DERIVED: Definition named 'CACHE_LINE_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition CACHE_LINE_BYTES : nat := 64.

not stated in registry status for this row

(empty -- not bound to any bare-metal exec fn/crate)


DERIVED: Definition named 'STRUCT_SIZE_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition STRUCT_SIZE_BYTES : nat := 192.


DERIVED: Definition named 'STRUCT_ALIGN_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition STRUCT_ALIGN_BYTES : nat := 64.


DERIVED: Definition named 'NUM_CACHE_LINES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout


DERIVED: Definition named 'HMAC_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout


DERIVED: Definition named 'NONCE_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout


DERIVED: Definition named 'RESERVED_BYTES' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout


DERIVED: Definition named 'field_valid_hmac' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition field_valid_hmac (obj : CubeObjectV1Spec) : Prop :=
  length (capability_hmac obj) = HMAC_BYTES.


DERIVED: Definition named 'field_valid_nonce' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition field_valid_nonce (obj : CubeObjectV1Spec) : Prop :=
  length (lease_nonce obj) = NONCE_BYTES.


DERIVED: Definition named 'reserved_zeroed' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition reserved_zeroed (obj : CubeObjectV1Spec) : Prop :=
  reserved_bytes obj = [0; 0; 0; 0].


DERIVED: Definition named 'layout_valid' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition layout_valid (obj : CubeObjectV1Spec) : Prop :=
  field_valid_hmac obj /\ field_valid_nonce obj /\ reserved_zeroed obj.


DERIVED: Definition named 'legacy_field_preserved' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition legacy_field_preserved (src dst : CubeObjectV1Spec) : Prop :=
  capability_hmac dst = capability_hmac src /\
  lease_nonce dst = lease_nonce src /\
  topology_state dst = topology_state src /\
  route_magic dst = route_magic src /\
  payload_hash dst = payload_hash src /\
  delegation_depth dst = delegation_depth src /\
  consent_mask dst = consent_mask src /\
  uah_byte dst = uah_byte src /\
  puf_seed dst = puf_seed src /\
  thermal_tag dst = thermal_tag src /\
  nvlink_epoch dst = nvlink_epoch src /\
  pcie_epoch dst = pcie_epoch src.


DERIVED: Theorem named 'CUB_0840_layout_invariant' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Theorem CUB_0840_layout_invariant :
  STRUCT_SIZE_BYTES = 192 /\
  STRUCT_ALIGN_BYTES = 64 /\
  NUM_CACHE_LINES = 3 /\
  STRUCT_SIZE_BYTES = STRUCT_ALIGN_BYTES * NUM_CACHE_LINES.


DERIVED: Theorem named 'CUB_0841_from_legacy_lossless' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Theorem CUB_0841_from_legacy_lossless :
  forall (src dst : CubeObjectV1Spec),
    legacy_field_preserved src dst ->
    capability_hmac dst = capability_hmac src /\
    lease_nonce dst = lease_nonce src /\
    topology_state dst = topology_state src.


DERIVED: Theorem named 'CUB_0842_reserved_no_info_leak' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Theorem CUB_0842_reserved_no_info_leak :
  forall (obj : CubeObjectV1Spec),
    reserved_zeroed obj ->
    reserved_bytes obj = [0; 0; 0; 0] /\
    length (reserved_bytes obj) = RESERVED_BYTES.


DERIVED: Definition named 'SOLVED_STATE_NAT' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition SOLVED_STATE_NAT : nat := 18014398509481983. (* 2^54 - 1 *)

Definition topology_in_range (obj : CubeObjectV1Spec) : Prop :=
  topology_state obj <= SOLVED_STATE_NAT.


DERIVED: Definition named 'topology_in_range' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Definition topology_in_range (obj : CubeObjectV1Spec) : Prop :=
  topology_state obj <= SOLVED_STATE_NAT.


DERIVED: Theorem named 'CUB_0843_topology_self_consistent' in the CubeObjectLayoutV2_5 family -- registry statement: V2.5 CubeObject Layout

Theorem CUB_0843_topology_self_consistent :
  forall (obj : CubeObjectV1Spec),
    topology_in_range obj ->
    topology_state obj <= SOLVED_STATE_NAT.


DERIVED: Definition named 'HeadShapeOK' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Definition HeadShapeOK (manifest engine runtime : AttentionManifest) : bool :=
  Nat.eqb (manifest_layers manifest) (manifest_layers engine)   &&
  Nat.eqb (manifest_layers engine)   (manifest_layers runtime)  &&
  Nat.eqb (manifest_h_q manifest)    (manifest_h_q engine)      &&
  Nat.eqb (manifest_h_q engine)      (manifest_h_q runtime)     &&
  Nat.eqb (manifest_h_kv manifest)   (manifest_h_kv engine)     &&
  Nat.eqb (manifest_h_kv engine)     (manifest_h_kv runtime)    &&
  Nat.eqb (manifest_d_head manifest) (manifest_d_head engine)   &&
  Nat.eqb (manifest_d_head engine)   (manifest_d_head runtime).

def HeadShapeOK (manifest engine runtime : AttentionManifest) : Bool


DERIVED: Definition named 'waste_ok_decomposition' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Definition waste_ok_decomposition (w : WasteOKFactors) : bool :=
  roofline_ok w          &&
  kv_budget_ok w          &&
  q_heads_ok w           &&
  adapter_swap_ok_b w    &&
  nvlink_waiter_safe_b w &&
  loop_free w            &&
  target_pool_ok w.

def waste_ok_decomposition (w : WasteOKFactors) : Bool


DERIVED: Definition named 'adapter_swap_ok' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Definition adapter_swap_ok (cached pcie_ok : bool) : bool :=
  cached || pcie_ok.

def adapter_swap_ok (cached pcie_ok : Bool) : Bool


DERIVED: Definition named 'nvlink_waiter_safe' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Definition nvlink_waiter_safe (zero_sm alloc_vram : bool) : bool :=
  negb (zero_sm && alloc_vram).

def nvlink_waiter_safe (zero_sm alloc_vram : Bool) : Bool


DERIVED: Theorem named 'head_shape_mismatch_implies_waste_zero' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Theorem head_shape_mismatch_implies_waste_zero :
  forall (m e r : AttentionManifest) (w : WasteOKFactors),
  HeadShapeOK m e r = false ->
  kv_budget_ok w = HeadShapeOK m e r ->
  waste_ok_decomposition w = false.

theorem head_shape_mismatch_implies_waste_zero
    (m e r : AttentionManifest) (w : WasteOKFactors)
    (hmismatch : HeadShapeOK m e r = false)
    (hkv : w.kv_budget_ok = HeadShapeOK m e r) :
    waste_ok_decomposition w = false


DERIVED: Definition named 'symmetric_fast_path_valid' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Definition symmetric_fast_path_valid (cfg : FastPathConfig) : bool :=
  use_symmetric_mac cfg && fast_path_ok cfg.

def symmetric_fast_path_valid (cfg : FastPathConfig) : Bool


DERIVED: Theorem named 'symmetric_mac_fast_path_constraint' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Theorem symmetric_mac_fast_path_constraint : forall (cfg : FastPathConfig),
  use_symmetric_mac cfg = false ->
  symmetric_fast_path_valid cfg = false.

theorem symmetric_mac_fast_path_constraint (cfg : FastPathConfig)
    (h : cfg.use_symmetric_mac = false) :
    symmetric_fast_path_valid cfg = false


DERIVED: Lemma named 'nvlink_deadlock_detected' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Lemma nvlink_deadlock_detected : forall (zero_sm alloc_vram : bool),
  zero_sm = true -> alloc_vram = true ->
  nvlink_waiter_safe zero_sm alloc_vram = false.

theorem nvlink_deadlock_detected (zero_sm alloc_vram : Bool)
    (hz : zero_sm = true) (ha : alloc_vram = true) :
    nvlink_waiter_safe zero_sm alloc_vram = false


DERIVED: Lemma named 'adapter_swap_fails_when_uncached_and_no_pcie' in the CubieAttentionGeometry_v7 family -- registry statement: V7 Attention Geometry

Lemma adapter_swap_fails_when_uncached_and_no_pcie :
  forall (cached pcie_ok : bool),
  cached = false -> pcie_ok = false ->
  adapter_swap_ok cached pcie_ok = false.


DERIVED: Definition named 'FACE_MASK' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition FACE_MASK : N := 511%N.        (* 0x1FF *)
Definition SOLVED_STATE : N := 18014398509481983%N. (* 2^54 - 1 *)
Definition NUM_FACES : nat := 6.


DERIVED: Definition named 'SOLVED_STATE' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition SOLVED_STATE : N := 18014398509481983%N. (* 2^54 - 1 *)
Definition NUM_FACES : nat := 6.


DERIVED: Definition named 'NUM_FACES' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard


DERIVED: Definition named 'face_bits' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition face_bits (state : N) (i : nat) : N :=
  N.land (N.shiftr state (N.of_nat (i * 9))) FACE_MASK.


DERIVED: Definition named 'face_valid' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition face_valid (state : N) (i : nat) : Prop :=
  face_bits state i = FACE_MASK.


DERIVED: Definition named 'all_faces_valid' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition all_faces_valid (state : N) : Prop :=
  face_valid state 0 /\ face_valid state 1 /\ face_valid state 2 /\
  face_valid state 3 /\ face_valid state 4 /\ face_valid state 5.


DERIVED: Definition named 'face_bit' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition face_bit (b : bool) (i : nat) : N :=
  if b then N.shiftl FACE_MASK (N.of_nat (i * 9)) else 0%N.


DERIVED: Definition named 'bitboard_from_faces' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition bitboard_from_faces (f : list bool) : N :=
  match f with
  | [f0; f1; f2; f3; f4; f5] =>
      N.lor (face_bit f0 0)
    (N.lor (face_bit f1 1)
    (N.lor (face_bit f2 2)
    (N.lor (face_bit f3 3)
    (N.lor (face_bit f4 4)
           (face_bit f5 5)))))
  | _ => 0%N
  end.


DERIVED: Definition named 'solved' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition solved (state : N) : Prop :=
  N.land state SOLVED_STATE = SOLVED_STATE.


DERIVED: Definition named 'seam_bitmask' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition seam_bitmask (state : N) : N :=
  N.lor (face_bits state 0)
 (N.lor (face_bits state 1)
 (N.lor (face_bits state 2)
 (N.lor (face_bits state 3)
 (N.lor (face_bits state 4)
        (face_bits state 5))))).


DERIVED: Theorem named 'CUB_0832_bitboard_solved_iff_all_faces' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0832_bitboard_solved_iff_all_faces :
  forall f0 f1 f2 f3 f4 f5 : bool,
    bitboard_from_faces [f0; f1; f2; f3; f4; f5] = SOLVED_STATE <->
    (f0 = true /\ f1 = true /\ f2 = true /\
     f3 = true /\ f4 = true /\ f5 = true).


DERIVED: Theorem named 'CUB_0833_face_valid_iff_window_full' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0833_face_valid_iff_window_full :
  forall (state : N) (i : nat),
    i < 6 ->
    (face_valid state i <-> face_bits state i = FACE_MASK).


DERIVED: Theorem named 'CUB_0834_seam_full_implies_all_valid' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0834_seam_full_implies_all_valid :
  forall (state : N),
    seam_bitmask state = FACE_MASK ->
    all_faces_valid state.


