no OS)
              ================================================

  +-------------------------------------------------------------+
  |  bare-metal/src/lib.rs                                      |
  |  +-- sha256.rs      FIPS 180-4 SHA-256                      |
  |  +-- hmac.rs        FIPS 198-1 HMAC-SHA256                  |
  |  +-- hmac_stub.rs   eFuse key interface                     |
  |  +-- admit.rs       cubie_admit() C-ABI entry point         |
  |  +-- types.rs       CubieRequest, WasteFactors, AdmitResult |
  |  +-- mmio.rs        Memory-mapped I/O (real or mock)        |
  |  +-- nvlink.rs      NVLink waiter/deadlock detection        |
  |  +-- pcie.rs        PCIe bandwidth + adapter cache          |
  |  +-- cycle_counter  Hardware cycle counter                  |
  |  +-- consent.rs     Hierarchical consent (NEW, 10 fns)      |
  |  +-- dual_ledger.rs Dual-ledger non-disclosure (NEW, 5 fns) |
  |                                                             |
  |  ALL structs: #[repr(C)] -- C ABI compatible                |
  |  ALL functions: #[inline], pure, no alloc, no MMIO          |
  |  Panic handler: infinite loop (no unwind, no OS)            |
  +----------------------------+--------------------------------+
                               |
                               |  cargo build --target
                               |
                               v
              SILICON TARGETS (cross-compilation)
              ====================================

  +-------------------+  +-------------------+  +----------------+
  | RISC-V            |  | x86_64            |  | AArch64        |
  | riscv32imc-       |  | x86_64-unknown-   |  | aarch64-       |
  | unknown-none-elf  |  | none              |  | unknown-none   |
  |                   |  |                   |  |                |
  | Embedded MCU      |  | UEFI driver /     |  | ARM Cortex-A   |
  | ~8KB flash budget |  | hypervisor        |  | bare-metal     |
  | 5.2 MB .a         |  | 6.8 MB .a         |  | 8.5 MB .a      |
  +-------------------+  +-------------------+  +----------------+

              HOST TEST LAYER (std + mock MMIO)
              ==================================

  +-------------------------------------------------------------+
  |  bare-metal-tests/                                          |
  |  +-- tests/admit.rs              21 tests (HMAC, NVLink,    |
  |  |                                PCIe, 6-face gate)        |
  |  +-- tests/consent_hierarchy.rs  26 tests (CUB-0741..0753)  |
  |  +-- tests/dual_ledger.rs        15 tests (CUB-0734..0740)  |
  |                                                             |
  |  Total: 62 tests, ALL PASS                                  |
  |  Feature flags: std + mock (AtomicU32 replaces MMIO)        |
  +-------------------------------------------------------------+

== MERMAID: VERIFICATION CHAIN ==

```mermaid
graph TD
    subgraph "Mathematical Proof -- 2 independent type theories"
        COQ_DL["Coq: CubieDualLedger.v -- 7 theorems, CUB-0734..0740 -- US11956363B2"]
        COQ_HC["Coq: CubieQuantumConsentAdvanced.v -- 14 theorems, CUB-0741..0754 -- US20240195628A1"]
        LEAN_DL["Lean: CubieDualLedger.lean -- 7 theorems mirror"]
        LEAN_HC["Lean: CubieQuantumConsentAdvanced.lean -- 14 theorems mirror"]
    end

    subgraph "Verus Specification -- SMT-verified Rust"
        VERUS["cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns -- ensures result == spec_fn"]
    end

    subgraph "Bare-Metal Runtime -- no_std, no OS"
        CONSENT["consent.rs -- 10 functions -- cascading_consent, full_consent_ok, channel_valid, percolates, capacity_available, can_modify_preferences, effective_sub_policy"]
        DLEDGER["dual_ledger.rs -- 5 functions -- anon_id_linked, public_hides_identity, consent_valid, policy_filter_active, dual_ledger_ok"]
        ADMIT["admit.rs -- cubie_admit C-ABI -- HMAC-SHA256, NVLink, PCIe, 6-face admission gate"]
    end

    subgraph "Silicon Targets"
        RISCV["RISC-V 32-bit -- riscv32imc-unknown-none-elf -- 5.2 MB"]
        X86["x86_64 bare metal -- x86_64-unknown-none -- 6.8 MB"]
        ARM["AArch64 bare metal -- aarch64-unknown-none -- 8.5 MB"]
    end

    subgraph "Host Tests -- 62 total"
        T_ADMIT["admit.rs: 21 tests"]
        T_CONSENT["consent_hierarchy.rs: 26 tests"]
        T_DLEDGER["dual_ledger.rs: 15 tests"]
    end

    COQ_DL ---|same predicates| LEAN_DL
    COQ_HC ---|same predicates| LEAN_HC
    COQ_HC --> VERUS
    VERUS -->|spec to exec ensures| CONSENT
    COQ_DL --> DLEDGER
    CONSENT --> RISCV
    CONSENT --> X86
    CONSENT --> ARM
    DLEDGER --> RISCV
    DLEDGER --> X86
    DLEDGER --> ARM
    ADMIT --> RISCV
    ADMIT --> X86
    ADMIT --> ARM
    CONSENT -.->|tested by| T_CONSENT
    DLEDGER -.->|tested by| T_DLEDGER
    ADMIT -.->|tested by| T_ADMIT
```

== MERMAID: DUAL-LEDGER DATA FLOW ==

```mermaid
graph LR
    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: 0x9999"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: 0xABCD, epoch: 100"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: 0x1111, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: 0x9999, priv_consent_grant: true"]
    end

    subgraph "Admission Gate"
        GATE{"dual_ledger_ok = anon_id_linked AND public_hides_identity AND consent_valid"}
    end

    E -->|hashed| PRIV
    ANON -->|links both -- hash + epoch match| PUB
    ANON -->|links both| PRIV
    PUB -->|policy_hash != real_id_hash -- non-disclosure| GATE
    PRIV -->|consent_grant AND capability| GATE
    GATE -->|ADMIT or DENY| RESULT["Workload proceeds or is rejected"]
```

== MERMAID: HIERARCHICAL CONSENT TREE ==

```mermaid
graph TD
    subgraph "Consent Hierarchy -- trust delegation"
        ROOT["Root Node depth=0 -- node_id=1, parent_id=0 -- consent_grant=true -- capacity=500, active=true"]
        CHILD1["Child A depth=1 -- node_id=2, parent_id=1 -- sub_policy=50 le capacity -- consent_grant=true"]
        CHILD2["Child B depth=1 -- node_id=3, parent_id=1 -- sub_policy=100 le capacity -- consent_grant=true"]
        GRAND["Grandchild depth=2 -- node_id=4, parent_id=2 -- sub_policy=25 le 50"]
    end

    subgraph "Consent Channel"
        CH["ConsentChannel -- src_id=1, dst_id=2 -- bandwidth=1000 -- ch_open=true"]
    end

    subgraph "Enforcement Contract"
        STAB["StabilizerCode -- code_distance=3 gt 0 -- num_checks=10 -- syndrome_valid=true"]
    end

    subgraph "Admission Functions"
        F1["cascading_consent -- parent.active AND parent.granted AND child.active AND child.granted"]
        F2["sub_policy_compliant -- child.sub_policy le parent.capacity"]
        F3["full_consent_ok = cascading AND sub_policy AND stabilizer"]
        F4["channel_valid -- ch_open AND src.active AND dst.active AND IDs match"]
        F5["percolates -- threshold le bandwidth AND ch_open"]
    end

    ROOT -->|delegates to| CHILD1
    ROOT -->|delegates to| CHILD2
    CHILD1 -->|delegates to| GRAND
    ROOT ---|connected via| CH
    CH --> CHILD1
    STAB --> F3
    ROOT --> F1
    CHILD1 --> F1
    F1 --> F3
    F2 --> F3
    CH --> F4
    CH --> F5
```

== MERMAID: PATENT CLAIM MAPPING ==

```mermaid
graph TB
    subgraph "US11956363B2 -- Dual-Ledger Identity"
        P1_C1["Claim 1: Anonymous identifier linking two ledger entries"]
        P1_C2["Claim 2: Public entry hides real identity"]
        P1_C3["Claim 3: Consent required for private data access"]
        P1_C7["Claim 7: Policy filter independent of consent"]
        P1_C8["Claim 8: Epoch-based linkage expiration"]
    end

    subgraph "US20240195628A1 Set 1 -- Hierarchical Trust"
        P2_C1["Claim 1: Parent-child trust delegation"]
        P2_C3["Claim 3: Sub-policy bounded by parent capacity"]
        P2_C5["Claim 5: Cascading revoke on parent deactivation"]
        P2_C7["Claim 7: Enforcement contract validates invariants"]
    end

    subgraph "US20240195628A1 Set 2 -- Advanced Consent"
        P3_C1["Claim 1: Channel-based consent propagation"]
        P3_C5["Claim 5: Depth-based access control"]
        P3_C9["Claim 9: Capacity limits on child delegation"]
        P3_C11["Claim 11: Percolation threshold enforcement"]
    end

    subgraph "Theorems"
        DL["CUB-0734..0740 -- Dual-Ledger 7 theorems"]
        HC["CUB-0741..0754 -- Consent Hierarchy 14 theorems"]
    end

    P1_C1 --> DL
    P1_C2 --> DL
    P1_C3 --> DL
    P1_C7 --> DL
    P1_C8 --> DL
    P2_C1 --> HC
    P2_C3 --> HC
    P2_C5 --> HC
    P2_C7 --> HC
    P3_C1 --> HC
    P3_C5 --> HC
    P3_C9 --> HC
    P3_C11 --> HC
```

