Now update the README to match:


Edit

| V2.5 NFT Consent Hierarchy | `CubieQuantumConsentAdvanced.v` | 14 |

| V2.5 Hierarchical Consent | `CubieQuantumConsentAdvanced.v` | 14 |


The file C:\Users\NickV\cubie-verification\README.md has been updated successfully.

# cubie-verification

Formal verification stack for the **Cubie Trust Compiler** — a 6-faced admission gate
for AI workload deployment on bare-metal silicon, cloud, and embedded hardware.

Covers **754 theorems** across Coq, Lean 4, and Verus, with a no_std Rust crate that
compiles directly to RISC-V, x86_64, and AArch64 without an OS.

---

## What this is

The Cubie Trust Compiler enforces a 3×3×2 "cube" of admission conditions before any
AI workload runs on hardware. Each face of the cube maps to a formal predicate:

| Cube face | Predicate | Gate check |
|-----------|-----------|------------|
| Who | Identity corner | `who_pass` |
| What | Capability corner | `what_pass` |
| How | Method corner | `how_pass` |
| Where | Deployment corner | `where_pass` |
| When | Lease validity | `when_pass + has_valid_lease + epoch_fresh` |
| Why | Policy corner | `why_pass` |

On top of the logical checks, the bare-metal gate adds three hardware-backed checks:
- **HMAC-SHA256** over a hardware eFuse key (FIPS 198-1 + FIPS 180-4)
- **NVLink waiter detection** (SM idle + VRAM held = deadlock signature → deny)
- **PCIe adapter swap gate** (16-entry cache + bandwidth threshold)

All three hardware checks are proven correct by Verus exec functions that
are verified at compile time to satisfy their formal specifications.

---

## Repository layout

```
cubie-verification/
│
├── coq/                        # 35 Coq proof files (.v)
│   ├── RamenCornerConsensusV1192.v        # 53 theorems — v1.19.2 canonical
│   ├── CubieTrustCompilerV2_0.v           # 26 theorems — v2.0 canonical
│   ├── CubieTrustCompilerV2_0_PerPredicate.v  # 54 corollaries
│   ├── TheoremOmega*.v                    # Omega 4.0 / 4.3 / 5.0 / 6.0
│   └── Cubie*_v7.v                        # v2.5 whitepaper gap theorems (5 files)
│
├── lean/                       # 34 Lean 4 proof files (.lean)
│   └── (mirrors coq/ module for module)
│
├── verus/                      # 17 Verus spec files (.rs)
│   ├── cubie_runtime_spec.rs              # Top-level admit gate spec + exec fn
│   ├── cubie_per_predicate_spec.rs        # 54 per-predicate corollaries
│   └── cubie_*_spec.rs                    # Per-cluster specs with exec fn layer
│
├── bare-metal/                 # no_std Rust crate — runs directly on silicon
│   ├── Cargo.toml              # staticlib + rlib, zero dependencies
│   ├── .cargo/config.toml      # default target: riscv32imc-unknown-none-elf
│   └── src/
│       ├── lib.rs              # crate root; std/mock feature flags
│       ├── admit.rs            # cubie_admit() C ABI entry point
│       ├── types.rs            # CubieRequest, WasteFactors, AdmitResult (#[repr(C)])
│       ├── sha256.rs           # FIPS 180-4 SHA-256 (pure Rust, no_std, no heap)
│       ├── hmac.rs             # FIPS 198-1 HMAC-SHA256 + constant-time ct_eq_32
│       ├── hmac_stub.rs        # capability_hmac_verify (eFuse key + HMAC)
│       ├── mmio.rs             # volatile MMIO reads; mock AtomicU32 cells for tests
│       ├── nvlink.rs           # NVLink waiter-signature detection
│       ├── pcie.rs             # PCIe adapter cache + BW threshold gate
│       └── cycle_counter.rs    # RISC-V mcycle / x86_64 rdtsc / AArch64 cntvct_el0
│
├── bare-metal-tests/           # Host test crate (std + mock features)
│   ├── tests/admit.rs          # 21 integration tests (all gate conditions)
│   ├── benches/admit_bench.rs  # Criterion benchmarks (5 sections)
│   └── src/speedtest.rs        # Speed test with CPUID brand + RDTSC calibration
│
├── roadmap/
│   ├── master_theorem_table.csv      # 733 rows — one per theorem/axiom/definition
│   ├── cubie_full_proof_stack.jsonl  # 1,345 records — unified proof stack
│   ├── comprehensive_proof_inventory.csv
│   └── crosswalk_203.csv
│
├── tools/                      # Python build and analysis scripts
│   ├── load_jsonl_to_excel.py        # → cubie_master_proof_stack.xlsx (5 sheets)
│   ├── gap_analysis_to_excel.py      # → cubie_gap_analysis.xlsx (4 sheets)
│   ├── append_whitepaper_gaps.py     # Added CUB-0717–0733 from whitepaper v2.5
│   ├── build_comprehensive_table.py
│   ├── build_crosswalk.py
│   ├── scan_for_unsound_tokens.py    # Scans for Admitted/sorry/unexpected axioms
│   └── verify_hashes.py
│
├── reports/                    # coqchk logs, verification reports, gap report
├── docs/                       # Axiom audit, theorem inventory, certificates
├── manifest.json               # SHA-256 hashes for all source files
│
├── speedtest.ps1               # Build + run silicon speed test (Windows)
├── run_verus.ps1               # Run Verus verification across all 17 specs
├── run_verus_debug.ps1         # Verus with verbose output
├── run_verus_full.ps1          # Full Verus pass including all gap specs
└── Makefile                    # scan / crosswalk / verify-coq / verify-lean / report
```