DERIVED: Definition named 'vertex_valid' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition vertex_valid (state : N) (fa fb fc : nat) : Prop :=
  face_valid state fa /\ face_valid state fb /\ face_valid state fc.


DERIVED: Theorem named 'CUB_0835_vertex_implies_triple_face' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0835_vertex_implies_triple_face :
  forall (state : N) (fa fb fc : nat),
    fa < 6 -> fb < 6 -> fc < 6 ->
    vertex_valid state fa fb fc ->
    face_valid state fa /\ face_valid state fb /\ face_valid state fc.


DERIVED: Definition named 'bool_to_nat' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition bool_to_nat (b : bool) : nat := if b then 1 else 0.


DERIVED: Definition named 'face_valid_b' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition face_valid_b (state : N) (i : nat) : bool :=
  N.eqb (face_bits state i) FACE_MASK.


DERIVED: Definition named 'count_passing_dimensions' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Definition count_passing_dimensions (state : N) : nat :=
  bool_to_nat (face_valid_b state 0) +
  bool_to_nat (face_valid_b state 1) +
  bool_to_nat (face_valid_b state 2) +
  bool_to_nat (face_valid_b state 3) +
  bool_to_nat (face_valid_b state 4) +
  bool_to_nat (face_valid_b state 5).


DERIVED: Theorem named 'CUB_0836_popcount_equals_passing_dims' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0836_popcount_equals_passing_dims :
  forall (state : N),
    popcount (N.land state SOLVED_STATE) = 9 * count_passing_dimensions state.


DERIVED: Theorem named 'CUB_0837_subset_popcount_monotone' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0837_subset_popcount_monotone :
  forall (s1 s2 : N),
    N.land s1 s2 = s1 ->
    popcount s1 <= popcount s2.


DERIVED: Theorem named 'CUB_0838_all_false_gives_zero' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0838_all_false_gives_zero :
  bitboard_from_faces [false; false; false; false; false; false] = 0%N.


DERIVED: Theorem named 'CUB_0839_not_solved_has_invalid_face' in the CubieBitboardV2_5 family -- registry statement: V2.5 Bitboard

Theorem CUB_0839_not_solved_has_invalid_face :
  forall (state : N),
    ~ solved state ->
    ~ face_valid state 0 \/ ~ face_valid state 1 \/ ~ face_valid state 2 \/
    ~ face_valid state 3 \/ ~ face_valid state 4 \/ ~ face_valid state 5.


DERIVED: Definition named 'bloom_m' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Definition bloom_m : nat := 512 * 1024.  (* bits: 64KB *)
Definition bloom_k : nat := 3.       (* hash functions *)
Definition bloom_n_max : nat := 50 * 1000.


DERIVED: Definition named 'bloom_k' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Definition bloom_k : nat := 3.       (* hash functions *)
Definition bloom_n_max : nat := 50 * 1000.


DERIVED: Definition named 'bloom_n_max' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Definition bloom_n_max : nat := 50 * 1000.


DERIVED: Definition named 'bloom_is_readonly' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Definition bloom_is_readonly : Prop := True.


DERIVED: Theorem named 'CUB_0848_coverage_invariant' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Theorem CUB_0848_coverage_invariant :
  bloom_n_max * bloom_k <= bloom_m.


DERIVED: Theorem named 'CUB_0849_inserted_implies_probe' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Theorem CUB_0849_inserted_implies_probe :
  forall (nonce : nat), inserted nonce -> bloom_probe nonce.


DERIVED: Theorem named 'CUB_0850_zero_nonce_always_present' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease


DERIVED: Theorem named 'CUB_0851_bloom_probe_readonly' in the CubieBloomLeaseV2_5 family -- registry statement: V2.5 Bloom Lease

Theorem CUB_0851_bloom_probe_readonly :
  bloom_is_readonly.


DERIVED: Definition named 'CornerK' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition CornerK (c : RackCorner) : bool :=
Definition WriteOK (c : RackCorner) (policyOK : bool) : bool :=
(* 2. TWO-CORNER PROJECTION (per Cubie diagram 04) *)
Definition gpu_seam (s : ToRSeam) : bool :=
Definition deployment_seam (s : ToRSeam) : bool :=
Definition gpu_corner (c : RackCorner) : bool :=
Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.


DERIVED: Definition named 'WriteOK' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition WriteOK (c : RackCorner) (policyOK : bool) : bool :=
(* 2. TWO-CORNER PROJECTION (per Cubie diagram 04) *)
Definition gpu_seam (s : ToRSeam) : bool :=
Definition deployment_seam (s : ToRSeam) : bool :=
Definition gpu_corner (c : RackCorner) : bool :=
Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.

def WriteOK (c : RackCorner) (policyOK : Bool) : Bool


DERIVED: Definition named 'gpu_seam' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition gpu_seam (s : ToRSeam) : bool :=
Definition deployment_seam (s : ToRSeam) : bool :=
Definition gpu_corner (c : RackCorner) : bool :=
Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.


DERIVED: Definition named 'deployment_seam' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition deployment_seam (s : ToRSeam) : bool :=
Definition gpu_corner (c : RackCorner) : bool :=
Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.

def deployment_seam (s : ToRSeam) : Bool


DERIVED: Definition named 'gpu_corner' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition gpu_corner (c : RackCorner) : bool :=
Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.


DERIVED: Definition named 'deployment_corner' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition deployment_corner (c : RackCorner) : bool :=
Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.

def deployment_corner (c : RackCorner) : Bool


DERIVED: Definition named 'topology' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition topology (c : RackCorner) : bool :=
(* 3. SEAM-LEVEL KEYSTONE (T0) *)
Lemma J_decomposes : forall s : ToRSeam,
Proof.


DERIVED: Lemma named 'J_decomposes' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Lemma J_decomposes : forall s : ToRSeam,
Proof.

theorem J_decomposes (s : ToRSeam) :
cases s.id_ok <;> cases s.attest_ok <;> cases s.prov_ok <;> cases s.time_ok <;>
cases s.lin_ok <;> cases s.scope_ok <;> cases s.waste_ok <;> rfl
-- ==============================================================================
-- 4. CORNER-LEVEL KEYSTONE (T1, UNIFICATION MAP THEOREM 1)
-- ==============================================================================
theorem admit_decomposition (c : RackCorner) (policyOK : Bool) :
cases gpu_seam c.s1 <;> cases deployment_seam c.s1 <;>
cases gpu_seam c.s2 <;> cases deployment_seam c.s2 <;>
cases gpu_seam c.s3 <;> cases deployment_seam c.s3 <;>
cases (c.s1.nonce != c.s2.nonce) <;> cases (c.s2.nonce != c.s3.nonce) <;>
cases (c.s1.nonce != c.s3.nonce) <;>
cases (c.s1.target_id == c.target_node) <;>
-/


DERIVED: Theorem named 'admit_decomposition' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Theorem admit_decomposition : forall (c : RackCorner) (policyOK : bool),
Proof.

theorem admit_decomposition (c : RackCorner) (policyOK : Bool) :
cases gpu_seam c.s1 <;> cases deployment_seam c.s1 <;>
cases gpu_seam c.s2 <;> cases deployment_seam c.s2 <;>
cases gpu_seam c.s3 <;> cases deployment_seam c.s3 <;>
cases (c.s1.nonce != c.s2.nonce) <;> cases (c.s2.nonce != c.s3.nonce) <;>
cases (c.s1.nonce != c.s3.nonce) <;>
cases (c.s1.target_id == c.target_node) <;>
-/


DERIVED: Theorem named 'gpu_failure_implies_denial' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Theorem gpu_failure_implies_denial : forall (c : RackCorner) (policyOK : bool),
Proof.


DERIVED: Theorem named 'deployment_failure_implies_denial' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Theorem deployment_failure_implies_denial : forall (c : RackCorner) (policyOK : bool),
Proof.


DERIVED: Definition named 'wit_g1' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition wit_g1 :=
{| nonce := 1; origin_id := 10; target_id := 42;
Definition wit_g2 :=
{| nonce := 2; origin_id := 20; target_id := 42;
Definition wit_g3 :=
{| nonce := 3; origin_id := 30; target_id := 42;
Definition wit_d1 :=
{| nonce := 1; origin_id := 10; target_id := 42;
Definition wit_d2 :=
*)


DERIVED: Definition named 'wit_g2' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition wit_g2 :=
{| nonce := 2; origin_id := 20; target_id := 42;
Definition wit_g3 :=
{| nonce := 3; origin_id := 30; target_id := 42;
Definition wit_d1 :=
{| nonce := 1; origin_id := 10; target_id := 42;
Definition wit_d2 :=
*)


DERIVED: Definition named 'wit_g3' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition wit_g3 :=
{| nonce := 3; origin_id := 30; target_id := 42;
Definition wit_d1 :=
{| nonce := 1; origin_id := 10; target_id := 42;
Definition wit_d2 :=
*)


DERIVED: Definition named 'wit_d1' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge

Definition wit_d1 :=
{| nonce := 1; origin_id := 10; target_id := 42;
Definition wit_d2 :=
*)


DERIVED: Definition named 'wit_d2' in the CubieBridgeV1_40 family -- registry statement: V1.40 Cubie Bridge


DERIVED: Definition named 'optimistic_capacity_decrement' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition optimistic_capacity_decrement (current cost : nat) : CapacityResult :=
  if cost <=? current then CapOk (current - cost) else DenyKvHeadBudget.


DERIVED: Theorem named 'CUB_0855_capacity_non_negative' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0855_capacity_non_negative :
  forall (current cost : nat),
    match optimistic_capacity_decrement current cost with
    | CapOk new_cap => new_cap + cost <= current + cost (* new_cap = current - cost *)
    | DenyKvHeadBudget => True
    end.


DERIVED: Theorem named 'CUB_0856_deny_on_budget_exhaustion' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0856_deny_on_budget_exhaustion :
  forall (current cost : nat),
    current < cost ->
    optimistic_capacity_decrement current cost = DenyKvHeadBudget.


DERIVED: Theorem named 'CUB_0857_decrement_deterministic' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0857_decrement_deterministic :
  forall (current cost : nat),
    optimistic_capacity_decrement current cost =
    optimistic_capacity_decrement current cost.


DERIVED: Theorem named 'CUB_0858_zero_cost_always_succeeds' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0858_zero_cost_always_succeeds :
  forall (current : nat),
    optimistic_capacity_decrement current 0 = CapOk current.


DERIVED: Definition named 'head_shape_valid' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition head_shape_valid (q_heads kv_heads : nat) : Prop :=
  kv_heads > 0 /\ q_heads > 0 /\ q_heads mod kv_heads = 0.


DERIVED: Theorem named 'CUB_0859_head_shape_valid_spec' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0859_head_shape_valid_spec :
  forall (q_heads kv_heads : nat),
    head_shape_valid q_heads kv_heads <->
    (kv_heads > 0 /\ q_heads > 0 /\ q_heads mod kv_heads = 0).


DERIVED: Definition named 'deny_head_shape_mismatch' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition deny_head_shape_mismatch (q_heads kv_heads : nat) : CapacityResult :=
  if (Nat.ltb 0 kv_heads && Nat.ltb 0 q_heads && Nat.eqb (q_heads mod kv_heads) 0)%bool
  then CapOk q_heads
  else DenyKvHeadBudget.