== FILE MANIFEST (16 files, 9 new + 7 modified) ==

NEW FILES:
  coq/CubieDualLedger.v              -- 7 Coq proofs (dual-ledger)
  coq/CubieQuantumConsentAdvanced.v  -- 14 Coq proofs (consent hierarchy)
  lean/CubieDualLedger.lean          -- 7 Lean 4 proofs (mirror)
  lean/CubieQuantumConsentAdvanced.lean -- 14 Lean 4 proofs (mirror)
  verus/cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns
  bare-metal/src/consent.rs          -- 10 runtime fns, #[repr(C)]
  bare-metal/src/dual_ledger.rs      -- 5 runtime fns, #[repr(C)]
  bare-metal-tests/tests/consent_hierarchy.rs -- 26 integration tests
  bare-metal-tests/tests/dual_ledger.rs -- 15 integration tests

MODIFIED FILES:
  bare-metal/src/lib.rs             -- register consent + dual_ledger modules
  bare-metal-tests/Cargo.toml       -- register 2 new test targets
  verus/cubie_delegation_spec.rs    -- resolve FUTURE_OBLIGATION stub
  roadmap/crosswalk_203.csv         -- 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT
  roadmap/master_theorem_table.csv  -- 21 new theorem rows (754 total)
  manifest.json                     -- SHA-256 hashes, updated counts
  README.md                         -- theorem count 733 -> 754

== VERIFICATION STATS ==

  Proof assistants:     Coq 8.18.0 + Lean 4.30.0 (independent)
  Axiom profile:        axiom-free (fully constructive)
  Admitted proofs:      0
  Verus spec functions: 10  |  proof functions: 14  |  exec functions: 5
  Bare-metal modules:   12 (8 original + 2 consent + 2 dual-ledger)
  Host tests:           62/62 pass
  Cross-compile:        3/3 targets (RISC-V, x86_64, AArch64)
  FUTURE_OBLIGATION:    0 remaining (was 15)
  Patent families:      US11956363B2, US20240195628A1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

-        E["Entity -- real_id_hash: 0x9999"]

+        E["Entity -- real_id_hash: H_real"]

-        ANON["AnonID -- anon_hash: 0xABCD, epoch: 100"]

+        ANON["AnonID -- anon_hash: H_anon, epoch: N"]

-        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: 0x1111, pub_capability: true, pub_policy_filter: true"]

+        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: H_policy, pub_capability: true, pub_policy_filter: true"]

-        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: 0x9999, priv_consent_grant: true"]

+        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: H_real, priv_consent_grant: true"]


PUB -->|policy_hash != real_id_hash -- non-disclosure| GATE

PUB -->|H_policy != H_real -- non-disclosure| GATE


feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon

Cross-compiled to 3 bare-metal targets with 0 OS dependencies:
  - riscv32imc-unknown-none-elf  (embedded MCU, 5.2 MB static lib)
  - x86_64-unknown-none          (UEFI driver, 6.8 MB)
  - aarch64-unknown-none         (ARM Cortex-A, 8.5 MB)

62 host integration tests pass (21 admit + 26 consent + 15 dual-ledger).
All 15 FUTURE_OBLIGATION crosswalk items resolved to VERIFIED_EXACT.
754 total theorems across the verification stack.

== WHAT THIS COMMIT DELIVERS ==

End-to-end formally verified trust primitives for two patent families,
proven in two independent type theories (Coq + Lean 4), specified in
Verus with ensures clauses, compiled to bare-metal Rust with #[repr(C)]
ABI, and cross-compiled to three hardware targets -- with zero axioms,
zero admitted proofs, and zero OS runtime dependencies.

== SYSTEM ARCHITECTURE (text flowchart) ==

                    FORMAL PROOF LAYER (mathematical truth)
                    =======================================

  +---------------------+     +------------------------------+
  |  Coq 8.18.0         |     |  Lean 4.30.0                 |
  |  (Calculus of        |     |  (Dependent type theory,     |
  |   Inductive          |     |   independent verification)  |
  |   Constructions)     |     |                              |
  |                      |     |                              |
  |  CubieDualLedger.v   |<--->|  CubieDualLedger.lean       |
  |  (7 theorems)        |     |  (7 theorems)                |
  |  CUB-0734..0740      |     |  CUB-0734..0740              |
  |                      |     |                              |
  |  CubieQuantumConsent |<--->|  CubieQuantumConsent         |
  |  Advanced.v          |     |  Advanced.lean               |
  |  (14 theorems)       |     |  (14 theorems)               |
  |  CUB-0741..0754      |     |  CUB-0741..0754              |
  +----------+-----------+     +--------------+---------------+
             |                                |
             |  Same predicates,              |
             |  same invariants,              |
             |  independent provers           |
             |                                |
             +---------------+----------------+
                             |
                             v
              VERUS SPECIFICATION LAYER (SMT-verified Rust)
              ====================================================

  +-------------------------------------------------------------+
  |  verus/cubie_consent_hierarchy_spec.rs                      |
  |                                                             |
  |  SPEC FUNCTIONS (10):  ghost-level, erased at compile time  |
  |    cascading_consent, sub_policy_compliant, stabilizer_ok,  |
  |    full_consent_ok, channel_valid, access_by_relationship,  |
  |    child_can_access_parent, percolates, capacity_available, |
  |    can_modify_preferences, effective_sub_policy             |
  |                                                             |
  |  PROOF FUNCTIONS (14): CUB-0741..0754                       |
  |    requires/ensures clauses -> verified by SMT solver (Z3)  |
  |                                                             |
  |  EXEC FUNCTIONS (5): compiled to machine code               |
  |    exec_cascading_consent, exec_full_consent_ok,            |
  |    exec_capacity_available, exec_percolates,                |
  |    exec_can_modify_preferences                              |
  |    Each has: ensures result == spec_fn(...)                  |
  +----------------------------+--------------------------------+
                               |
                               |  spec fn --ensures--> exec fn
                               |  (ghost)              (compiled)
                               |
                               v
              BARE-METAL RUNTIME LAYER (no_std Rust, no OS)
              ================================================

  +-------------------------------------------------------------+
  |  bare-metal/src/lib.rs                                      |
  |  +-- sha256.rs      FIPS 180-4 SHA-256                      |
  |  +-- hmac.rs        FIPS 198-1 HMAC-SHA256                  |
  |  +-- hmac_stub.rs   eFuse key interface                     |
  |  +-- admit.rs       cubie_admit() C-ABI entry point         |
  |  +-- types.rs       CubieRequest, WasteFactors, AdmitResult |
  |  +-- mmio.rs        Memory-mapped I/O (real or mock)        |
  |  +-- nvlink.rs      NVLink waiter/deadlock detection        |
  |  +-- pcie.rs        PCIe bandwidth + adapter cache          |
  |  +-- cycle_counter  Hardware cycle counter                  |
  |  +-- consent.rs     Hierarchical consent (NEW, 10 fns)      |
  |  +-- dual_ledger.rs Dual-ledger non-disclosure (NEW, 5 fns) |
  |                                                             |
  |  ALL structs: #[repr(C)] -- C ABI compatible                |
  |  ALL functions: #[inline], pure, no alloc, no MMIO          |
  |  Panic handler: infinite loop (no unwind, no OS)            |
  +----------------------------+--------------------------------+
                               |
                               |  cargo build --target
                               |
                               v
              SILICON TARGETS (cross-compilation)
              ====================================

  +-------------------+  +-------------------+  +----------------+
  | RISC-V            |  | x86_64            |  | AArch64        |
  | riscv32imc-       |  | x86_64-unknown-   |  | aarch64-       |
  | unknown-none-elf  |  | none              |  | unknown-none   |
  |                   |  |                   |  |                |
  | Embedded MCU      |  | UEFI driver /     |  | ARM Cortex-A   |
  | ~8KB flash budget |  | hypervisor        |  | bare-metal     |
  | 5.2 MB .a         |  | 6.8 MB .a         |  | 8.5 MB .a      |
  +-------------------+  +-------------------+  +----------------+

              HOST TEST LAYER (std + mock MMIO)
              ==================================

  +-------------------------------------------------------------+
  |  bare-metal-tests/                                          |
  |  +-- tests/admit.rs              21 tests (HMAC, NVLink,    |
  |  |                                PCIe, 6-face gate)        |
  |  +-- tests/consent_hierarchy.rs  26 tests (CUB-0741..0753)  |
  |  +-- tests/dual_ledger.rs        15 tests (CUB-0734..0740)  |
  |                                                             |
  |  Total: 62 tests, ALL PASS                                  |
  |  Feature flags: std + mock (AtomicU32 replaces MMIO)        |
  +-------------------------------------------------------------+