---

## Theorem coverage

| Deliverable | Coq file | Theorems |
|-------------|----------|----------|
| V1.19.2 Ramen Corner | `RamenCornerConsensusV1192.v` | 53 |
| V1.30 ToR Admission | `ToRAdmissionCompilerV1_30.v` | 5 |
| V1.31 ToR Spoofing | `ToRCornerSpoofingV1_31.v` | 2 |
| V1.40 Cubie Bridge | `CubieBridgeV1_40.v` | 6 |
| V1.50 Track B | `CubieTrustCompilerV1_50.v` | 17 |
| V2.0 Track C | `CubieTrustCompilerV2_0.v` | 26 |
| V2.0-PP Per-Predicate | `CubieTrustCompilerV2_0_PerPredicate.v` | 54 |
| Omega 4.0–6.0 | `TheoremOmega*.v` | 8 |
| V2.5 Gap theorems | `Cubie*_v7.v` (5 files) | 17 |
| V2.5 Dual-Ledger Consent | `CubieDualLedger.v` | 7 |
| V2.5 NFT Consent Hierarchy | `CubieQuantumConsentAdvanced.v` | 14 |
| **Total** | | **754 rows** |

---

## Quick start

### Run Verus verification
```powershell
.\run_verus.ps1
```

### Run all 21 integration tests on host
```powershell
cargo test --manifest-path bare-metal-tests/Cargo.toml
```

### Run silicon speed test (CPUID + RDTSC calibration)
```powershell
.\speedtest.ps1
```

### Cross-compile to RISC-V bare-metal
```powershell
cargo build --release --manifest-path bare-metal/Cargo.toml --target riscv32imc-unknown-none-elf
# Output: bare-metal/target/riscv32imc-unknown-none-elf/release/libcubie_bare_metal.a
```

### Cross-compile to x86_64 bare-metal (UEFI)
```powershell
cargo build --release --manifest-path bare-metal/Cargo.toml --target x86_64-unknown-none
```

### Generate Excel workbooks
```powershell
python tools/load_jsonl_to_excel.py    # → cubie_master_proof_stack.xlsx
python tools/gap_analysis_to_excel.py  # → cubie_gap_analysis.xlsx
```

### Makefile targets
```bash
make scan       # Scan for Admitted/sorry/unexpected axioms
make crosswalk  # Build roadmap/crosswalk_203.csv
make report     # Generate reports/
make master     # Build roadmap/master_theorem_table.csv
make verify-coq
make verify-lean
make verify-verus
```

---

## Bare-metal gate performance

Measured on **Intel Core Ultra 9 285HX @ 3.07 GHz** (RDTSC-calibrated):

| Benchmark | ns/call | cycles/call | calls/sec |
|-----------|---------|-------------|-----------|
| Full gate — cache miss | ~730 ns | ~2,242 | ~1.37M |
| Full gate — cache hit | ~730 ns | ~2,242 | ~1.37M |
| HMAC-SHA256 only | ~785 ns | ~2,352 | ~1.27M |
| NVLink check only | < 1 ns | 1 | > 1B |
| PCIe cache hit | < 1 ns | 1 | > 1B |

HMAC-SHA256 dominates (~97% of gate time). Everything else is sub-nanosecond.