DERIVED: Theorem named 'CUB_0860_invalid_head_shape_produces_deny' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0860_invalid_head_shape_produces_deny :
  forall (q_heads kv_heads : nat),
    ~ head_shape_valid q_heads kv_heads ->
    deny_head_shape_mismatch q_heads kv_heads = DenyKvHeadBudget.


DERIVED: Definition named 'CACHE_LINE_BYTES' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition CACHE_LINE_BYTES : nat := 64.


DERIVED: Definition named 'NUM_BUDGET_SHARDS' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition NUM_BUDGET_SHARDS : nat := 8.


DERIVED: Theorem named 'CUB_0882_cache_line_isolation' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0882_cache_line_isolation :
  CACHE_LINE_BYTES = 64 /\
  NUM_BUDGET_SHARDS = 8 /\
  NUM_BUDGET_SHARDS * CACHE_LINE_BYTES = 512.


DERIVED: Definition named 'shard_index' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition shard_index (payload_hash : nat) : nat :=
  payload_hash mod NUM_BUDGET_SHARDS.


DERIVED: Theorem named 'CUB_0883_shard_index_in_bounds' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0883_shard_index_in_bounds :
  forall (payload_hash : nat),
    shard_index payload_hash < NUM_BUDGET_SHARDS.


DERIVED: Theorem named 'CUB_0883b_shard_index_deterministic' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0883b_shard_index_deterministic :
  forall (h : nat),
    shard_index h = shard_index h.


DERIVED: Definition named 'kv_admit_spec' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition kv_admit_spec (cost limit shard_val : nat) : nat :=
  if Nat.eqb cost 0 then 1
  else if Nat.eqb limit 0 then 1
  else if shard_val + cost <=? limit then 1
  else 0.


DERIVED: Theorem named 'CUB_0885_zero_cost_bypass' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0885_zero_cost_bypass :
  forall (limit shard_val : nat),
    kv_admit_spec 0 limit shard_val = 1.


DERIVED: Theorem named 'CUB_0887_zero_limit_bypass' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0887_zero_limit_bypass :
  forall (cost shard_val : nat),
    kv_admit_spec cost 0 shard_val = 1.


DERIVED: Theorem named 'CUB_0886_budget_exhaustion_denies' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0886_budget_exhaustion_denies :
  forall (cost limit shard_val : nat),
    cost > 0 ->
    limit > 0 ->
    shard_val + cost > limit ->
    kv_admit_spec cost limit shard_val = 0.


DERIVED: Theorem named 'CUB_0884_rollback_restores_budget' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0884_rollback_restores_budget :
  forall (prev cost : nat),
    (prev + cost) - cost = prev.


DERIVED: Definition named 'is_bit' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition is_bit (b : nat) : Prop := b = 0 \/ b = 1.


DERIVED: Definition named 'bloom_probe_spec' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Definition bloom_probe_spec (b1 b2 b3 : nat) : nat := b1 * b2 * b3.


DERIVED: Theorem named 'CUB_0884b_bloom_all_set_iff' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0884b_bloom_all_set_iff :
  forall (b1 b2 b3 : nat),
    is_bit b1 -> is_bit b2 -> is_bit b3 ->
    bloom_probe_spec b1 b2 b3 = 1 <-> (b1 = 1 /\ b2 = 1 /\ b3 = 1).


DERIVED: Theorem named 'CUB_0884c_any_clear_bit_blocks' in the CubieCapacityV2_5 family -- registry statement: V2.5 Capacity

Theorem CUB_0884c_any_clear_bit_blocks :
  forall (b1 b2 b3 : nat),
    is_bit b1 -> is_bit b2 -> is_bit b3 ->
    (b1 = 0 \/ b2 = 0 \/ b3 = 0) ->
    bloom_probe_spec b1 b2 b3 = 0.


DERIVED: Definition named 'depth_access_granted' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition depth_access_granted (ctx : ConsentContext) : bool :=
  Nat.leb (current_depth ctx) (delegation_depth ctx).


DERIVED: Definition named 'bloom_ok' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition bloom_ok (ctx : ConsentContext) : bool :=
  lease_nonce_inserted ctx.


DERIVED: Definition named 'consent_ok' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition consent_ok (ctx : ConsentContext) : bool :=
  depth_access_granted ctx.


DERIVED: Definition named 'ledger_ok' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition ledger_ok (ctx : ConsentContext) : bool :=
  bloom_ok ctx.


DERIVED: Definition named 'consent_and_ledger' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition consent_and_ledger (ctx : ConsentContext) : bool :=
  consent_ok ctx && ledger_ok ctx.


DERIVED: Definition named 'ct_mask' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition ct_mask (b : bool) : nat :=
  if b then 1 else 0.


DERIVED: Definition named 'consent_mask' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Definition consent_mask (ctx : ConsentContext) : nat :=
  ct_mask (consent_and_ledger ctx).


DERIVED: Theorem named 'depth_bound_v2_5' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem depth_bound_v2_5 :
  forall ctx,
    depth_access_granted ctx = true <-> current_depth ctx <= delegation_depth ctx.

theorem depth_bound_v2_5 :
    ∀ (ctx : ConsentContext),
      depthAccessGranted ctx = true ↔ ctx.currentDepth ≤ ctx.delegationDepth


DERIVED: Theorem named 'depth_denied_when_exceeded' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem depth_denied_when_exceeded :
  forall ctx,
    delegation_depth ctx < current_depth ctx ->
    depth_access_granted ctx = false.

theorem depth_denied_when_exceeded :
    ∀ (ctx : ConsentContext),
      ctx.delegationDepth < ctx.currentDepth →
      depthAccessGranted ctx = false


DERIVED: Theorem named 'consent_ledger_conj_v2_5' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem consent_ledger_conj_v2_5 :
  forall ctx,
    consent_and_ledger ctx = true
    <-> (consent_ok ctx = true /\ ledger_ok ctx = true).

theorem consent_ledger_conj_v2_5 :
    ∀ (ctx : ConsentContext),
      consentAndLedger ctx = true ↔
      (consentOk ctx = true ∧ ledgerOk ctx = true)


DERIVED: Theorem named 'consent_ledger_fail_on_consent' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem consent_ledger_fail_on_consent :
  forall ctx,
    consent_ok ctx = false -> consent_and_ledger ctx = false.

theorem consent_ledger_fail_on_consent :
    ∀ (ctx : ConsentContext),
      consentOk ctx = false → consentAndLedger ctx = false


DERIVED: Theorem named 'consent_ledger_fail_on_ledger' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem consent_ledger_fail_on_ledger :
  forall ctx,
    ledger_ok ctx = false -> consent_and_ledger ctx = false.

theorem consent_ledger_fail_on_ledger :
    ∀ (ctx : ConsentContext),
      ledgerOk ctx = false → consentAndLedger ctx = false


DERIVED: Theorem named 'ct_consent_mask_range' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem ct_consent_mask_range :
  forall ctx, consent_mask ctx = 0 \/ consent_mask ctx = 1.

theorem ct_consent_mask_range :
    ∀ (ctx : ConsentContext),
      consentMask ctx = 0 ∨ consentMask ctx = 1


DERIVED: Theorem named 'ct_consent_mask_iff' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem ct_consent_mask_iff :
  forall ctx,
    consent_mask ctx = 1 <-> consent_and_ledger ctx = true.

theorem ct_consent_mask_iff :
    ∀ (ctx : ConsentContext),
      consentMask ctx = 1 ↔ consentAndLedger ctx = true


DERIVED: Theorem named 'ct_consent_mask_zero_iff' in the CubieConsentBridgeV2_5 family -- registry statement: V2.5 Consent Bridge

Theorem ct_consent_mask_zero_iff :
  forall ctx,
    consent_mask ctx = 0 <-> consent_and_ledger ctx = false.

theorem ct_consent_mask_zero_iff :
    ∀ (ctx : ConsentContext),
      consentMask ctx = 0 ↔ consentAndLedger ctx = false


DERIVED: Definition named 'depth_access_granted' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Definition depth_access_granted (current_depth delegation_depth : nat) : Prop :=
  current_depth <= delegation_depth.


DERIVED: Theorem named 'CUB_0852_depth_access_iff_bound' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Theorem CUB_0852_depth_access_iff_bound :
  forall (current_depth delegation_depth : nat),
    depth_access_granted current_depth delegation_depth <->
    current_depth <= delegation_depth.


DERIVED: Definition named 'v25_consent_gate' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Definition v25_consent_gate
    (consent_ok ledger_ok depth_bounded bloom_probed : bool) : Prop :=
  (consent_ok && ledger_ok)%bool = (depth_bounded && bloom_probed)%bool.


DERIVED: Theorem named 'CUB_0853_consent_gate_equivalence' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Theorem CUB_0853_consent_gate_equivalence :
  forall (consent_ok ledger_ok depth_bounded bloom_probed : bool),
    v25_consent_gate consent_ok ledger_ok depth_bounded bloom_probed ->
    (consent_ok && ledger_ok)%bool = (depth_bounded && bloom_probed)%bool.


DERIVED: Definition named 'consent_mask_valid' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Definition consent_mask_valid (mask : nat) (consent_ok ledger_ok : bool) : Prop :=
  (mask = 0 \/ mask = 1) /\
  (mask = 1 <-> (consent_ok && ledger_ok)%bool = true).


DERIVED: Theorem named 'CUB_0854_consent_mask_encoding' in the CubieConsentV2_5 family -- registry statement: V2.5 Consent Hierarchy

Theorem CUB_0854_consent_mask_encoding :
  forall (mask : nat) (consent_ok ledger_ok : bool),
    consent_mask_valid mask consent_ok ledger_ok ->
    (mask = 0 \/ mask = 1) /\
    (mask = 1 <-> (consent_ok && ledger_ok)%bool = true).


DERIVED: Definition named 'bool_to_mask' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition bool_to_mask (b : bool) : nat :=
  if b then 1 else 0.


DERIVED: Definition named 'mask_and' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition mask_and (a b : nat) : nat :=
  if (Nat.eqb a 1) && (Nat.eqb b 1) then 1 else 0.


DERIVED: Definition named 'bool_gpu_corner' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition bool_gpu_corner (who what how : bool) : bool :=
  who && what && how.


DERIVED: Definition named 'bool_deploy_corner' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition bool_deploy_corner (whr whn why : bool) : bool :=
  whr && whn && why.


DERIVED: Definition named 'mask_gpu_corner' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition mask_gpu_corner (who what how : bool) : nat :=
  mask_and (mask_and (bool_to_mask who) (bool_to_mask what)) (bool_to_mask how).


DERIVED: Definition named 'mask_deploy_corner' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Definition mask_deploy_corner (whr whn why : bool) : nat :=
  mask_and (mask_and (bool_to_mask whr) (bool_to_mask whn)) (bool_to_mask why).