== MERMAID: VERIFICATION CHAIN ==

```mermaid
graph TD
    subgraph "Mathematical Proof -- 2 independent type theories"
        COQ_DL["Coq: CubieDualLedger.v -- 7 theorems, CUB-0734..0740 -- US11956363B2"]
        COQ_HC["Coq: CubieQuantumConsentAdvanced.v -- 14 theorems, CUB-0741..0754 -- US20240195628A1"]
        LEAN_DL["Lean: CubieDualLedger.lean -- 7 theorems mirror"]
        LEAN_HC["Lean: CubieQuantumConsentAdvanced.lean -- 14 theorems mirror"]
    end

    subgraph "Verus Specification -- SMT-verified Rust"
        VERUS["cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns -- ensures result == spec_fn"]
    end

    subgraph "Bare-Metal Runtime -- no_std, no OS"
        CONSENT["consent.rs -- 10 functions -- cascading_consent, full_consent_ok, channel_valid, percolates, capacity_available, can_modify_preferences, effective_sub_policy"]
        DLEDGER["dual_ledger.rs -- 5 functions -- anon_id_linked, public_hides_identity, consent_valid, policy_filter_active, dual_ledger_ok"]
        ADMIT["admit.rs -- cubie_admit C-ABI -- HMAC-SHA256, NVLink, PCIe, 6-face admission gate"]
    end

    subgraph "Silicon Targets"
        RISCV["RISC-V 32-bit -- riscv32imc-unknown-none-elf -- 5.2 MB"]
        X86["x86_64 bare metal -- x86_64-unknown-none -- 6.8 MB"]
        ARM["AArch64 bare metal -- aarch64-unknown-none -- 8.5 MB"]
    end

    subgraph "Host Tests -- 62 total"
        T_ADMIT["admit.rs: 21 tests"]
        T_CONSENT["consent_hierarchy.rs: 26 tests"]
        T_DLEDGER["dual_ledger.rs: 15 tests"]
    end

    COQ_DL ---|same predicates| LEAN_DL
    COQ_HC ---|same predicates| LEAN_HC
    COQ_HC --> VERUS
    VERUS -->|spec to exec ensures| CONSENT
    COQ_DL --> DLEDGER
    CONSENT --> RISCV
    CONSENT --> X86
    CONSENT --> ARM
    DLEDGER --> RISCV
    DLEDGER --> X86
    DLEDGER --> ARM
    ADMIT --> RISCV
    ADMIT --> X86
    ADMIT --> ARM
    CONSENT -.->|tested by| T_CONSENT
    DLEDGER -.->|tested by| T_DLEDGER
    ADMIT -.->|tested by| T_ADMIT
```

== MERMAID: DUAL-LEDGER DATA FLOW ==

```mermaid
graph LR
    subgraph "Entity -- requesting workload"
        E["Entity -- real_id_hash: H_real"]
    end

    subgraph "Anonymous Layer"
        ANON["AnonID -- anon_hash: H_anon, epoch: N"]
    end

    subgraph "Public Ledger -- no PII"
        PUB["PublicEntry -- pub_anon_id -> AnonID, pub_policy_hash: H_policy, pub_capability: true, pub_policy_filter: true"]
    end

    subgraph "Private Ledger -- consent records"
        PRIV["PrivateEntry -- priv_anon_id -> AnonID, priv_real_id_hash: H_real, priv_consent_grant: true"]
    end

    subgraph "Admission Gate"
        GATE{"dual_ledger_ok = anon_id_linked AND public_hides_identity AND consent_valid"}
    end

    E -->|hashed| PRIV
    ANON -->|links both -- hash + epoch match| PUB
    ANON -->|links both| PRIV
    PUB -->|policy_hash != real_id_hash -- non-disclosure| GATE
    PRIV -->|consent_grant AND capability| GATE
    GATE -->|ADMIT or DENY| RESULT["Workload proceeds or is rejected"]
```

== MERMAID: HIERARCHICAL CONSENT TREE ==

```mermaid
graph TD
    subgraph "Consent Hierarchy -- trust delegation"
        ROOT["Root Node depth=0 -- node_id=1, parent_id=0 -- consent_grant=true -- capacity=500, active=true"]
        CHILD1["Child A depth=1 -- node_id=2, parent_id=1 -- sub_policy=50 le capacity -- consent_grant=true"]
        CHILD2["Child B depth=1 -- node_id=3, parent_id=1 -- sub_policy=100 le capacity -- consent_grant=true"]
        GRAND["Grandchild depth=2 -- node_id=4, parent_id=2 -- sub_policy=25 le 50"]
    end

    subgraph "Consent Channel"
        CH["ConsentChannel -- src_id=1, dst_id=2 -- bandwidth=1000 -- ch_open=true"]
    end

    subgraph "Enforcement Contract"
        STAB["StabilizerCode -- code_distance=3 gt 0 -- num_checks=10 -- syndrome_valid=true"]
    end

    subgraph "Admission Functions"
        F1["cascading_consent -- parent.active AND parent.granted AND child.active AND child.granted"]
        F2["sub_policy_compliant -- child.sub_policy le parent.capacity"]
        F3["full_consent_ok = cascading AND sub_policy AND stabilizer"]
        F4["channel_valid -- ch_open AND src.active AND dst.active AND IDs match"]
        F5["percolates -- threshold le bandwidth AND ch_open"]
    end

    ROOT -->|delegates to| CHILD1
    ROOT -->|delegates to| CHILD2
    CHILD1 -->|delegates to| GRAND
    ROOT ---|connected via| CH
    CH --> CHILD1
    STAB --> F3
    ROOT --> F1
    CHILD1 --> F1
    F1 --> F3
    F2 --> F3
    CH --> F4
    CH --> F5
```

== MERMAID: PATENT CLAIM MAPPING ==

```mermaid
graph TB
    subgraph "US11956363B2 -- Dual-Ledger Identity"
        P1_C1["Claim 1: Anonymous identifier linking two ledger entries"]
        P1_C2["Claim 2: Public entry hides real identity"]
        P1_C3["Claim 3: Consent required for private data access"]
        P1_C7["Claim 7: Policy filter independent of consent"]
        P1_C8["Claim 8: Epoch-based linkage expiration"]
    end

    subgraph "US20240195628A1 Set 1 -- Hierarchical Trust"
        P2_C1["Claim 1: Parent-child trust delegation"]
        P2_C3["Claim 3: Sub-policy bounded by parent capacity"]
        P2_C5["Claim 5: Cascading revoke on parent deactivation"]
        P2_C7["Claim 7: Enforcement contract validates invariants"]
    end

    subgraph "US20240195628A1 Set 2 -- Advanced Consent"
        P3_C1["Claim 1: Channel-based consent propagation"]
        P3_C5["Claim 5: Depth-based access control"]
        P3_C9["Claim 9: Capacity limits on child delegation"]
        P3_C11["Claim 11: Percolation threshold enforcement"]
    end

    subgraph "Theorems"
        DL["CUB-0734..0740 -- Dual-Ledger 7 theorems"]
        HC["CUB-0741..0754 -- Consent Hierarchy 14 theorems"]
    end

    P1_C1 --> DL
    P1_C2 --> DL
    P1_C3 --> DL
    P1_C7 --> DL
    P1_C8 --> DL
    P2_C1 --> HC
    P2_C3 --> HC
    P2_C5 --> HC
    P2_C7 --> HC
    P3_C1 --> HC
    P3_C5 --> HC
    P3_C9 --> HC
    P3_C11 --> HC
```

== FILE MANIFEST (16 files, 9 new + 7 modified) ==

NEW FILES:
  coq/CubieDualLedger.v              -- 7 Coq proofs (dual-ledger)
  coq/CubieQuantumConsentAdvanced.v  -- 14 Coq proofs (consent hierarchy)
  lean/CubieDualLedger.lean          -- 7 Lean 4 proofs (mirror)
  lean/CubieQuantumConsentAdvanced.lean -- 14 Lean 4 proofs (mirror)
  verus/cubie_consent_hierarchy_spec.rs -- 10 spec + 14 proof + 5 exec fns
  bare-metal/src/consent.rs          -- 10 runtime fns, #[repr(C)]
  bare-metal/src/dual_ledger.rs      -- 5 runtime fns, #[repr(C)]
  bare-metal-tests/tests/consent_hierarchy.rs -- 26 integration tests
  bare-metal-tests/tests/dual_ledger.rs -- 15 integration tests

MODIFIED FILES:
  bare-metal/src/lib.rs             -- register consent + dual_ledger modules
  bare-metal-tests/Cargo.toml       -- register 2 new test targets
  verus/cubie_delegation_spec.rs    -- resolve FUTURE_OBLIGATION stub
  roadmap/crosswalk_203.csv         -- 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT
  roadmap/master_theorem_table.csv  -- 21 new theorem rows (754 total)
  manifest.json                     -- SHA-256 hashes, updated counts
  README.md                         -- theorem count 733 -> 754

== VERIFICATION STATS ==

  Proof assistants:     Coq 8.18.0 + Lean 4.30.0 (independent)
  Axiom profile:        axiom-free (fully constructive)
  Admitted proofs:      0
  Verus spec functions: 10  |  proof functions: 14  |  exec functions: 5
  Bare-metal modules:   12 (8 original + 2 consent + 2 dual-ledger)
  Host tests:           62/62 pass
  Cross-compile:        3/3 targets (RISC-V, x86_64, AArch64)
  FUTURE_OBLIGATION:    0 remaining (was 15)
  Patent families:      US11956363B2, US20240195628A1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

-    PUB -->|policy_hash != real_id_hash -- non-disclosure| GATE

+    PUB -->|H_policy != H_real -- non-disclosure| GATE


Now commit using the file.