Projected on embedded silicon:

| Platform | Estimate |
|----------|----------|
| RISC-V @ 1 GHz | ~2.4 µs/call (~416K admits/sec) |
| ARM @ 1.8 GHz | ~1.3 µs/call (~750K admits/sec) |

Add ~100–400 ns for eFuse MMIO read latency on real hardware.

---

## Feature flags (bare-metal crate)

| Flag | Effect |
|------|--------|
| *(none)* | `no_std`, real MMIO — production firmware build |
| `std` | Enables std; removes custom panic handler — host test builds |
| `mock` | Replaces all MMIO with AtomicU32 cells — **never use in production** |

---

## Crosswalk status values

| Status | Meaning |
|--------|---------|
| `VERIFIED_EXACT` | Exact theorem in Coq/Lean source |
| `VERIFIED_EQUIVALENT` | Semantically equivalent theorem exists |
| `DERIVED_CANDIDATE` | Provable from verified stack — needs formalization |
| `FUTURE_OBLIGATION` | Needs new definitions + formalization |
| `REWRITE_RULE` | Documentation/spec guardrail — no proof required |
| `ENGINEERING_INVARIANT` | Runtime invariant (Verus/integration test target) |
| `EMPIRICAL_CLAIM` | Measurement-based — cannot be formally proved |

---

## Formal verification toolchain

| Tool | Version | Use |
|------|---------|-----|
| Coq | 8.18.0 | Primary proof assistant |
| Lean 4 | 4.x | Secondary proof assistant |
| Verus | 0.x | Rust formal verification + exec fn layer |
| coqchk | 8.18.0 | Independent kernel verification of .vo files |

---

## Patent alignment

Theorems in this stack map to claims in:
- **US11956363B2** — Cubie Trust Compiler (granted)
- **US12073439B2** — Cubie geometry + corner model (granted)
- **US20240195628A1** — V2.0-PP per-predicate corollaries (pending)

See `docs/AXIOM_AUDIT.md` and the `PatentClaim` column in
`roadmap/master_theorem_table.csv` for the full theorem → patent claim mapping.

---

## Release history

| Tag | Description |
|-----|-------------|
| [`v1.1-bare-metal`](https://github.com/iamdatanick/cubie-math/releases/tag/v1.1-bare-metal) | 17 whitepaper v2.5 gap theorems + bare-metal silicon gate + HMAC/NVLink/PCIe hardware stubs + test suite + speed test |
| `v1.0` | Initial formal verification stack — 716 theorems, Coq + Lean + Verus |

-| V2.5 NFT Consent Hierarchy | `CubieQuantumConsentAdvanced.v` | 14 |

+| V2.5 Hierarchical Consent | `CubieQuantumConsentAdvanced.v` | 14 |


Now let me verify the "ad filtering" language is gone from the dual-ledger master table entries too:


738:CUB-0737,CubieDualLedger,V2.5 Dual-Ledger Consent,Audit Privacy and Proof-Ledger,21,CTCP_CHAIN,no_capability_no_access,Theorem,CubieDualLedger.v,CubieDualLedger.lean,PENDING,PENDING,123,0 axioms,VERIFIED_EXACT,YES,Coq+Lean,"US11956363B2 Claim 2. No advertiser capability => dual ledger admission fails."
739:CUB-0738,CubieDualLedger,V2.5 Dual-Ledger Consent,Audit Privacy and Proof-Ledger,21,CTCP_CHAIN,filter_independent_of_consent,Theorem,CubieDualLedger.v,CubieDualLedger.lean,PENDING,PENDING,133,0 axioms,VERIFIED_EXACT,YES,Coq+Lean,"US11956363B2 Claim 3. Ad filtering preference is orthogonal to consent state."


No advertiser capability => dual ledger admission fails.

No entity capability => dual ledger admission fails.