DERIVED: Theorem named 'mask_range' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem mask_range :
  forall (b : bool), bool_to_mask b = 0 \/ bool_to_mask b = 1.

theorem mask_range (b : Bool) : boolToMask b = 0 ∨ boolToMask b = 1


DERIVED: Theorem named 'mask_and_isomorphism' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem mask_and_isomorphism :
  forall (a b : bool),
  Nat.eqb (mask_and (bool_to_mask a) (bool_to_mask b)) 1 = (a && b).

theorem mask_and_isomorphism (a b : Bool) :
    (maskAnd (boolToMask a) (boolToMask b) == 1) = (a && b)


DERIVED: Theorem named 'gpu_corner_isomorphism' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem gpu_corner_isomorphism :
  forall (who what how : bool),
  Nat.eqb (mask_gpu_corner who what how) 1 = bool_gpu_corner who what how.

theorem gpu_corner_isomorphism (who what how : Bool) :
    (maskGpuCorner who what how == 1) = boolGpuCorner who what how


DERIVED: Theorem named 'deploy_corner_isomorphism' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem deploy_corner_isomorphism :
  forall (whr whn why : bool),
  Nat.eqb (mask_deploy_corner whr whn why) 1 = bool_deploy_corner whr whn why.

theorem deploy_corner_isomorphism (whr whn why : Bool) :
    (maskDeployCorner whr whn why == 1) = boolDeployCorner whr whn why


DERIVED: Theorem named 'single_false_denies_gpu' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem single_false_denies_gpu :
  forall (who what how : bool),
  (who = false \/ what = false \/ how = false) ->
  mask_gpu_corner who what how = 0.

theorem single_false_denies_gpu (who what how : Bool)
    (h : ¬who ∨ ¬what ∨ ¬how) :
    maskGpuCorner who what how = 0


DERIVED: Theorem named 'all_true_allows' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem all_true_allows :
  mask_gpu_corner true true true = 1.

theorem all_true_allows :
    maskGpuCorner true true true = 1


DERIVED: Theorem named 'mask_and_commutative' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem mask_and_commutative :
  forall (a b : bool),
  mask_and (bool_to_mask a) (bool_to_mask b) =
  mask_and (bool_to_mask b) (bool_to_mask a).

theorem mask_and_commutative (a b : Nat) :
    maskAnd a b = maskAnd b a


DERIVED: Theorem named 'mask_and_associative' in the CubieConstantTime family -- registry statement: Constant-Time Ops

Theorem mask_and_associative :
  forall (a b c : bool),
  mask_and (mask_and (bool_to_mask a) (bool_to_mask b)) (bool_to_mask c) =
  mask_and (bool_to_mask a) (mask_and (bool_to_mask b) (bool_to_mask c)).


DERIVED: Definition named 'permission_attenuation' in the CubieDelegationRecursion_v6 family -- registry statement: V6 Delegation Recursion

Definition permission_attenuation (parent child : PermBudget) : bool :=
  Nat.eqb (Nat.land (perm_scope child) (perm_scope parent)) (perm_scope child) &&
  Nat.leb (perm_ttl   child) (perm_ttl   parent) &&
  Nat.eqb (perm_depth child) (perm_depth parent + 1).

def permission_attenuation (parent child : PermBudget) : Bool


DERIVED: Theorem named 'subagent_containment' in the CubieDelegationRecursion_v6 family -- registry statement: V6 Delegation Recursion

Theorem subagent_containment : forall (parent child : PermBudget),
  permission_attenuation parent child = true ->
  Nat.land (perm_scope child) (perm_scope parent) = perm_scope child.

theorem subagent_containment (parent child : PermBudget)
    (h : permission_attenuation parent child = true) :
    Nat.land child.perm_scope parent.perm_scope = child.perm_scope


DERIVED: Lemma named 'subagent_ttl_containment' in the CubieDelegationRecursion_v6 family -- registry statement: V6 Delegation Recursion

Lemma subagent_ttl_containment : forall (parent child : PermBudget),
  permission_attenuation parent child = true ->
  perm_ttl child <= perm_ttl parent.

theorem subagent_ttl_containment (parent child : PermBudget)
    (h : permission_attenuation parent child = true) :
    child.perm_ttl ≤ parent.perm_ttl


DERIVED: Lemma named 'subagent_depth_increment' in the CubieDelegationRecursion_v6 family -- registry statement: V6 Delegation Recursion

Lemma subagent_depth_increment : forall (parent child : PermBudget),
  permission_attenuation parent child = true ->
  perm_depth child = perm_depth parent + 1.

theorem subagent_depth_increment (parent child : PermBudget)
    (h : permission_attenuation parent child = true) :
    child.perm_depth = parent.perm_depth + 1


DERIVED: Lemma named 'attenuation_scope_transitive' in the CubieDelegationRecursion_v6 family -- registry statement: V6 Delegation Recursion

Lemma attenuation_scope_transitive : forall (a b c : PermBudget),
  permission_attenuation a b = true ->
  permission_attenuation b c = true ->
  Nat.land (perm_scope c) (perm_scope a) = perm_scope c.

theorem attenuation_scope_transitive (a b c : PermBudget)
    (hab : permission_attenuation a b = true)
    (hbc : permission_attenuation b c = true) :
    Nat.land c.perm_scope a.perm_scope = c.perm_scope


DERIVED: Definition named 'anon_id_linked' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition anon_id_linked (dl : DualLedger) : bool :=
  Nat.eqb (anon_hash (pub_anon_id (public_entry dl)))
           (anon_hash (priv_anon_id (private_entry dl))) &&
  Nat.eqb (epoch (pub_anon_id (public_entry dl)))
           (epoch (priv_anon_id (private_entry dl))).

def anon_id_linked (dl : DualLedger) : Bool


DERIVED: Definition named 'public_hides_identity' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition public_hides_identity (dl : DualLedger) : bool :=
  negb (Nat.eqb (pub_policy_hash (public_entry dl))
                 (priv_real_id_hash (private_entry dl))).

def public_hides_identity (dl : DualLedger) : Bool


DERIVED: Definition named 'consent_valid' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition consent_valid (dl : DualLedger) : bool :=
  priv_consent_grant (private_entry dl) &&
  pub_capability (public_entry dl).

def consent_valid (dl : DualLedger) : Bool


DERIVED: Definition named 'policy_filter_active' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition policy_filter_active (dl : DualLedger) : bool :=
  pub_policy_filter (public_entry dl).

def policy_filter_active (dl : DualLedger) : Bool


DERIVED: Definition named 'dual_ledger_ok' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition dual_ledger_ok (dl : DualLedger) : bool :=
  anon_id_linked dl &&
  public_hides_identity dl &&
  consent_valid dl.

def dual_ledger_ok (dl : DualLedger) : Bool


DERIVED: Theorem named 'dual_ledger_non_disclosure' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem dual_ledger_non_disclosure :
  forall (dl : DualLedger),
  dual_ledger_ok dl = true ->
  public_hides_identity dl = true.

theorem dual_ledger_non_disclosure (dl : DualLedger)
  (h : dual_ledger_ok dl = true) :
    public_hides_identity dl = true


DERIVED: Theorem named 'anon_linkage_preserved' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem anon_linkage_preserved :
  forall (dl : DualLedger),
  dual_ledger_ok dl = true ->
  anon_id_linked dl = true.

theorem anon_linkage_preserved (dl : DualLedger)
  (h : dual_ledger_ok dl = true) :
    anon_id_linked dl = true


DERIVED: Theorem named 'no_consent_no_access' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem no_consent_no_access :
  forall (dl : DualLedger),
  priv_consent_grant (private_entry dl) = false ->
  dual_ledger_ok dl = false.

theorem no_consent_no_access (dl : DualLedger)
    (h : dl.private_entry.priv_consent_grant = false) :
    dual_ledger_ok dl = false


DERIVED: Theorem named 'no_capability_no_access' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem no_capability_no_access :
  forall (dl : DualLedger),
  pub_capability (public_entry dl) = false ->
  dual_ledger_ok dl = false.

theorem no_capability_no_access (dl : DualLedger)
    (h : dl.public_entry.pub_capability = false) :
    dual_ledger_ok dl = false


DERIVED: Theorem named 'policy_filter_independent_of_consent' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem policy_filter_independent_of_consent :
  forall (dl : DualLedger),
  policy_filter_active dl = true ->
  dual_ledger_ok dl = false ->
  policy_filter_active dl = true.

theorem policy_filter_independent_of_consent (dl : DualLedger)
    (hf : policy_filter_active dl = true)
    (_ : dual_ledger_ok dl = false) :
    policy_filter_active dl = true


DERIVED: Theorem named 'identity_collision_detection' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem identity_collision_detection :
  forall (dl1 dl2 : DualLedger),
  anon_hash (pub_anon_id (public_entry dl1)) =
  anon_hash (pub_anon_id (public_entry dl2)) ->
  priv_real_id_hash (private_entry dl1) <>
  priv_real_id_hash (private_entry dl2) ->
  dual_ledger_ok dl1 = true ->
  dual_ledger_ok dl2 = true ->
  anon_hash (pub_anon_id (public_entry dl1)) =
  anon_hash (pub_anon_id (public_entry dl2)).

theorem identity_collision_detection (dl1 dl2 : DualLedger)
    (hsame : dl1.public_entry.pub_anon_id.anon_hash =
             dl2.public_entry.pub_anon_id.anon_hash)
    (_ : dl1.private_entry.priv_real_id_hash ≠
         dl2.private_entry.priv_real_id_hash)
    (_ : dual_ledger_ok dl1 = true)
    (_ : dual_ledger_ok dl2 = true) :
    dl1.public_entry.pub_anon_id.anon_hash =
    dl2.public_entry.pub_anon_id.anon_hash


DERIVED: Theorem named 'epoch_mismatch_breaks_linkage' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem epoch_mismatch_breaks_linkage :
  forall (dl : DualLedger),
  epoch (pub_anon_id (public_entry dl)) <>
  epoch (priv_anon_id (private_entry dl)) ->
  anon_id_linked dl = false.

theorem epoch_mismatch_breaks_linkage (dl : DualLedger)
    (h : dl.public_entry.pub_anon_id.epoch ≠
         dl.private_entry.priv_anon_id.epoch) :
    anon_id_linked dl = false


DERIVED: Definition named 'anon_billing_id_spec' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition anon_billing_id_spec (anon_hash epoch : nat) : nat :=
  anon_hash + epoch.


DERIVED: Definition named 'billing_cost_ok' in the CubieDualLedger family -- registry statement: Dual Ledger

Definition billing_cost_ok (br : BillingRecord) (deducted : nat) : Prop :=
  if br_outcome br then budget_cost br = deducted
  else budget_cost br = 0.


DERIVED: Theorem named 'billing_only_on_allow' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem billing_only_on_allow :
  forall (dl : DualLedger) (cost : nat),
  cost > 0 ->
  billing_cost_ok
    (mkBillingRecord (anon_billing_id_spec
                        (anon_hash (pub_anon_id (public_entry dl)))
                        (epoch (pub_anon_id (public_entry dl))))
                     cost
                     (epoch (pub_anon_id (public_entry dl)))
                     true)
    cost.


DERIVED: Theorem named 'billing_cost_matches_deducted' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem billing_cost_matches_deducted :
  forall (br : BillingRecord) (deducted : nat),
  br_outcome br = true ->
  budget_cost br = deducted ->
  billing_cost_ok br deducted.


DERIVED: Theorem named 'consent_log_requires_fresh_epoch' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem consent_log_requires_fresh_epoch :
  forall (dl : DualLedger) (wh : nat),
  epoch (priv_anon_id (private_entry dl)) <> 0 ->
  exists (e : ConsentLogEntry),
    cle_epoch e = epoch (priv_anon_id (private_entry dl)) /\
    workload_hash e = wh.