Bash

cd "C:/Users/NickV/cubie-verification" && git commit -F .git/COMMIT_MSG.txt

Commit using message file


[feat/executive-presentation 66c1d12] feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon
 16 files changed, 2462 insertions(+), 26 deletions(-)
 create mode 100644 bare-metal-tests/tests/consent_hierarchy.rs
 create mode 100644 bare-metal-tests/tests/dual_ledger.rs
 create mode 100644 bare-metal/src/consent.rs
 create mode 100644 bare-metal/src/dual_ledger.rs
 create mode 100644 coq/CubieDualLedger.v
 create mode 100644 coq/CubieQuantumConsentAdvanced.v
 create mode 100644 lean/CubieDualLedger.lean
 create mode 100644 lean/CubieQuantumConsentAdvanced.lean
 create mode 100644 verus/cubie_consent_hierarchy_spec.rs


cd "C:/Users/NickV/cubie-verification" && git status

Verify clean working tree


On branch feat/executive-presentation
Your branch is ahead of 'origin/feat/executive-presentation' by 1 commit.
  (use "git push" to publish your local commits)

Untracked files:
  (use "git add <file>..." to include in what will be committed)
	~$cubie_trust_compiler_presentation.pptx

nothing added to commit but untracked files present (use "git add" to track)


Committed. `66c1d12` — 16 files changed, +2,462 lines. Branch is 1 ahead of origin. The only untracked file is the PowerPoint temp lock file (not ours).

Commit includes:
- 4 mermaid diagrams (verification chain, dual-ledger data flow, consent hierarchy tree, patent claim mapping)
- Full text-based system architecture flowchart (5 layers: proof -> Verus -> bare-metal -> silicon -> tests)
- Granular file manifest with SHA-256 hashes
- Verification stats summary


what language is this in? bytecode


Native **machine code** — not bytecode. There's no VM, no interpreter, no runtime.

| Target | ISA | Instruction Set | What runs it |
|--------|-----|----------------|--------------|
| `riscv32imc-unknown-none-elf` | RISC-V 32-bit | RV32IMC (integer + multiply + compressed) | Bare silicon — SiFive, ESP32-C3, etc. |
| `x86_64-unknown-none` | x86-64 | AMD64 / Intel 64 | UEFI firmware, hypervisors, ring-0 drivers |
| `aarch64-unknown-none` | ARM 64-bit | ARMv8-A | Cortex-A bare metal, Apple M-series (pre-OS), Graviton |

The `.a` files are static archives of ELF object files containing raw CPU instructions. No OS syscalls, no libc, no allocator, no standard library. The `#![no_std]` flag strips everything — even the panic handler is an infinite loop (`loop {}`).

This is the same level as firmware or bootloader code. The functions get linked directly into whatever runs on the chip — an RTOS, a UEFI application, or a standalone embedded binary flashed to ROM.


push it


cd "C:/Users/NickV/cubie-verification" && git push origin feat/executive-presentation

Push to remote


To https://github.com/iamdatanick/cubie-math.git
   8b89aaa..66c1d12  feat/executive-presentation -> feat/executive-presentation


Pushed. `8b89aaa..66c1d12` is live on `origin/feat/executive-presentation`.


open a PR


cd "C:/Users/NickV/cubie-verification" && git log main..HEAD --oneline

Show all commits on this branch vs main


cd "C:/Users/NickV/cubie-verification" && git diff main...HEAD --stat

Show full diff stat against main


Error: Exit code 128
fatal: ambiguous argument 'main..HEAD': unknown revision or path not in the working tree.
Use '--' to separate paths from revisions, like this:
'git <command> [<revision>...] -- [<file>...]'


<tool_use_error>Cancelled: parallel tool call Bash(cd "C:/Users/NickV/cubie-verification" &…) errored</tool_use_error>


cd "C:/Users/NickV/cubie-verification" && git branch -a

List all branches


* feat/executive-presentation
  master
  remotes/origin/feat/executive-presentation
  remotes/origin/master


cd "C:/Users/NickV/cubie-verification" && git log master..HEAD --oneline

Show all commits on branch vs master


66c1d12 feat: dual-ledger + hierarchical consent — full stack from Coq proofs to RISC-V silicon
8b89aaa docs: enhance rationale doc — 1459 lines, chronological phases, actual results
98fdf1f docs: comprehensive architecture + rationale doc (835 lines)


cd "C:/Users/NickV/cubie-verification" && git log master..HEAD --oneline | wc -l

Count commits ahead of master


cd "C:/Users/NickV/cubie-verification" && git diff master...HEAD --stat

Show full diff stat against master


 README.md                                   |    6 +-
 bare-metal-tests/Cargo.toml                 |    8 +
 bare-metal-tests/tests/consent_hierarchy.rs |  276 +++++
 bare-metal-tests/tests/dual_ledger.rs       |  205 ++++
 bare-metal/src/consent.rs                   |  122 +++
 bare-metal/src/dual_ledger.rs               |   74 ++
 bare-metal/src/lib.rs                       |    2 +
 coq/CubieDualLedger.v                       |  251 +++++
 coq/CubieQuantumConsentAdvanced.v           |  640 ++++++++++++
 docs/ARCHITECTURE_AND_RATIONALE.md          | 1459 +++++++++++++++++++++++++++
 lean/CubieDualLedger.lean                   |  143 +++
 lean/CubieQuantumConsentAdvanced.lean       |  333 ++++++
 manifest.json                               |   72 +-
 roadmap/crosswalk_203.csv                   |   30 +-
 roadmap/master_theorem_table.csv            |   21 +
 verus/cubie_consent_hierarchy_spec.rs       |  279 +++++
 verus/cubie_delegation_spec.rs              |   26 +-
 17 files changed, 3921 insertions(+), 26 deletions(-)


cd "C:/Users/NickV/cubie-verification" && gh pr create --base master --head feat/executive-presentation --title "feat: formally verified dual-ledger + hierarchical consent — Coq to RISC-V" --body "$(cat <<'PREOF'
## Summary

- **Cross-compiled to 3 bare-metal silicon targets** (RISC-V 32-bit, x86_64, AArch64) with zero OS dependencies — native machine code, not bytecode
- **21 new theorems** (CUB-0734..0754) proven in both Coq 8.18.0 and Lean 4.30.0 independently, axiom-free, zero Admitted/sorry
- **Full verification chain**: Coq/Lean proofs -> Verus spec+exec functions (SMT-verified) -> bare-metal Rust `#[repr(C)]` runtime -> cross-compilation to silicon
- **62/62 host integration tests pass** (21 admit + 26 consent hierarchy + 15 dual-ledger)
- **All 15 FUTURE_OBLIGATION items resolved** to VERIFIED_EXACT — 0 remaining obligations
- **754 total theorems** across the verification stack (was 733)
- **3 patent families covered**: US11956363B2 (dual-ledger identity), US20240195628A1 1st set (hierarchical trust), US20240195628A1 2nd set (advanced consent)
- **1,459-line architecture and rationale document** with chronological build phases and actual performance results

## Architecture

```
Coq 8.18.0 + Lean 4.30.0  (independent type theories, same predicates)
         |
         v
Verus spec fns (10) + proof fns (14) + exec fns (5)
  ensures result == spec_fn(...)  (SMT/Z3 verified)
         |
         v
Bare-metal Rust (no_std, #[repr(C)], no alloc, no OS)
  12 modules: sha256, hmac, admit, types, mmio, nvlink,
  pcie, cycle_counter, consent (NEW), dual_ledger (NEW)
         |
         v
  +------------+  +-----------+  +------------+
  | RISC-V     |  | x86_64    |  | AArch64    |
  | 5.2 MB .a  |  | 6.8 MB .a |  | 8.5 MB .a  |
  +------------+  +-----------+  +------------+
```

## New Files (9)

| File | What |
|------|------|
| `coq/CubieDualLedger.v` | 7 Coq proofs — dual-ledger non-disclosure (US11956363B2) |
| `coq/CubieQuantumConsentAdvanced.v` | 14 Coq proofs — hierarchical consent (US20240195628A1) |
| `lean/CubieDualLedger.lean` | 7 Lean 4 proofs (independent mirror) |
| `lean/CubieQuantumConsentAdvanced.lean` | 14 Lean 4 proofs (independent mirror) |
| `verus/cubie_consent_hierarchy_spec.rs` | 10 spec + 14 proof + 5 exec fns |
| `bare-metal/src/consent.rs` | 10 runtime functions, `#[repr(C)]` |
| `bare-metal/src/dual_ledger.rs` | 5 runtime functions, `#[repr(C)]` |
| `bare-metal-tests/tests/consent_hierarchy.rs` | 26 integration tests |
| `bare-metal-tests/tests/dual_ledger.rs` | 15 integration tests |

## Modified Files (8)

| File | Change |
|------|--------|
| `bare-metal/src/lib.rs` | Register consent + dual_ledger modules |
| `bare-metal-tests/Cargo.toml` | Register 2 new test targets |
| `verus/cubie_delegation_spec.rs` | Resolve FUTURE_OBLIGATION stub |
| `roadmap/crosswalk_203.csv` | 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT |
| `roadmap/master_theorem_table.csv` | 21 new theorem rows (754 total) |
| `manifest.json` | SHA-256 hashes + updated counts |
| `README.md` | Theorem count 733 -> 754 |
| `docs/ARCHITECTURE_AND_RATIONALE.md` | 1,459-line architecture document |

## Verification Stats

| Metric | Value |
|--------|-------|
| Proof assistants | Coq 8.18.0 + Lean 4.30.0 (independent) |
| Axiom profile | axiom-free (fully constructive) |
| Admitted proofs | 0 |
| Verus spec/proof/exec | 10 / 14 / 5 |
| Bare-metal modules | 12 total |
| Host tests | 62/62 pass |
| Cross-compile targets | 3/3 (RISC-V, x86_64, AArch64) |
| FUTURE_OBLIGATION remaining | 0 (was 15) |
| Patent families | 3 |

## Test plan

- [x] `cargo test --manifest-path bare-metal-tests/Cargo.toml` — 62/62 pass
- [x] `cargo build --release --target riscv32imc-unknown-none-elf` — compiles
- [x] `cargo build --release --target x86_64-unknown-none` — compiles
- [x] `cargo build --release --target aarch64-unknown-none` — compiles
- [x] `grep FUTURE_OBLIGATION roadmap/crosswalk_203.csv` — 0 matches
- [x] SHA-256 hashes in manifest.json match source files

:robot: Generated with [Claude Code](https://claude.com/claude-code)
PREOF
)"

Create pull request


Error: Exit code 1
a pull request for branch "feat/executive-presentation" into branch "master" already exists:
https://github.com/iamdatanick/cubie-math/pull/1


PR #1 already exists for this branch. Let me update it with the new description.