DERIVED: Theorem named 'anon_billing_id_deterministic' in the CubieDualLedger family -- registry statement: Dual Ledger

Theorem anon_billing_id_deterministic :
  forall (h1 h2 e1 e2 : nat),
  h1 = h2 -> e1 = e2 ->
  anon_billing_id_spec h1 e1 = anon_billing_id_spec h2 e2.


DERIVED: Definition named 'IOPMP_ADDR0' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition IOPMP_ADDR0       : nat := 0x40030000.


DERIVED: Definition named 'IOPMP_CFG0' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition IOPMP_CFG0        : nat := 0x40030004.


DERIVED: Definition named 'MTIME_REG' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition MTIME_REG         : nat := 0x0200BFF8.


DERIVED: Definition named 'EPOCH_QUANT_TICKS' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition EPOCH_QUANT_TICKS : nat := 164.


DERIVED: Definition named 'DMA_MAILBOX_BASE' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition DMA_MAILBOX_BASE  : nat := 0x08000000.


DERIVED: Definition named 'DMA_MAILBOX_SIZE' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition DMA_MAILBOX_SIZE  : nat := 64.


DERIVED: Definition named 'after_secure_entry' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition after_secure_entry (_ : PipelineState) : PipelineState :=
  mkPipeline true true true.

def after_secure_entry (_ : PipelineState) : PipelineState


DERIVED: Theorem named 'cub_0899_enclave_icache_flush_before_entry' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem cub_0899_enclave_icache_flush_before_entry :
  forall (pre : PipelineState),
    icache_flushed (after_secure_entry pre) = true.

theorem cub_0899_enclave_icache_flush_before_entry (pre : PipelineState) :
    (after_secure_entry pre).icache_flushed = true


DERIVED: Theorem named 'cub_0900_enclave_btb_cleared_before_entry' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem cub_0900_enclave_btb_cleared_before_entry :
  forall (pre : PipelineState),
    btb_cleared (after_secure_entry pre) = true.

theorem cub_0900_enclave_btb_cleared_before_entry (pre : PipelineState) :
    (after_secure_entry pre).btb_cleared = true


DERIVED: Definition named 'canonical_iopmp' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition canonical_iopmp : IopmpConfig :=
  mkIopmp true DMA_MAILBOX_BASE DMA_MAILBOX_SIZE.


DERIVED: Definition named 'dma_access_permitted' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition dma_access_permitted (cfg : IopmpConfig) (addr sz : nat) : bool :=
  if enabled cfg
  then andb (Nat.leb (mailbox_base cfg) addr)
            (Nat.leb (addr + sz) (mailbox_base cfg + mailbox_size cfg))
  else true.

def dma_access_permitted (cfg : IopmpConfig) (addr sz : Nat) : Bool


DERIVED: Theorem named 'cub_0901_enclave_iopmp_dma_restricted' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem cub_0901_enclave_iopmp_dma_restricted :
  forall (addr sz : nat),
    (* DMA target starts before mailbox — overflow scenario *)
    addr + sz > DMA_MAILBOX_BASE + DMA_MAILBOX_SIZE ->
    dma_access_permitted canonical_iopmp addr sz = false.

theorem cub_0901_enclave_iopmp_dma_restricted (addr sz : Nat)
    (h : addr + sz > DMA_MAILBOX_BASE + DMA_MAILBOX_SIZE) :
    dma_access_permitted canonical_iopmp addr sz = false


DERIVED: Theorem named 'iopmp_mailbox_access_permitted' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem iopmp_mailbox_access_permitted :
  forall (addr sz : nat),
    addr >= DMA_MAILBOX_BASE ->
    addr + sz <= DMA_MAILBOX_BASE + DMA_MAILBOX_SIZE ->
    sz > 0 ->
    dma_access_permitted canonical_iopmp addr sz = true.

theorem iopmp_mailbox_access_permitted (addr sz : Nat)
    (h1 : addr ≥ DMA_MAILBOX_BASE)
    (h2 : addr + sz ≤ DMA_MAILBOX_BASE + DMA_MAILBOX_SIZE) :
    dma_access_permitted canonical_iopmp addr sz = true


DERIVED: Definition named 'quantized_epoch' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition quantized_epoch (mtime_ticks : nat) : nat :=
  mtime_ticks / EPOCH_QUANT_TICKS.

def quantized_epoch (mtime_ticks : Nat) : Nat


DERIVED: Definition named 'epochs_differ' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Definition epochs_differ (t1 t2 : nat) : bool :=
  negb (Nat.eqb (quantized_epoch t1) (quantized_epoch t2)).


DERIVED: Theorem named 'cub_0902_enclave_epoch_aad_entangles_time' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem cub_0902_enclave_epoch_aad_entangles_time :
  forall (t1 t2 : nat),
    t2 >= t1 + EPOCH_QUANT_TICKS ->
    t1 mod EPOCH_QUANT_TICKS = 0 ->
    quantized_epoch t2 > quantized_epoch t1.

theorem cub_0902_enclave_epoch_aad_entangles_time (t1 t2 : Nat)
    (h_span : t2 ≥ t1 + EPOCH_QUANT_TICKS)
    (h_boundary : t1 % EPOCH_QUANT_TICKS = 0) :
    quantized_epoch t2 > quantized_epoch t1


DERIVED: Corollary named 'epoch_aad_changes_over_window' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave


DERIVED: Theorem named 'full_entry_sequence_correct' in the CubieEnclaveV2_5 family -- registry statement: V2.5 Enclave

Theorem full_entry_sequence_correct :
  forall (pre : PipelineState),
    icache_flushed      (after_secure_entry pre) = true /\
    btb_cleared         (after_secure_entry pre) = true /\
    pipeline_serialized (after_secure_entry pre) = true.

theorem full_entry_sequence_correct (pre : PipelineState) :
    (after_secure_entry pre).icache_flushed = true ∧
    (after_secure_entry pre).btb_cleared = true ∧
    (after_secure_entry pre).pipeline_serialized = true


DERIVED: Definition named 'kv_cache_byte_estimator' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Definition kv_cache_byte_estimator
  (layers batch ctx h_kv d_head : nat) : nat :=
  4 * layers * batch * ctx * h_kv * d_head.

def kv_cache_byte_estimator
    (layers batch ctx h_kv d_head : Nat) : Nat


DERIVED: Definition named 'roofline_admission_time' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Definition roofline_admission_time (t_compute t_mem : nat) : nat :=
  Nat.max t_compute t_mem.

def roofline_admission_time (t_compute t_mem : Nat) : Nat


DERIVED: Definition named 'l_ctx_pessimistic_bound' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Definition l_ctx_pessimistic_bound (input_tokens max_output : nat) : nat :=
  input_tokens + max_output.

def l_ctx_pessimistic_bound (input_tokens max_output : Nat) : Nat


DERIVED: Lemma named 'failure_probability_bound' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Lemma failure_probability_bound :
  forall (layers1 layers2 batch ctx h_kv d_head : nat),
  layers1 <= layers2 ->
  kv_cache_byte_estimator layers1 batch ctx h_kv d_head <=
  kv_cache_byte_estimator layers2 batch ctx h_kv d_head.

theorem failure_probability_bound
    (layers1 layers2 batch ctx h_kv d_head : Nat)
    (h : layers1 ≤ layers2) :
    kv_cache_byte_estimator layers1 batch ctx h_kv d_head ≤
    kv_cache_byte_estimator layers2 batch ctx h_kv d_head


DERIVED: Lemma named 'roofline_symmetric' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Lemma roofline_symmetric : forall (t_compute t_mem : nat),
  roofline_admission_time t_compute t_mem =
  roofline_admission_time t_mem t_compute.

theorem roofline_symmetric (t_compute t_mem : Nat) :
    roofline_admission_time t_compute t_mem =
    roofline_admission_time t_mem t_compute


DERIVED: Lemma named 'pessimistic_bound_ge_input' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Lemma pessimistic_bound_ge_input : forall (input_tokens max_output : nat),
  input_tokens <= l_ctx_pessimistic_bound input_tokens max_output.

theorem pessimistic_bound_ge_input (input_tokens max_output : Nat) :
    input_tokens ≤ l_ctx_pessimistic_bound input_tokens max_output


DERIVED: Lemma named 'kv_estimator_monotone_batch' in the CubieEngineeringPhysics_v7 family -- registry statement: V7 Engineering Physics

Lemma kv_estimator_monotone_batch : forall (layers batch1 batch2 ctx h_kv d_head : nat),
  batch1 <= batch2 ->
  kv_cache_byte_estimator layers batch1 ctx h_kv d_head <=
  kv_cache_byte_estimator layers batch2 ctx h_kv d_head.

theorem kv_estimator_monotone_batch
    (layers batch1 batch2 ctx h_kv d_head : Nat)
    (h : batch1 ≤ batch2) :
    kv_cache_byte_estimator layers batch1 ctx h_kv d_head ≤
    kv_cache_byte_estimator layers batch2 ctx h_kv d_head


DERIVED: Definition named 'is_fenced_read' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Definition is_fenced_read (seq : FencedSequence) : bool :=
  andb (has_fence seq)
  (andb (Nat.ltb 0 (length (fence_before seq)))
        (Nat.ltb 0 (length (fence_after seq)))).

def is_fenced_read (seq : FencedSequence) : Bool


DERIVED: Definition named 'is_fenced_write' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Definition is_fenced_write (seq : FencedSequence) : bool :=
  andb (has_fence seq)
  (andb (Nat.ltb 0 (length (fence_before seq)))
        (Nat.ltb 0 (length (fence_after seq)))).

def is_fenced_write (seq : FencedSequence) : Bool


DERIVED: Theorem named 'cub_0892_fence_before_mmio_read' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Theorem cub_0892_fence_before_mmio_read :
  forall (seq : FencedSequence),
    is_fenced_read seq = true ->
    has_fence seq = true /\
    0 < length (fence_before seq).

theorem cub_0892_fence_before_mmio_read (seq : FencedSequence)
    (h : is_fenced_read seq = true) :
    seq.has_fence = true ∧ 0 < seq.fence_before.length


DERIVED: Theorem named 'cub_0893_fence_after_mmio_write' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Theorem cub_0893_fence_after_mmio_write :
  forall (seq : FencedSequence),
    is_fenced_write seq = true ->
    has_fence seq = true /\
    0 < length (fence_after seq).

theorem cub_0893_fence_after_mmio_write (seq : FencedSequence)
    (h : is_fenced_write seq = true) :
    seq.has_fence = true ∧ 0 < seq.fence_after.length


DERIVED: Definition named 'globally_precedes' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Definition globally_precedes
    (op_a_before : bool)
    (op_b_after  : bool)
    (has_fence   : bool) : bool :=
  implb has_fence (andb op_a_before op_b_after).

def globally_precedes (op_a_before op_b_after has_fence : Bool) : Bool


DERIVED: Theorem named 'cub_0894_fence_rvwmo_ordering' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Theorem cub_0894_fence_rvwmo_ordering :
  forall (op_a_before op_b_after has_fence : bool),
    has_fence = true ->
    op_a_before = true ->
    op_b_after  = true ->
    globally_precedes op_a_before op_b_after has_fence = true.

theorem cub_0894_fence_rvwmo_ordering
    (op_a_before op_b_after has_fence : Bool)
    (h_fence  : has_fence = true)
    (h_before : op_a_before = true)
    (h_after  : op_b_after = true) :
    globally_precedes op_a_before op_b_after has_fence = true


DERIVED: Definition named 'fenced_scrub_correct' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Definition fenced_scrub_correct (all_zeroed : bool) (has_fence : bool) : bool :=
  andb all_zeroed has_fence.

def fenced_scrub_correct (all_zeroed has_fence : Bool) : Bool


DERIVED: Theorem named 'fenced_scrub_implies_ordered_zero' in the CubieFenceV2_5 family -- registry statement: V2.5 Fence

Theorem fenced_scrub_implies_ordered_zero :
  forall (all_zeroed has_fence : bool),
    has_fence  = true ->
    all_zeroed = true ->
    fenced_scrub_correct all_zeroed has_fence = true.

theorem fenced_scrub_implies_ordered_zero (all_zeroed has_fence : Bool)
    (h_fence  : has_fence = true)
    (h_zeroed : all_zeroed = true) :
    fenced_scrub_correct all_zeroed has_fence = true


DERIVED: Definition named 'AUTH_PASS' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition AUTH_PASS : N := 1515870810%N.  (* 0x5A5A5A5A *)
Definition AUTH_FAIL : N := 2779096485%N.  (* 0xA5A5A5A5 *)

Definition magic_word_valid (w : N) : bool :=
  N.eqb w AUTH_PASS || N.eqb w AUTH_FAIL.


DERIVED: Definition named 'AUTH_FAIL' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition AUTH_FAIL : N := 2779096485%N.  (* 0xA5A5A5A5 *)

Definition magic_word_valid (w : N) : bool :=
  N.eqb w AUTH_PASS || N.eqb w AUTH_FAIL.


DERIVED: Definition named 'magic_word_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition magic_word_valid (w : N) : bool :=
  N.eqb w AUTH_PASS || N.eqb w AUTH_FAIL.


DERIVED: Theorem named 'magic_words_distinct' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem magic_words_distinct :
  AUTH_PASS <> AUTH_FAIL.

theorem magic_words_distinct : AUTH_PASS ≠ AUTH_FAIL


DERIVED: Theorem named 'magic_word_exhaustive' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem magic_word_exhaustive :
  forall (w : N),
  magic_word_valid w = true ->
  w = AUTH_PASS \/ w = AUTH_FAIL.

theorem magic_word_exhaustive (w : UInt32) (h : magicWordValid w = true) :
    w = AUTH_PASS ∨ w = AUTH_FAIL


DERIVED: Definition named 'temporally_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition temporally_valid (current_cycle expiry_cycle : nat) : bool :=
  Nat.eqb expiry_cycle 0 || Nat.leb current_cycle expiry_cycle.


DERIVED: Definition named 'token_expired' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition token_expired (current_cycle expiry_cycle : nat) : bool :=
  negb (Nat.eqb expiry_cycle 0) && negb (Nat.leb current_cycle expiry_cycle).


DERIVED: Theorem named 'zero_expiry_always_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem zero_expiry_always_valid :
  forall (current : nat),
  temporally_valid current 0 = true.

theorem zero_expiry_always_valid (current : Nat) :
    temporallyValid current 0 = true


DERIVED: Theorem named 'expired_token_denied' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem expired_token_denied :
  forall (current expiry : nat),
  expiry > 0 -> current > expiry ->
  token_expired current expiry = true.

theorem expired_token_denied (current expiry : Nat)
    (hpos : expiry > 0) (hexp : current > expiry) :
    tokenExpired current expiry = true


DERIVED: Theorem named 'monotonic_expiry' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem monotonic_expiry :
  forall (t1 t2 expiry : nat),
  t1 <= t2 ->
  token_expired t1 expiry = true ->
  token_expired t2 expiry = true.

theorem monotonic_expiry (t1 t2 expiry : Nat)
    (hle : t1 ≤ t2) (hexp : tokenExpired t1 expiry = true) :
    tokenExpired t2 expiry = true


DERIVED: Theorem named 'boundary_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem boundary_valid :
  forall (expiry : nat),
  expiry > 0 ->
  temporally_valid expiry expiry = true.

theorem boundary_valid (expiry : Nat) (hpos : expiry > 0) :
    temporallyValid expiry expiry = true


DERIVED: Definition named 'PREGATE_MAGIC' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition PREGATE_MAGIC : N := 3408625358%N. (* 0xCB1EFACE *)

Definition pregate_pass (route_magic : N) : bool :=
  N.eqb route_magic PREGATE_MAGIC.


DERIVED: Definition named 'pregate_pass' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition pregate_pass (route_magic : N) : bool :=
  N.eqb route_magic PREGATE_MAGIC.


DERIVED: Theorem named 'wrong_magic_rejected' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem wrong_magic_rejected :
  forall (rm : N),
  rm <> PREGATE_MAGIC ->
  pregate_pass rm = false.

theorem wrong_magic_rejected (rm : UInt32) (h : rm ≠ PREGATE_MAGIC) :
    pregatePass rm = false


DERIVED: Theorem named 'correct_magic_passes' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem correct_magic_passes :
  pregate_pass PREGATE_MAGIC = true.

theorem correct_magic_passes : pregatePass PREGATE_MAGIC = true


DERIVED: Definition named 'hardened_admit' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition hardened_admit (route_magic : N) (inner_pass : bool) : bool :=
  pregate_pass route_magic && inner_pass.


DERIVED: Theorem named 'pregate_fail_denies_all' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem pregate_fail_denies_all :
  forall (rm : N) (inner : bool),
  pregate_pass rm = false ->
  hardened_admit rm inner = false.

theorem pregate_fail_denies_all (rm : UInt32) (inner : Bool)
    (h : pregatePass rm = false) :
    hardenedAdmit rm inner = false


DERIVED: Definition named 'entangled_message_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Definition entangled_message_valid (efuse_len : nat) : bool :=
  Nat.eqb efuse_len 32.


DERIVED: Theorem named 'entanglement_valid' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem entanglement_valid :
  entangled_message_valid 32 = true.

theorem entanglement_valid (h : Nat) (bits : List Nat)
    (hlen : bits.length = 32) :
    entangledMessage h bits = true


DERIVED: Theorem named 'wrong_efuse_invalidates' in the CubieHardenedGate family -- registry statement: Hardened Gate

Theorem wrong_efuse_invalidates :
  forall (n : nat),
  n <> 32 -> entangled_message_valid n = false.


DERIVED: Definition named 'NIST_THEOREM_COUNT' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition NIST_THEOREM_COUNT : nat := 228.


DERIVED: Definition named 'C4_SUBGATE_COUNT' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition C4_SUBGATE_COUNT   : nat := 4.


DERIVED: Definition named 'FACES_PER_CUBE' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition FACES_PER_CUBE     : nat := 6.


DERIVED: Definition named 'CELLS_PER_FACE' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition CELLS_PER_FACE     : nat := 9.


DERIVED: Definition named 'FACE_WHO' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'FACE_WHERE' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'FACE_WHY' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'FACE_WHEN' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'FACE_WHAT' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'FACE_HOW' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4


DERIVED: Definition named 'c4_identity_gate' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition c4_identity_gate : bool :=
  andb (face_ok FACE_WHO) hmac_ok.

def c4_identity_gate (face_ok : Nat -> Bool) (hmac_ok : Bool) : Bool


DERIVED: Definition named 'c4_capability_gate' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition c4_capability_gate : bool :=
  andb (face_ok FACE_WHAT) delegation_ok.

def c4_capability_gate (face_ok : Nat -> Bool) (delegation_ok : Bool) : Bool


DERIVED: Definition named 'c4_context_gate' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition c4_context_gate : bool :=
  andb (andb (face_ok FACE_WHERE) (face_ok FACE_WHEN)) (face_ok FACE_WHY).

def c4_context_gate (face_ok : Nat -> Bool) : Bool


DERIVED: Definition named 'c4_protocol_gate' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition c4_protocol_gate : bool :=
  andb (face_ok FACE_HOW) consent_ok.

def c4_protocol_gate (face_ok : Nat -> Bool) (consent_ok : Bool) : Bool


DERIVED: Definition named 'nist_c4_authorize' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition nist_c4_authorize : bool :=
  andb (andb c4_identity_gate c4_capability_gate)
       (andb c4_context_gate c4_protocol_gate).

def nist_c4_authorize (face_ok : Nat -> Bool)
    (hmac_ok delegation_ok consent_ok : Bool) : Bool


DERIVED: Definition named 'nist_c4_attest' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Definition nist_c4_attest : NistAttestation :=
  mkNistAttestation
    nist_c4_authorize
    c4_identity_gate
    c4_capability_gate
    c4_context_gate
    c4_protocol_gate
    NIST_THEOREM_COUNT.

def nist_c4_attest (face_ok : Nat -> Bool)
    (hmac_ok delegation_ok consent_ok : Bool) : NistAttestation


DERIVED: Theorem named 'cub_0903_identity_requires_who_and_hmac' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0903_identity_requires_who_and_hmac :
  c4_identity_gate = true ->
  face_ok FACE_WHO = true /\ hmac_ok = true.

theorem cub_0903_identity_requires_who_and_hmac
    (face_ok : Nat -> Bool) (hmac_ok : Bool)
    (h : c4_identity_gate face_ok hmac_ok = true) :
    face_ok FACE_WHO = true /\ hmac_ok = true


DERIVED: Theorem named 'cub_0904_capability_requires_what_and_delegation' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0904_capability_requires_what_and_delegation :
  c4_capability_gate = true ->
  face_ok FACE_WHAT = true /\ delegation_ok = true.

theorem cub_0904_capability_requires_what_and_delegation
    (face_ok : Nat -> Bool) (delegation_ok : Bool)
    (h : c4_capability_gate face_ok delegation_ok = true) :
    face_ok FACE_WHAT = true /\ delegation_ok = true


DERIVED: Theorem named 'cub_0905_context_requires_where_when_why' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0905_context_requires_where_when_why :
  c4_context_gate = true ->
  face_ok FACE_WHERE = true /\ face_ok FACE_WHEN = true /\ face_ok FACE_WHY = true.

theorem cub_0905_context_requires_where_when_why
    (face_ok : Nat -> Bool)
    (h : c4_context_gate face_ok = true) :
    face_ok FACE_WHERE = true /\ face_ok FACE_WHEN = true /\ face_ok FACE_WHY = true


DERIVED: Theorem named 'cub_0906_protocol_requires_how_and_consent' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0906_protocol_requires_how_and_consent :
  c4_protocol_gate = true ->
  face_ok FACE_HOW = true /\ consent_ok = true.

theorem cub_0906_protocol_requires_how_and_consent
    (face_ok : Nat -> Bool) (consent_ok : Bool)
    (h : c4_protocol_gate face_ok consent_ok = true) :
    face_ok FACE_HOW = true /\ consent_ok = true


DERIVED: Theorem named 'cub_0907_composite_requires_all_subgates' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0907_composite_requires_all_subgates :
  nist_c4_authorize = true ->
  c4_identity_gate = true /\ c4_capability_gate = true /\
  c4_context_gate = true /\ c4_protocol_gate = true.

theorem cub_0907_composite_requires_all_subgates
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool)
    (h : nist_c4_authorize face_ok hmac_ok delegation_ok consent_ok = true) :
    c4_identity_gate face_ok hmac_ok = true
    /\ c4_capability_gate face_ok delegation_ok = true
    /\ c4_context_gate face_ok = true
    /\ c4_protocol_gate face_ok consent_ok = true