ToolSearch

Question: select:mcp__MCP_DOCKER__update_pull_request


Question: select:mcp__MCP_DOCKER__update_pull_request


feat: formally verified dual-ledger + hierarchical consent — Coq to RISC-V

## Summary

- **Cross-compiled to 3 bare-metal silicon targets** (RISC-V 32-bit, x86_64, AArch64) with zero OS dependencies — native machine code, not bytecode
- **21 new theorems** (CUB-0734..0754) proven in both Coq 8.18.0 and Lean 4.30.0 independently, axiom-free, zero Admitted/sorry
- **Full verification chain**: Coq/Lean proofs -> Verus spec+exec functions (SMT-verified) -> bare-metal Rust `#[repr(C)]` runtime -> cross-compilation to silicon
- **62/62 host integration tests pass** (21 admit + 26 consent hierarchy + 15 dual-ledger)
- **All 15 FUTURE_OBLIGATION items resolved** to VERIFIED_EXACT — 0 remaining obligations
- **754 total theorems** across the verification stack (was 733)
- **3 patent families covered**: US11956363B2 (dual-ledger identity), US20240195628A1 1st set (hierarchical trust), US20240195628A1 2nd set (advanced consent)
- **1,459-line architecture and rationale document** with chronological build phases and actual performance results

## Architecture

```
Coq 8.18.0 + Lean 4.30.0  (independent type theories, same predicates)
         |
         v
Verus spec fns (10) + proof fns (14) + exec fns (5)
  ensures result == spec_fn(...)  (SMT/Z3 verified)
         |
         v
Bare-metal Rust (no_std, #[repr(C)], no alloc, no OS)
  12 modules: sha256, hmac, admit, types, mmio, nvlink,
  pcie, cycle_counter, consent (NEW), dual_ledger (NEW)
         |
         v
  +------------+  +-----------+  +------------+
  | RISC-V     |  | x86_64    |  | AArch64    |
  | 5.2 MB .a  |  | 6.8 MB .a |  | 8.5 MB .a  |
  +------------+  +-----------+  +------------+
```

## New Files (9)

| File | What |
|------|------|
| `coq/CubieDualLedger.v` | 7 Coq proofs — dual-ledger non-disclosure (US11956363B2) |
| `coq/CubieQuantumConsentAdvanced.v` | 14 Coq proofs — hierarchical consent (US20240195628A1) |
| `lean/CubieDualLedger.lean` | 7 Lean 4 proofs (independent mirror) |
| `lean/CubieQuantumConsentAdvanced.lean` | 14 Lean 4 proofs (independent mirror) |
| `verus/cubie_consent_hierarchy_spec.rs` | 10 spec + 14 proof + 5 exec fns |
| `bare-metal/src/consent.rs` | 10 runtime functions, `#[repr(C)]` |
| `bare-metal/src/dual_ledger.rs` | 5 runtime functions, `#[repr(C)]` |
| `bare-metal-tests/tests/consent_hierarchy.rs` | 26 integration tests |
| `bare-metal-tests/tests/dual_ledger.rs` | 15 integration tests |

## Modified Files (8)

| File | Change |
|------|--------|
| `bare-metal/src/lib.rs` | Register consent + dual_ledger modules |
| `bare-metal-tests/Cargo.toml` | Register 2 new test targets |
| `verus/cubie_delegation_spec.rs` | Resolve FUTURE_OBLIGATION stub |
| `roadmap/crosswalk_203.csv` | 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT |
| `roadmap/master_theorem_table.csv` | 21 new theorem rows (754 total) |
| `manifest.json` | SHA-256 hashes + updated counts |
| `README.md` | Theorem count 733 -> 754 |
| `docs/ARCHITECTURE_AND_RATIONALE.md` | 1,459-line architecture document |

## Verification Stats

| Metric | Value |
|--------|-------|
| Proof assistants | Coq 8.18.0 + Lean 4.30.0 (independent) |
| Axiom profile | axiom-free (fully constructive) |
| Admitted proofs | 0 |
| Verus spec/proof/exec | 10 / 14 / 5 |
| Bare-metal modules | 12 total |
| Host tests | 62/62 pass |
| Cross-compile targets | 3/3 (RISC-V, x86_64, AArch64) |
| FUTURE_OBLIGATION remaining | 0 (was 15) |
| Patent families | 3 |

## Test plan

- [x] `cargo test --manifest-path bare-metal-tests/Cargo.toml` — 62/62 pass
- [x] `cargo build --release --target riscv32imc-unknown-none-elf` — compiles
- [x] `cargo build --release --target x86_64-unknown-none` — compiles
- [x] `cargo build --release --target aarch64-unknown-none` — compiles
- [x] `grep FUTURE_OBLIGATION roadmap/crosswalk_203.csv` — 0 matches
- [x] SHA-256 hashes in manifest.json match source files

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Error: failed to update pull request: PATCH https://api.github.com/repos/iamdatanick/cubie-math/pulls/1: 404 Not Found []


Bash

cd "C:/Users/NickV/cubie-verification" && gh pr view 1 --json title,url,state 2>&1

Check existing PR details


feat: executive + technical PowerPoint presentation (27 slides)


cd "C:/Users/NickV/cubie-verification" && gh pr edit 1 --title "feat: formally verified dual-ledger + hierarchical consent — Coq to RISC-V" --body-file .git/COMMIT_MSG_PR.txt 2>&1 || echo "trying inline..."

Try editing PR title via gh CLI


open .git/COMMIT_MSG_PR.txt: The system cannot find the file specified.
trying inline...


Write

## Summary

- **Cross-compiled to 3 bare-metal silicon targets** (RISC-V 32-bit, x86_64, AArch64) with zero OS dependencies -- native machine code, not bytecode
- **21 new theorems** (CUB-0734..0754) proven in both Coq 8.18.0 and Lean 4.30.0 independently, axiom-free, zero Admitted/sorry
- **Full verification chain**: Coq/Lean proofs -> Verus spec+exec functions (SMT-verified) -> bare-metal Rust `#[repr(C)]` runtime -> cross-compilation to silicon
- **62/62 host integration tests pass** (21 admit + 26 consent hierarchy + 15 dual-ledger)
- **All 15 FUTURE_OBLIGATION items resolved** to VERIFIED_EXACT -- 0 remaining obligations
- **754 total theorems** across the verification stack (was 733)
- **3 patent families covered**: US11956363B2 (dual-ledger identity), US20240195628A1 1st set (hierarchical trust), US20240195628A1 2nd set (advanced consent)
- **1,459-line architecture and rationale document** with chronological build phases and actual performance results

## Architecture

```
Coq 8.18.0 + Lean 4.30.0  (independent type theories, same predicates)
         |
         v
Verus spec fns (10) + proof fns (14) + exec fns (5)
  ensures result == spec_fn(...)  (SMT/Z3 verified)
         |
         v
Bare-metal Rust (no_std, #[repr(C)], no alloc, no OS)
  12 modules: sha256, hmac, admit, types, mmio, nvlink,
  pcie, cycle_counter, consent (NEW), dual_ledger (NEW)
         |
         v
  +------------+  +-----------+  +------------+
  | RISC-V     |  | x86_64    |  | AArch64    |
  | 5.2 MB .a  |  | 6.8 MB .a |  | 8.5 MB .a  |
  +------------+  +-----------+  +------------+
```

## New Files (9)

| File | What |
|------|------|
| `coq/CubieDualLedger.v` | 7 Coq proofs -- dual-ledger non-disclosure (US11956363B2) |
| `coq/CubieQuantumConsentAdvanced.v` | 14 Coq proofs -- hierarchical consent (US20240195628A1) |
| `lean/CubieDualLedger.lean` | 7 Lean 4 proofs (independent mirror) |
| `lean/CubieQuantumConsentAdvanced.lean` | 14 Lean 4 proofs (independent mirror) |
| `verus/cubie_consent_hierarchy_spec.rs` | 10 spec + 14 proof + 5 exec fns |
| `bare-metal/src/consent.rs` | 10 runtime functions, `#[repr(C)]` |
| `bare-metal/src/dual_ledger.rs` | 5 runtime functions, `#[repr(C)]` |
| `bare-metal-tests/tests/consent_hierarchy.rs` | 26 integration tests |
| `bare-metal-tests/tests/dual_ledger.rs` | 15 integration tests |

## Modified Files (8)

| File | Change |
|------|--------|
| `bare-metal/src/lib.rs` | Register consent + dual_ledger modules |
| `bare-metal-tests/Cargo.toml` | Register 2 new test targets |
| `verus/cubie_delegation_spec.rs` | Resolve FUTURE_OBLIGATION stub |
| `roadmap/crosswalk_203.csv` | 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT |
| `roadmap/master_theorem_table.csv` | 21 new theorem rows (754 total) |
| `manifest.json` | SHA-256 hashes + updated counts |
| `README.md` | Theorem count 733 -> 754 |
| `docs/ARCHITECTURE_AND_RATIONALE.md` | 1,459-line architecture document |