DERIVED: Theorem named 'cub_0908_identity_failure_denies' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0908_identity_failure_denies :
  c4_identity_gate = false -> nist_c4_authorize = false.

theorem cub_0908_identity_failure_denies
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool)
    (h : c4_identity_gate face_ok hmac_ok = false) :
    nist_c4_authorize face_ok hmac_ok delegation_ok consent_ok = false


DERIVED: Theorem named 'cub_0908_capability_failure_denies' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0908_capability_failure_denies :
  c4_capability_gate = false -> nist_c4_authorize = false.

theorem cub_0908_capability_failure_denies
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool)
    (h : c4_capability_gate face_ok delegation_ok = false) :
    nist_c4_authorize face_ok hmac_ok delegation_ok consent_ok = false


DERIVED: Theorem named 'cub_0908_context_failure_denies' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0908_context_failure_denies :
  c4_context_gate = false -> nist_c4_authorize = false.

theorem cub_0908_context_failure_denies
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool)
    (h : c4_context_gate face_ok = false) :
    nist_c4_authorize face_ok hmac_ok delegation_ok consent_ok = false


DERIVED: Theorem named 'cub_0908_protocol_failure_denies' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0908_protocol_failure_denies :
  c4_protocol_gate = false -> nist_c4_authorize = false.

theorem cub_0908_protocol_failure_denies
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool)
    (h : c4_protocol_gate face_ok consent_ok = false) :
    nist_c4_authorize face_ok hmac_ok delegation_ok consent_ok = false


DERIVED: Theorem named 'cub_0909_attestation_theorem_count_invariant' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0909_attestation_theorem_count_invariant :
  theorem_count nist_c4_attest = NIST_THEOREM_COUNT.

theorem cub_0909_attestation_theorem_count_invariant
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool) :
    (nist_c4_attest face_ok hmac_ok delegation_ok consent_ok).theorem_count
    = NIST_THEOREM_COUNT


DERIVED: Theorem named 'cub_0910_attestation_consistency' in the CubieNistC4V2_5 family -- registry statement: V2.5 NIST C4

Theorem cub_0910_attestation_consistency :
  c4_passed nist_c4_attest =
  andb (andb (identity_r nist_c4_attest) (capability_r nist_c4_attest))
       (andb (context_r nist_c4_attest) (protocol_r nist_c4_attest)).

theorem cub_0910_attestation_consistency
    (face_ok : Nat -> Bool) (hmac_ok delegation_ok consent_ok : Bool) :
    let a


DERIVED: Definition named 'color_of' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition color_of (f : Face) : Color :=
  match f with
  | FWho => Yellow
  | FWhat => Blue
  | FWhen => Green
  | FWhere => Orange
  | FWhy => White
  | FHow => Red
  end.


DERIVED: Definition named 'semantic_face_count' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition semantic_face_count : nat := 6.


DERIVED: Definition named 'sites_per_face' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum


DERIVED: Definition named 'oriented_facelet_count' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition oriented_facelet_count : nat := 54.


DERIVED: Definition named 'physical_cubie_count' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition physical_cubie_count : nat := 26.


DERIVED: Definition named 'GodsNumberMax' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum


DERIVED: Definition named 'CayleyDistanceOK' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition CayleyDistanceOK (q : Cubie) : Prop :=
  cayley_distance (rubik_state q) solved_state <= GodsNumberMax.


DERIVED: Definition named 'UniformFace' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition UniformFace (q : Cubie) (f : Face) : Prop :=
  forall c : Coord, visible_color q f c = color_of f.

def UniformFace (q : Cubie) (f : Face) : Prop


DERIVED: Definition named 'PatternOK' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition PatternOK (ctx : Context) (A : AccessSet) (q : Cubie) (pi : AccessPattern) : Prop :=
  exists f : Face, FaceAllowed ctx f /\ ContainsPattern A f pi /\ ColorTypeOK ctx q f.

def PatternOK (ctx : Context) (A : AccessSet) (q : Cubie) (π : AccessPattern) : Prop


DERIVED: Definition named 'LinearHandoffOK' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition LinearHandoffOK (ctx : Context) (h : Handoff) : Prop :=
  consumed h = false /\ HandoffContextOK h ctx.

def LinearHandoffOK (ctx : Context) (h : Handoff) : Prop


DERIVED: Definition named 'RotateExtraOK' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition RotateExtraOK (ctx : Context) (q : Cubie) (axis : Face) (h : Handoff) : Prop :=
  AxisAuthorize ctx axis /\ LinearHandoffOK ctx h /\ CayleyTransitionOK q axis.

def RotateExtraOK (ctx : Context) (q : Cubie) (axis : Face) (h : Handoff) : Prop


DERIVED: Definition named 'Auth' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Definition Auth
    (ctx : Context) (depth : nat) (A : AccessSet) (q : Cubie)
    (pi : AccessPattern) (mode : AccessMode) (axis : Face)
    (w : Workflow) (h : Handoff) : Prop :=
  CoreValid ctx depth A q pi w h /\
  match mode with
  | AMObserve => True
  | AMRotate => RotateExtraOK ctx q axis h
  end.

def Auth
    (ctx : Context) (depth : Nat) (A : AccessSet) (q : Cubie)
    (π : AccessPattern) (mode : AccessMode) (axis : Face)
    (w : Workflow) (h : Handoff) : Prop


DERIVED: Theorem named 'auth_implies_core' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem auth_implies_core :
  forall (ctx : Context) (depth : nat) (A : AccessSet) (q : Cubie)
         (pi : AccessPattern) (mode : AccessMode) (axis : Face)
         (w : Workflow) (h : Handoff),
    Auth ctx depth A q pi mode axis w h -> CoreValid ctx depth A q pi w h.

theorem auth_implies_core
    (ctx : Context) (depth : Nat) (A : AccessSet) (q : Cubie)
    (π : AccessPattern) (mode : AccessMode) (axis : Face)
    (w : Workflow) (h : Handoff)
    (ha : Auth ctx depth A q π mode axis w h) :
    CoreValid ctx depth A q π w h


DERIVED: Theorem named 'rotate_auth_implies_linear_handoff' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem rotate_auth_implies_linear_handoff :
  forall (ctx : Context) (depth : nat) (A : AccessSet) (q : Cubie)
         (pi : AccessPattern) (axis : Face) (w : Workflow) (h : Handoff),
    Auth ctx depth A q pi AMRotate axis w h -> LinearHandoffOK ctx h.

theorem rotate_auth_implies_linear_handoff
    (ctx : Context) (depth : Nat) (A : AccessSet) (q : Cubie)
    (π : AccessPattern) (axis : Face) (w : Workflow) (h : Handoff)
    (ha : Auth ctx depth A q π AccessMode.rotate axis w h) :
    LinearHandoffOK ctx h


DERIVED: Theorem named 'linear_handoff_unconsumed' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem linear_handoff_unconsumed :
  forall (ctx : Context) (h : Handoff),
    LinearHandoffOK ctx h -> consumed h = false.

theorem linear_handoff_unconsumed
    (ctx : Context) (h : Handoff)
    (hl : LinearHandoffOK ctx h) :
    consumed h = false


DERIVED: Theorem named 'rotate_auth_implies_axis_authorized' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem rotate_auth_implies_axis_authorized :
  forall (ctx : Context) (depth : nat) (A : AccessSet) (q : Cubie)
         (pi : AccessPattern) (axis : Face) (w : Workflow) (h : Handoff),
    Auth ctx depth A q pi AMRotate axis w h -> AxisAuthorize ctx axis.

theorem rotate_auth_implies_axis_authorized
    (ctx : Context) (depth : Nat) (A : AccessSet) (q : Cubie)
    (π : AccessPattern) (axis : Face) (w : Workflow) (h : Handoff)
    (ha : Auth ctx depth A q π AccessMode.rotate axis w h) :
    AxisAuthorize ctx axis


DERIVED: Theorem named 'depth3_turn_bound' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem depth3_turn_bound : GodsNumberMax * 3 = 60.

theorem depth3_turn_bound : GodsNumberMax * 3 = 60


DERIVED: Theorem named 'full_surface_depth3' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem full_surface_depth3 : 54 ^ 3 = 157464.

theorem full_surface_depth3 : 54 ^ 3 = 157464


DERIVED: Theorem named 'same_face_depth3' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum


DERIVED: Theorem named 'golden_depth3' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum


DERIVED: Theorem named 'authorized_linear_resource_is_unconsumed' in the CubieNonQuantum_v1_10 family -- registry statement: v1.10 Non-Quantum

Theorem authorized_linear_resource_is_unconsumed :
  forall (ctx : Context) (depth : nat) (A : AccessSet) (q : Cubie)
         (pi : AccessPattern) (mode : AccessMode) (axis : Face)
         (w : Workflow) (h : Handoff),
    Auth ctx depth A q pi mode axis w h -> consumed h = false.

theorem authorized_linear_resource_is_unconsumed
    (ctx : Context) (depth : Nat) (A : AccessSet) (q : Cubie)
    (π : AccessPattern) (mode : AccessMode) (axis : Face)
    (w : Workflow) (h : Handoff)
    (ha : Auth ctx depth A q π mode axis w h) :
    consumed h = false


DERIVED: Definition named 'manifold_valid' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition manifold_valid (s : OmegaState) : bool :=
  ashby_regulation s &&
  licklider_attribution s &&
  vonneumann_replication s &&
  shannon_information s &&
  thompson_trust s &&
  session_state s &&
  hardware_key s.

def manifold_valid (s : OmegaState) : Bool


DERIVED: Definition named 'safe_admission' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition safe_admission (s : OmegaState) : bool := manifold_valid s.

def safe_admission (s : OmegaState) : Bool


DERIVED: Definition named 'witness_explains' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition witness_explains (w : ContainmentFailureWitness) (s : OmegaState) : bool :=
  match w with
  | ashby_failure      => negb (ashby_regulation s)
  | licklider_failure  => negb (licklider_attribution s)
  | vonneumann_failure => negb (vonneumann_replication s)
  | shannon_failure    => negb (shannon_information s)
  | thompson_failure   => negb (thompson_trust s)
  | session_failure    => negb (session_state s)
  | hardware_failure   => negb (hardware_key s)
  end.

def witness_explains (w : ContainmentFailureWitness) (s : OmegaState) : Bool


DERIVED: Definition named 'operational_containment_failure_with' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition operational_containment_failure_with
           (s : OmegaState) (w : ContainmentFailureWitness) : bool :=
  witness_explains w s.

def operational_containment_failure_with
    (s : OmegaState) (w : ContainmentFailureWitness) : Bool


DERIVED: Definition named 'explanation_exists' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition explanation_exists (s : OmegaState) : bool :=
  negb (ashby_regulation s) ||
  negb (licklider_attribution s) ||
  negb (vonneumann_replication s) ||
  negb (shannon_information s) ||
  negb (thompson_trust s) ||
  negb (session_state s) ||
  negb (hardware_key s).

def explanation_exists (s : OmegaState) : Bool


DERIVED: Definition named 'cubie_admit' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition cubie_admit (c : CubieState) : bool :=
  c_topology c && c_identity c && c_lease c && c_epoch c &&
  c_reqhash c && c_attest c && c_policy c.