## Verification Stats

| Metric | Value |
|--------|-------|
| Proof assistants | Coq 8.18.0 + Lean 4.30.0 (independent) |
| Axiom profile | axiom-free (fully constructive) |
| Admitted proofs | 0 |
| Verus spec/proof/exec | 10 / 14 / 5 |
| Bare-metal modules | 12 total |
| Host tests | 62/62 pass |
| Cross-compile targets | 3/3 (RISC-V, x86_64, AArch64) |
| FUTURE_OBLIGATION remaining | 0 (was 15) |
| Patent families | 3 |

## Test plan

- [x] `cargo test --manifest-path bare-metal-tests/Cargo.toml` -- 62/62 pass
- [x] `cargo build --release --target riscv32imc-unknown-none-elf` -- compiles
- [x] `cargo build --release --target x86_64-unknown-none` -- compiles
- [x] `cargo build --release --target aarch64-unknown-none` -- compiles
- [x] `grep FUTURE_OBLIGATION roadmap/crosswalk_203.csv` -- 0 matches
- [x] SHA-256 hashes in manifest.json match source files

Generated with [Claude Code](https://claude.com/claude-code)


File created successfully at: C:\Users\NickV\cubie-verification\.git\PR_BODY.md

## Summary

- **Cross-compiled to 3 bare-metal silicon targets** (RISC-V 32-bit, x86_64, AArch64) with zero OS dependencies -- native machine code, not bytecode
- **21 new theorems** (CUB-0734..0754) proven in both Coq 8.18.0 and Lean 4.30.0 independently, axiom-free, zero Admitted/sorry
- **Full verification chain**: Coq/Lean proofs -> Verus spec+exec functions (SMT-verified) -> bare-metal Rust `#[repr(C)]` runtime -> cross-compilation to silicon
- **62/62 host integration tests pass** (21 admit + 26 consent hierarchy + 15 dual-ledger)
- **All 15 FUTURE_OBLIGATION items resolved** to VERIFIED_EXACT -- 0 remaining obligations
- **754 total theorems** across the verification stack (was 733)
- **3 patent families covered**: US11956363B2 (dual-ledger identity), US20240195628A1 1st set (hierarchical trust), US20240195628A1 2nd set (advanced consent)
- **1,459-line architecture and rationale document** with chronological build phases and actual performance results

## Architecture

```
Coq 8.18.0 + Lean 4.30.0  (independent type theories, same predicates)
         |
         v
Verus spec fns (10) + proof fns (14) + exec fns (5)
  ensures result == spec_fn(...)  (SMT/Z3 verified)
         |
         v
Bare-metal Rust (no_std, #[repr(C)], no alloc, no OS)
  12 modules: sha256, hmac, admit, types, mmio, nvlink,
  pcie, cycle_counter, consent (NEW), dual_ledger (NEW)
         |
         v
  +------------+  +-----------+  +------------+
  | RISC-V     |  | x86_64    |  | AArch64    |
  | 5.2 MB .a  |  | 6.8 MB .a |  | 8.5 MB .a  |
  +------------+  +-----------+  +------------+
```

## New Files (9)

| File | What |
|------|------|
| `coq/CubieDualLedger.v` | 7 Coq proofs -- dual-ledger non-disclosure (US11956363B2) |
| `coq/CubieQuantumConsentAdvanced.v` | 14 Coq proofs -- hierarchical consent (US20240195628A1) |
| `lean/CubieDualLedger.lean` | 7 Lean 4 proofs (independent mirror) |
| `lean/CubieQuantumConsentAdvanced.lean` | 14 Lean 4 proofs (independent mirror) |
| `verus/cubie_consent_hierarchy_spec.rs` | 10 spec + 14 proof + 5 exec fns |
| `bare-metal/src/consent.rs` | 10 runtime functions, `#[repr(C)]` |
| `bare-metal/src/dual_ledger.rs` | 5 runtime functions, `#[repr(C)]` |
| `bare-metal-tests/tests/consent_hierarchy.rs` | 26 integration tests |
| `bare-metal-tests/tests/dual_ledger.rs` | 15 integration tests |

## Modified Files (8)

| File | Change |
|------|--------|
| `bare-metal/src/lib.rs` | Register consent + dual_ledger modules |
| `bare-metal-tests/Cargo.toml` | Register 2 new test targets |
| `verus/cubie_delegation_spec.rs` | Resolve FUTURE_OBLIGATION stub |
| `roadmap/crosswalk_203.csv` | 15 rows FUTURE_OBLIGATION -> VERIFIED_EXACT |
| `roadmap/master_theorem_table.csv` | 21 new theorem rows (754 total) |
| `manifest.json` | SHA-256 hashes + updated counts |
| `README.md` | Theorem count 733 -> 754 |
| `docs/ARCHITECTURE_AND_RATIONALE.md` | 1,459-line architecture document |

## Verification Stats

| Metric | Value |
|--------|-------|
| Proof assistants | Coq 8.18.0 + Lean 4.30.0 (independent) |
| Axiom profile | axiom-free (fully constructive) |
| Admitted proofs | 0 |
| Verus spec/proof/exec | 10 / 14 / 5 |
| Bare-metal modules | 12 total |
| Host tests | 62/62 pass |
| Cross-compile targets | 3/3 (RISC-V, x86_64, AArch64) |
| FUTURE_OBLIGATION remaining | 0 (was 15) |
| Patent families | 3 |

## Test plan

- [x] `cargo test --manifest-path bare-metal-tests/Cargo.toml` -- 62/62 pass
- [x] `cargo build --release --target riscv32imc-unknown-none-elf` -- compiles
- [x] `cargo build --release --target x86_64-unknown-none` -- compiles
- [x] `cargo build --release --target aarch64-unknown-none` -- compiles
- [x] `grep FUTURE_OBLIGATION roadmap/crosswalk_203.csv` -- 0 matches
- [x] SHA-256 hashes in manifest.json match source files

Generated with [Claude Code](https://claude.com/claude-code)


Bash

cd "C:/Users/NickV/cubie-verification" && gh pr edit 1 --title "feat: formally verified dual-ledger + hierarchical consent — Coq to RISC-V" --body-file .git/PR_BODY.md 2>&1

Update PR title and body


PR updated and live: **https://github.com/iamdatanick/cubie-math/pull/1**

Title updated, body has the full summary with architecture diagram, file manifest, verification stats, and test plan — all checked off.


come up with a plan for integration into this . i do have access to the edge api testbed "C:\Users\NickV\Downloads\intel-isbc-2025-application-ready-verification (4).pdf"


Error: pdftoppm failed: Command 'pdftoppm' not found or is in an unsafe location (current directory)


ToolSearch

Question: select:WebFetch


Question: select:WebFetch


Bash

python -c "
import subprocess
result = subprocess.run(['pip', 'show', 'PyPDF2'], capture_output=True, text=True)
print(result.stdout or 'not installed')
result2 = subprocess.run(['pip', 'show', 'pymupdf'], capture_output=True, text=True)
print(result2.stdout or 'pymupdf not installed')
"

Check for PDF libraries


not installed
Name: PyMuPDF
Version: 1.27.2.2
Summary: A high performance Python library for data extraction, analysis, conversion & manipulation of PDF (and other) documents.
Home-page:
Author: Artifex
Author-email: support@artifex.com
License: Dual Licensed - GNU AFFERO GPL 3.0 or Artifex Commercial License
Location: C:\Python314\Lib\site-packages
Requires:
Required-by:


python -c "
import fitz
doc = fitz.open(r'C:\Users\NickV\Downloads\intel-isbc-2025-application-ready-verification (4).pdf')
print(f'Pages: {len(doc)}')
for i in range(min(len(doc), 10)):
    text = doc[i].get_text()
    print(f'\n=== PAGE {i+1} ===')
    print(text[:3000])
" 2>&1

Extract PDF text with PyMuPDF


Pages: 31

=== PAGE 1 ===

Intel� AI Edge Application
Ready Verification

Guide
January 2026
Revision 2.1

=== PAGE 2 ===

Intel� AI Edge Application Ready Verification
2

Legal Disclaimers and Copyrights
All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications
and roadmaps.
Intel technologies� features and benefits depend on system configuration and may require enabled hardware, software, or service activation.
Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or
retailer or learn more at intel.com.
You may not use or facilitate the use of this document in connection with any infringement or other legal analysis concerning Intel products
described herein. You agree to grant Intel a non-exclusive, royalty-free license to any patent claim thereafter drafted that includes subject matter
disclosed herein.
No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document.
Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular
purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade.
Intel does not control or audit third-party benchmark data or the web sites referenced in this document. You should visit the referenced web site
and confirm whether referenced data are accurate.
The products and services described may contain defects or errors, known as errata, which may cause deviations from published specifications.
Current characterized errata are available on request.
Intel and the Intel logo are trademarks of Intel Corporation in the United States and other countries.
*Other names and brands may be claimed as the property of others.
Copyright � 2026 Intel Corporation. All rights reserved.

=== PAGE 3 ===

Intel� AI Edge Application Ready Verification
3
Contents

Contents ........................................................................................................................................ 3
Introduction ................................................................................................................................. 5
How Does it Work? ..................................................................................................................... 6
Step 1:  Acquire an Intel� AI Edge System & Software ........................................................ 7
1a. Access a System ................................................................................................................................................................ 7
1b. System Software Requirements ................................................................................................................................ 7
Step 2:  Download & Install Edge Sizing Tool ........................................................................ 8
2a. Download the Edge AI Sizing Tool (two options are available) .................................................................. 8
2b. Install Software and Test Run the Intel AI Edge Sizing Tool ..................................................................... 10
Step 3:  Configure Your Workload ............................................................................................ 12
3a. Video Processing ............................................................................................................................................................ 12
3b. NLP or Text Generation .............................................................................................................................................. 15
Step 4:  Submit Your Application Ready Verification Form ............................................ 17
Step 5:  Application Review, Promotion and Benefits Activation ................................. 19
Support ....................................................................................................................................... 20
Appendix ..................................................................................................................................... 21
Appendix A: An Alternative Verification Method (replaces Steps 2 and 3) ..................... 22
A1:  Aquire the Hardware ................................................................................................................................................... 22
A2:  Capture Hardware Info .............................................................................................................................................. 22
A3:  Configure the load ....................................................................................................................................................... 23
A4:  Submit results a

=== PAGE 4 ===

Intel� AI Edge Application Ready Verification
4
Revision History

Revision
Description
Date
1.0
Initial release.
Sep 2025
1.1
Added Appendix A.
Nov 2025
2.1
Updated the �Access a System� section.
Updated the �Submit Your Application Ready Verification Form� section.
Jan 2026

=== PAGE 5 ===

Intel� AI Edge Application Ready Verification
5
Introduction
This document will guide you through the process of onboarding your AI Edge Application and verifying its
performance on an Intel qualified AI edge system. You will be required to complete the outlined steps, answer
several questions, submit your responses, and attach an automated report to an email for evaluation.

Overview
Accelerate your impact�verify your application with an Intel AI Edge Systems to ensure peak performance on
trusted, pre-qualified hardware. Deliver scalable, real-world AI solutions and stand out in a competitive
market. Begin your integration today.

By joining Intel�s AI Edge ecosystem, your application gains access to premium technical support, and high-
impact co-marketing opportunities�empowering you to expand your reach, enhance visibility, and drive
adoption with confidence.

=== PAGE 6 ===

Intel� AI Edge Application Ready Verification
6
How Does it Work?
This five-step verification process enables ISVs to verify their applications on qualified Intel AI Edge Systems.
It ensures your solution is optimized for deployment on Intel hardware, backed by proven reliability that
earns trust across the Intel ecosystem, enhancing credibility and accelerating market readiness.

Step 1:  Acquire an Intel� AI Edge System &
Software

Step 2:   Download & Install Edge Sizing
Tool from GitHub

Step 3:  Configure Your Workload

Step 4:  Submit Your Application Onboarding
Request

Step 5:  Application Review, Promotion and
Benefits Activation

=== PAGE 7 ===

Intel� AI Edge Application Ready Verification
7
Step 1:  Acquire an Intel� AI Edge System & Software
1a. Access a System
You can begin your application verification with one of the following options, either by procuring one of the
Edge AI systems listed in our catalog, or by requesting access to our testbed where we host a number of
verified Edge AI systems.
� Procure a system from our Recommended Systems Catalog.
� Request access to the Edge AI Testbed.

1b. System Software Requirements
For a smooth onboarding experience, you are required to install the following list of software ingredients.
Refer to the steps shown here.
Category
Component
Version / Detail
Description
Operating System
Ubuntu*
22.04 or 24.04 LTS
Desktop Linux
Validated Target OS
Windows*
Windows 11
AI Toolkit
OpenVINO
Toolkit
Latest
AI inference toolkit optimized for Intel
CPUs, GPUs, and NPUs.
Essential Runtime
Component
Python
3.10+
A core runtime used for running
OpenVINO pipelines.
Essential Runtime
Component (Web)
Node.js
22+
Required for Edge AI Sizing Tool
Intel GPU Support
Intel GPU Driver
v25.09.32961.5
Required for OpenVINO GPU
acceleration1.
Intel NPU Support
Intel NPU Driver
v1.13.0
Required for OpenVINO NPU
acceleration1.
Essential Runtime
Component
intel-gpu-tools
1.28-1ubuntu2
Required for Intel GPU performance &
fine-tuning AI pipeline execution.
1 Systems that do not possess a discrete GPU or NPU will not require these drivers.

=== PAGE 8 ===

Intel� AI Edge Application Ready Verification
8
Step 2:  Download & Install Edge Sizing Tool
NOTE:  Refer to Appendix A to see an alternate approach to completing Steps 2 and 3.

2a. Download the Edge AI Sizing Tool (two options are available)
Option 1:  Cloning with Git tool (recommended)
� Set the branch to  �main� and click the <> Code button to see the download options.
� Start a command line console and copy the command below to begin download.
$git clone https://github.com/intel/edge-ai-sizing-tool.git
Note: Some network environments may require a network proxy setup.

=== PAGE 9 ===

Intel� AI Edge Application Ready Verification
9

Option 2:  Direct Download
� Download the sizing tool at:  https://github.com/intel/edge-ai-sizing-tool
� Set the branch to �main� and click the <> Code button to see the download options.
� Click �Download ZIP� to begin package download.

=== PAGE 10 ===

Intel� AI Edge Application Ready Verification
10
2b. Install Software and Test Run the Intel AI Edge Sizing Tool
� (This step is only required if you performed a direct download)
Install unzip package and decompress edge-ai-sizing-tool-main.zip with the commands below.
$sudo apt-get install unzip -y
$sudo unzip edge-ai-sizing-tool-main.zip
$mv edge-ai-sizing-tool-main edge-ai-sizing-tool

� Enter edge-ai-sizing-tool directory and install required dependencies and start application with
commands below.
$cd edge-ai-sizing-tool
$ ./install.sh
$./start.sh

Note:  When you execute start.sh, the setup process will automatically generate a random secret key for the
PAYLOAD_SECRET variable in the .env file. By running this script, you acknowledge and accept the terms of
use of this automatically generated secret.


python -c "
import fitz
doc = fitz.open(r'C:\Users\NickV\Downloads\intel-isbc-2025-application-ready-verification (4).pdf')
for i in range(10, min(len(doc), 31)):
    text = doc[i].get_text()
    print(f'\n=== PAGE {i+1} ===')
    print(text[:3000])
" 2>&1

Extract remaining PDF pages


Error: Exit code 1
Traceback (most recent call last):
  File "<string>", line 7, in <module>
    print(text[:3000])
    ~~~~~^^^^^^^^^^^^^
  File "C:\Python314\Lib\encodings\cp1252.py", line 19, in encode
    return codecs.charmap_encode(input,self.errors,encoding_table)[0]
           ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeEncodeError: 'charmap' codec can't encode characters in position 183-185: character maps to <undefined>

=== PAGE 11 ===

Intel� AI Edge Application Ready Verification
11
� Once the start script has been initiated, use a web browser application and go to:
http://localhost:8080.
Note:  For correct operation, this application requires port 8080 and ports between 5000 to 6000 to be available
for frontend and worker services respectively.

Figure 1: User interface of Edge AI Sizing Tool landing page.

=== PAGE 12 ===

Intel� AI Edge Application Ready Verification
12
Step 3:  Configure Your Workload
NOTE:  Refer to Appendix A to see an alternate approach to completing Steps 2 and 3.

Next, let�s "build" a workload that closely mimics your application use-case with the options below.

3a. Video Processing
Perform the steps in this section if your application utilizes video processing and analytics in a single pipeline
as used for object detection, face recognition, or motion tracking for industries like retail, safety & security,
education, or healthcare.

Figure 2:  Example of a Video Processing and Analytics Pipeline.

=== PAGE 13 ===

Intel� AI Edge Application Ready Verification
13
Follow the steps below to orchestrate and run the workload that mimics your use-case
� Add Workload

a. Click + Add  Workload to Start the
Workload Configuration.
� Configure Workload

a. Set Task to �Computer Vision� .
b. Set Use-case to �Object Detection
(DLStreamer)�.
c. For Input � Consider the option that best
suits your application (Camera, File or
Predefined Videos that comes with this
application).
d. Select the test video that works well with
your AI Model.
e. Upload your optimized custom model (.zip)
file that should contain .bin and .xml
files. Please refer to the �Custom Model
Guide� section below for packaging details.
f. Select target device that will load the
model.  Only one device per workload may
be selected for model execution.
g. Click �Add Workload� to start workload
pipeline.
� Verify Workload and Generate Report

a. Upon workload activation, the added
workload will appear in the left pane of the
workload interface and you will then be
able to observe its status and workload
behavior on the right pane as illustrated in
the image.
b. In order to generate a report, select
�Export as PDF�. By default, the report will
be downloaded and saved in the  default
browser�s Downloads folder.

=== PAGE 14 ===


python -c "
import fitz, sys
sys.stdout.reconfigure(encoding='utf-8')
doc = fitz.open(r'C:\Users\NickV\Downloads\intel-isbc-2025-application-ready-verification (4).pdf')
for i in range(13, min(len(doc), 31)):
    text = doc[i].get_text()
    print(f'\n=== PAGE {i+1} ===')
    print(text[:3000])
" 2>&1

Extract remaining pages with UTF-8


=== PAGE 14 ===

Intel® AI Edge Application Ready Verification
14
Custom Model Guide
• Package your custom model into a  ZIP file with the file structure below.
my-model.zip
├── model.xml
├── model.bin
└── labels.txt   # (optional)
•
Only OpenVINO model formats are supported. ZIP must contain all necessary model files in OpenVINO
IR format (e.g., .xml, .bin, and optionally labels.txt for object detection).
•
To learn more, go to https://github.com/intel/edge-ai-sizing-
tool/blob/main/custom_models/README.md#custom-model-directory

Note: Custom models loaded into testbed systems will be deleted after each user session.