DERIVED: Definition named 'project_to_omega' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Definition project_to_omega (c : CubieState) (hw : bool) : OmegaState :=
  {| ashby_regulation       := c_topology c;
     licklider_attribution  := c_identity c;
     vonneumann_replication := c_lease c && c_epoch c;
     shannon_information    := c_reqhash c;
     thompson_trust         := c_attest c;
     session_state          := c_policy c;
     hardware_key           := hw |}.

def project_to_omega (c : CubieState) (hw : Bool) : OmegaState


DERIVED: Theorem named 'omega_clause_1_safety' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem omega_clause_1_safety :
  forall s : OmegaState,
    manifold_valid s = true -> safe_admission s = true.

theorem omega_clause_1_safety (s : OmegaState) :
    manifold_valid s = true → safe_admission s = true


DERIVED: Theorem named 'omega_clause_2_failure_attribution' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem omega_clause_2_failure_attribution :
  forall s : OmegaState,
    manifold_valid s = false -> explanation_exists s = true.

theorem omega_clause_2_failure_attribution (s : OmegaState) :
    manifold_valid s = false → explanation_exists s = true


DERIVED: Theorem named 'omega_clause_3_mutual_exclusion' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem omega_clause_3_mutual_exclusion :
  forall (s : OmegaState) (w : ContainmentFailureWitness),
    safe_admission s = true ->
    operational_containment_failure_with s w = false.

theorem omega_clause_3_mutual_exclusion (s : OmegaState) (w : ContainmentFailureWitness) :
    safe_admission s = true →
    operational_containment_failure_with s w = false


DERIVED: Theorem named 'ashby_witness_iff_topology_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem ashby_witness_iff_topology_collapse :
  forall s : OmegaState,
    witness_explains ashby_failure s = true <-> ashby_regulation s = false.

theorem ashby_witness_iff_topology_collapse (s : OmegaState) :
    witness_explains ashby_failure s = true ↔ s.ashby_regulation = false


DERIVED: Theorem named 'licklider_witness_iff_identity_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem licklider_witness_iff_identity_collapse :
  forall s : OmegaState,
    witness_explains licklider_failure s = true <-> licklider_attribution s = false.

theorem licklider_witness_iff_identity_collapse (s : OmegaState) :
    witness_explains licklider_failure s = true ↔ s.licklider_attribution = false


DERIVED: Theorem named 'vonneumann_witness_iff_replication_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem vonneumann_witness_iff_replication_collapse :
  forall s : OmegaState,
    witness_explains vonneumann_failure s = true <-> vonneumann_replication s = false.

theorem vonneumann_witness_iff_replication_collapse (s : OmegaState) :
    witness_explains vonneumann_failure s = true ↔ s.vonneumann_replication = false


DERIVED: Theorem named 'shannon_witness_iff_information_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem shannon_witness_iff_information_collapse :
  forall s : OmegaState,
    witness_explains shannon_failure s = true <-> shannon_information s = false.

theorem shannon_witness_iff_information_collapse (s : OmegaState) :
    witness_explains shannon_failure s = true ↔ s.shannon_information = false


DERIVED: Theorem named 'thompson_witness_iff_attestation_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem thompson_witness_iff_attestation_collapse :
  forall s : OmegaState,
    witness_explains thompson_failure s = true <-> thompson_trust s = false.

theorem thompson_witness_iff_attestation_collapse (s : OmegaState) :
    witness_explains thompson_failure s = true ↔ s.thompson_trust = false


DERIVED: Theorem named 'session_witness_iff_policy_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem session_witness_iff_policy_collapse :
  forall s : OmegaState,
    witness_explains session_failure s = true <-> session_state s = false.

theorem session_witness_iff_policy_collapse (s : OmegaState) :
    witness_explains session_failure s = true ↔ s.session_state = false


DERIVED: Theorem named 'hardware_witness_iff_hardware_collapse' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem hardware_witness_iff_hardware_collapse :
  forall s : OmegaState,
    witness_explains hardware_failure s = true <-> hardware_key s = false.

theorem hardware_witness_iff_hardware_collapse (s : OmegaState) :
    witness_explains hardware_failure s = true ↔ s.hardware_key = false


DERIVED: Theorem named 'cubie_admit_iff_manifold_valid_with_hardware' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem cubie_admit_iff_manifold_valid_with_hardware :
  forall (c : CubieState),
    manifold_valid (project_to_omega c true) = cubie_admit c.

theorem cubie_admit_iff_manifold_valid_with_hardware (c : CubieState) :
    manifold_valid (project_to_omega c true) = cubie_admit c


DERIVED: Theorem named 'cubie_admit_implies_all_witnesses_pass' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem cubie_admit_implies_all_witnesses_pass :
  forall (c : CubieState),
    cubie_admit c = true ->
    ashby_regulation       (project_to_omega c true) = true /\
    licklider_attribution  (project_to_omega c true) = true /\
    vonneumann_replication (project_to_omega c true) = true /\
    shannon_information    (project_to_omega c true) = true /\
    thompson_trust         (project_to_omega c true) = true /\
    session_state          (project_to_omega c true) = true /\
    hardware_key           (project_to_omega c true) = true.

theorem cubie_admit_implies_all_witnesses_pass (c : CubieState) :
    cubie_admit c = true →
    (project_to_omega c true).ashby_regulation       = true ∧
    (project_to_omega c true).licklider_attribution  = true ∧
    (project_to_omega c true).vonneumann_replication = true ∧
    (project_to_omega c true).shannon_information    = true ∧
    (project_to_omega c true).thompson_trust         = true ∧
    (project_to_omega c true).session_state          = true ∧
    (project_to_omega c true).hardware_key           = true


DERIVED: Theorem named 'cubie_denial_implies_witness_attribution' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem cubie_denial_implies_witness_attribution :
  forall (c : CubieState) (hw : bool),
    cubie_admit c = false \/ hw = false ->
    explanation_exists (project_to_omega c hw) = true.

theorem cubie_denial_implies_witness_attribution (c : CubieState) (hw : Bool) :
    (cubie_admit c = false ∨ hw = false) →
    explanation_exists (project_to_omega c hw) = true


DERIVED: Theorem named 'manifold_validity_decidable' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem manifold_validity_decidable :
  forall s : OmegaState,
    manifold_valid s = true \/ manifold_valid s = false.

theorem manifold_validity_decidable (s : OmegaState) :
    manifold_valid s = true ∨ manifold_valid s = false


DERIVED: Theorem named 'containment_failure_attribution_total' in the CubieOmegaBridgeV2_3 family -- registry statement: CubieOmega Bridge v2.3

Theorem containment_failure_attribution_total :
  forall s : OmegaState,
    manifold_valid s = false ->
    (witness_explains ashby_failure s = true) \/
    (witness_explains licklider_failure s = true) \/
    (witness_explains vonneumann_failure s = true) \/
    (witness_explains shannon_failure s = true) \/
    (witness_explains thompson_failure s = true) \/
    (witness_explains session_failure s = true) \/
    (witness_explains hardware_failure s = true).

theorem containment_failure_attribution_total (s : OmegaState) :
    manifold_valid s = false →
    (witness_explains ashby_failure s = true) ∨
    (witness_explains licklider_failure s = true) ∨
    (witness_explains vonneumann_failure s = true) ∨
    (witness_explains shannon_failure s = true) ∨
    (witness_explains thompson_failure s = true) ∨
    (witness_explains session_failure s = true) ∨
    (witness_explains hardware_failure s = true)


DERIVED: Definition named 'OperationalFractalManifoldValid' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Definition OperationalFractalManifoldValid (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop :=
  FractalDepth x <= StaticEventHorizon /\
  ConditionalCompressibilityGap x s >= ExpertLineageFloor /\
  EntangledTwistedParity x s k >= SurfaceFaceParity x /\
  (GenerativePercolationDepth x <= PercolationCriticalLimit \/ AttestedInMacroRegistry x) /\
  ToolchainTensorHash x = OrthogonalCrossCompileHash x.

def OperationalFractalManifoldValid (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop


DERIVED: Definition named 'cubie_admit' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Definition cubie_admit (c : CubieState) : bool :=
  c_topology c && c_identity c && c_lease c && c_epoch c &&
  c_reqhash c && c_attest c && c_policy c.


DERIVED: Theorem named 'ashby_witness_from_topology_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem ashby_witness_from_topology_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_topology c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem ashby_witness_from_topology_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_topology = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'licklider_witness_from_identity_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem licklider_witness_from_identity_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_identity c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem licklider_witness_from_identity_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_identity = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'licklider_witness_from_policy_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem licklider_witness_from_policy_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_policy c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem licklider_witness_from_policy_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_policy = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'vonneumann_witness_from_lease_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem vonneumann_witness_from_lease_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_lease c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem vonneumann_witness_from_lease_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_lease = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'vonneumann_witness_from_epoch_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem vonneumann_witness_from_epoch_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_epoch c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem vonneumann_witness_from_epoch_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_epoch = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'shannon_witness_from_reqhash_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem shannon_witness_from_reqhash_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_reqhash c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem shannon_witness_from_reqhash_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_reqhash = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'thompson_witness_from_attest_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem thompson_witness_from_attest_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    c_attest c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem thompson_witness_from_attest_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : c.c_attest = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'cubie_face_failure_invokes_omega_containment_failure' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem cubie_face_failure_invokes_omega_containment_failure :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    cubie_admit c = false ->
    OperationalContainmentFailure (cubie_to_action c) s k.

theorem cubie_face_failure_invokes_omega_containment_failure
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : cubie_admit c = false) :
    OperationalContainmentFailure (cubie_to_action c) s k


DERIVED: Theorem named 'cubie_face_failure_invokes_photonic_containment' in the CubieOmegaStage2V2_3 family -- registry statement: CubieOmega Stage2 v2.3

Theorem cubie_face_failure_invokes_photonic_containment :
  forall (c : CubieState) (s : SessionState) (k : HardwareKey),
    cubie_admit c = false ->
    RoutedToPhotonicTarpit (cubie_to_action c) /\
    ~ MutatesPhysicalReality (cubie_to_action c).

theorem cubie_face_failure_invokes_photonic_containment
    (c : CubieState) (s : SessionState) (k : HardwareKey)
    (H : cubie_admit c = false) :
    RoutedToPhotonicTarpit (cubie_to_action c) ∧
    ¬ MutatesPhysicalReality (cubie_to_action c)


DERIVED: Definition named 'ALLOW_CODE' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition ALLOW_CODE : N          := 0x5A5A5A5A%N.


DERIVED: Definition named 'DENY_KV_HEAD_BUDGET' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_KV_HEAD_BUDGET : N := 0xA1A1A1A1%N.


DERIVED: Definition named 'DENY_HMAC' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_HMAC : N           := 0xB2B2B2B2%N.


DERIVED: Definition named 'DENY_REPLAY' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_REPLAY : N         := 0xC3C3C3C3%N.


DERIVED: Definition named 'DENY_DEPTH' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_DEPTH : N          := 0xD4D4D4D4%N.


DERIVED: Definition named 'DENY_BLOOM' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_BLOOM : N          := 0xE5E5E5E5%N.


DERIVED: Definition named 'DENY_TOPOLOGY' in the CubieOutputStateV2_5 family -- registry statement: V2.5 Output State

Definition DENY_TOPOLOGY : N       := 0xF6F6F6F6%N.