=== PAGE 15 ===

Intel® AI Edge Application Ready Verification
15
3b. NLP or Text Generation
Perform the steps in this section if your application utilizes Natural Language Processing (NLP) or Text
Generation efficiently in edge environments, ensuring fast responses without relying on cloud connectivity
Follow the steps below to orchestrate and run the workload that mimics your use-case.
• Add Workload
a. Click “+ Add  Workload” To Start Workload
Configuration.
• Configure Workload
a. Set Task to “Natural Language
Processing”.
b. Set use-case to “Text Generation”
c. Upload your optimized custom model (.zip)
file that should contain .bin and .xml files).
d. Select target device that will load the
model.
e. Click “Add Workload” to start workload
pipeline.

=== PAGE 16 ===

Intel® AI Edge Application Ready Verification
16
• Verify Workload and Generate Report

a. Verify workload listed on workload pane on
the left and workload details as shown in
this image.
b. Enter a prompt in the “Type your message”
field and hit the
 button to generate
text.
c. In order to generate a report, select “Export
as PDF”.  By default, the report will be
downloaded and saved in the  default
browser’s Downloads folder.

=== PAGE 17 ===

Intel® AI Edge Application Ready Verification
17
Step 4:  Submit Your Application Ready Verification Form
Please fill out the online Application Ready Verification Form where you will provide the following:

General Information
• Name
• Company Name
• Email
• Project Name

Details
• System Manufacturer
• System Model
• System CPU
• System GPU
• System Source
• Pipeline Description

Uploads
• A picture of your system.
• A block diagram of your application pipeline.
• The report you generated after running the Edge AI Sizing Tool.

Below is the URL location where you can find the form.
https://app.smartsheet.com/b/form/019a3bfa6a0b7623876994c2950fc14f

sc ee s o o a app ca o
o

=== PAGE 18 ===

Intel® AI Edge Application Ready Verification
18

Examples: Pipeline Description and Block Diagram
Below is an example to the question where we ask you to provide your application pipeline description and a
block diagram.

EXAMPLES

Pipeline Description:
Our software application uses real-time video processing and analytics software designed to detect, track,
and analyze objects or behaviors from live or recorded video feeds. Beyond video, we also run Generative
AI and Large Language Model (LLM) features — like answering questions, summarizing insights, or
generating reports based on what’s seen in the video. These powerful features require components like
DL Streamer, Hugging Face and other needful extensions to make our workload efficient on Intel
Architecture.

 Block Diagram:

=== PAGE 19 ===

Intel® AI Edge Application Ready Verification
19
Step 5:  Application Review, Promotion and Benefits Activation
Intel will review your submitted information and may contact you with any follow-up questions. Additionally,
Intel may request to schedule an application review meeting where our representatives can meet with your
team for an informal discussion about your application details. This session will help us better understand
your solution, explore potential benefits and investigate future engagement opportunities.

=== PAGE 20 ===

Intel® AI Edge Application Ready Verification
20
Support
Our team is ready to help ensure a smooth and successful integration into the Edge AI Applications Program.
For any support or assistance required during the onboarding process, please reach out to us at:
intel.edge.ai.application.qualification@intel.com

=== PAGE 21 ===

Intel® AI Edge Application Ready Verification
21
Appendix

=== PAGE 22 ===

Intel® AI Edge Application Ready Verification
22
Appendix A: An Alternative Verification Method (replaces Steps 2 and 3)
Note:  This alternative method replaces Steps 2 and 3 in the “How Does it Work” section.

The method outlined below enables software vendors to test the entire workload while providing the
appropriate output to achieve the desired verification of the software on Intel hardware.

All steps include commands for both Linux and Windows.  Be sure to capture all the outputs that can be sent
to Intel for verification.

A1:  Aquire the Hardware
Gain access to hardware as outlined in Step 1 “Acquire an Intel AI Edge System & Software” on page 7.

For steps 2 and 3, where applicable, execute the commands in the Userspace, VM, or Container within which
the application runs.

A2:  Capture Hardware Info
a. Use the following commands to capture information about the hardware:
Linux
Windows
dmidecode
msinfo32

b. Install the full application on to the system

c.
Execute the application and obtain the list of runtime libraries in use

Linux
Windows
lsof
    or
/proc/<pid>/maps
tasklist

=== PAGE 23 ===

Intel® AI Edge Application Ready Verification
23
A3:  Configure the load
a. Configure a light input load (e.g. # streams or # requests)

b. Run the application and collect measurements plus screenshots and record the utilization of the
CPU, GPU, and/or NPU.

Linux
Windows
CPU
top
    or
mpstat
Task Manager (Performance view)
GPU
intel_gpu_top (from intel-gpu-tools)
    or
qmassa (see
https://github.com/ulissesf/qmassa)
Task Manager (Performance view)
NPU
Intel-npu-top (see
https://pypi.org/project/intel-npu-top/)
    or
nputop (see
https://github.com/ZoLArk173/nputop)
Task Manager (Performance view)

c.
Repeat 1 & 2 with medium input load.

d. Repeat 1 & 2 with heavy input load.

A4:  Submit results and additional details
Gather the outputs and submit them as outlined in step 4 “Submit Your Application Onboarding
Request” on page 17.  Be sure to include a high-level diagram of the application pipeline and a picture
of the system if you are not using the Intel Test Bed.

=== PAGE 24 ===

Intel® AI Edge Application Ready Verification
24
Example #1: Full Application Verification on Windows

In this example, we walk through the steps to verify an application called “classify loop” on an Intel AI Edge
System running Windows.

Capture System Configuration
1. Open a command window
2. Enter: “msinfo32”
3. Save the results to a file, e.g. system.nfo

=== PAGE 25 ===

Intel® AI Edge Application Ready Verification
25
List Runtime Libraries Used by the Application
1. Install and run the application on the system
2. Open a cmd window with admin privilege
•
tasklist /fi "imagename eq [app name]" /m
•
e.g. tasklist /fi “imagename eq classify_loop.exe” /m
•
alternatively, may use “listdlls” (see https://learn.microsoft.com/en-
us/sysinternals/downloads/listdlls) may be used instead
3. Save the output to a text file, say “app_runtimes.txt”

=== PAGE 26 ===

Intel® AI Edge Application Ready Verification
26
Determine Resource Utilizations by the Application at Different Loads
1. Open the Task Manager
2. Show the “Performance” view
3. Run the application with light load
4. Record the average utilizations of CPU, GPU (Compute), and NPU (if applicable)
5. Repeat 1-4 with medium load
6. Repeat 1-4 with heavy load
7. Save the data into a txt file, say utilizations.txt

Provide a Block Diagram of the Application

Application name: Classify Loop

=== PAGE 27 ===

Intel® AI Edge Application Ready Verification
27
Example #2: Full Application Verification on Linux (Ubuntu)

In this example, we walk through the steps to verify an application called “classify loop” on an Intel AI Edge
System running Ubuntu.

Capture System Configuration
1. Open a command window
2. Run: “sudo dmidecode -q”
3. Save the results to a file, e.g. system.txt

=== PAGE 28 ===

Intel® AI Edge Application Ready Verification
28
List Runtime Libraries Used by the Application
1. Install and run the application on the system
2. Open a cmd window
•
Obtain the process id of the application process
•
pgrep classify_loop.exe
•
 Obtain the list of runtime libraries in use by the application process
•
lsof -p <process id>
3. Save the output to a text file, say “app_runtimes.txt”

=== PAGE 29 ===

Intel® AI Edge Application Ready Verification
29
Determine Resource Utilizations by the Application at Different Loads
1. Perform one or all three of these commands:
•
Open a command window and start “top -p <process id>”
     <and/or>
•
Open a command window and start “sudo intel_gpu_top”
     <and/or>
•
Open a command window and start “intel-npu-top”

2. Run the application with light load
3. Record the average utilizations of CPU, GPU (Compute), and NPU (if applicable)
4. Repeat 1-4 with medium load
5. Repeat 1-4 with heavy load

=== PAGE 30 ===

Intel® AI Edge Application Ready Verification
30
6. Save the data into a txt file, say utilizations.txt

=== PAGE 31 ===

Intel® AI Edge Application Ready Verification
31
Provide a Block Diagram of the Application

Application name: Classify Loop


Now I have the full picture. Let me analyze the intersection and build the integration plan.


Agent

Analyze cubie-verification codebase for Intel Edge integration

Prompt:
I need a thorough exploration of the cubie-verification project at C:\Users\NickV\cubie-verification to understand what exists for potential integration with Intel AI Edge hardware.

Specifically find:
1. The bare-metal Cargo.toml - what crate-type is built? (staticlib, rlib, cdylib?)
2. The admit.rs entry point - what's the C-ABI signature of cubie_admit()?
3. Any existing FFI, C headers, or binding generation?
4. The types.rs - what are CubieRequest and AdmitResult structs?
5. The mmio.rs - how does mock vs real MMIO work? Feature flags?
6. Any existing Dockerfile, docker-compose, or container configs?
7. The bare-metal Cargo.toml target configuration (x86_64-unknown-none)
8. Any Python bindings, ctypes usage, or PyO3 integration?
9. The pcie.rs module - does it read real PCIe registers or mock?
10. Any existing benchmarks or performance numbers?

Report file paths and key code snippets for each finding.