DERIVED: Theorem named 'surface_spoofing_separation' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem surface_spoofing_separation :
  exists r_gen r_spoof,
    project_request r_gen = project_request r_spoof /\
    Admit r_gen wepoch = true /\
    Admit r_spoof wepoch = false.

theorem surface_spoofing_separation :
    ∃ rGen rSpoof,
      project_request rGen = project_request rSpoof /\
      Admit rGen wepoch = true /\
      Admit rSpoof wepoch = false


DERIVED: Theorem named 'admit_not_surface_determined' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem admit_not_surface_determined :
  ~ (forall r1 r2, project_request r1 = project_request r2 ->
      Admit r1 wepoch = Admit r2 wepoch).

not stated in registry status for this row

theorem admit_not_surface_determined :
    ¬ (∀ r1 r2, project_request r1 = project_request r2 ->
      Admit r1 wepoch = Admit r2 wepoch)

(empty -- not bound to any bare-metal exec fn/crate)


DERIVED: Theorem named 'gpu_corner_independent_of_deployment_faces' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem gpu_corner_independent_of_deployment_faces : forall r1 r2,
  context r1 = context r2 ->
  runtime r1 = runtime r2 ->
  outcome r1 = outcome r2 ->
  GpuCornerPass r1 = GpuCornerPass r2.

theorem gpu_corner_independent_of_deployment_faces (r1 r2 : CubieRequest) :
    r1.context = r2.context ->
    r1.runtime = r2.runtime ->
    r1.outcome = r2.outcome ->
    GpuCornerPass r1 = GpuCornerPass r2


DERIVED: Theorem named 'deployment_corner_independent_of_gpu_faces' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem deployment_corner_independent_of_gpu_faces : forall r1 r2,
  identity r1 = identity r2 ->
  lineage r1 = lineage r2 ->
  policy r1 = policy r2 ->
  DeploymentCornerPass r1 = DeploymentCornerPass r2.

theorem deployment_corner_independent_of_gpu_faces (r1 r2 : CubieRequest) :
    r1.identity = r2.identity ->
    r1.lineage = r2.lineage ->
    r1.policy = r2.policy ->
    DeploymentCornerPass r1 = DeploymentCornerPass r2


DERIVED: Definition named 'policy_fresh_v2' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler


DERIVED: Definition named 'telemetry_fresh_v2' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler


DERIVED: Definition named 'AdmitV2' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition AdmitV2 (r : CubieRequest) (e : EpochCacheV2) : bool :=
  structural_identity_valid r && unified_causal_clock_valid_v2 e &&
  GpuCornerPass r && DeploymentCornerPass r.

def AdmitV2 (r : CubieRequest) (e : EpochCacheV2) : Bool


DERIVED: Definition named 'mint_lease' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition mint_lease (r : CubieRequest) (e : EpochCacheV2) : option AdmissionLease :=
  if AdmitV2 r e then
    Some {| lease_request_admit := true;
            lease_policy_epoch := v2_policy_epoch e;
            lease_telemetry_epoch := v2_telemetry_epoch e;
            lease_policy_hash := v2_policy_hash e;
            lease_telemetry_hash := v2_telemetry_hash e |}
  else None.

def mint_lease (r : CubieRequest) (e : EpochCacheV2) : Option AdmissionLease


DERIVED: Definition named 'host_verify_lease' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition host_verify_lease (l : AdmissionLease) (e_host : EpochCacheV2) : bool :=
  lease_request_admit l &&
  Nat.eqb (lease_policy_hash l) (v2_policy_hash e_host) &&
  Nat.eqb (lease_telemetry_hash l) (v2_telemetry_hash e_host).

def host_verify_lease (l : AdmissionLease) (eHost : EpochCacheV2) : Bool


DERIVED: Theorem named 'lease_mint_implies_admit' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem lease_mint_implies_admit : forall r e l,
  mint_lease r e = Some l -> AdmitV2 r e = true.

theorem lease_mint_implies_admit (r : CubieRequest) (e : EpochCacheV2) (l : AdmissionLease) :
    mint_lease r e = some l -> AdmitV2 r e = true


DERIVED: Theorem named 'lease_validates_implies_witness' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem lease_validates_implies_witness : forall l e_host,
  host_verify_lease l e_host = true -> lease_request_admit l = true.

theorem lease_validates_implies_witness (l : AdmissionLease) (eHost : EpochCacheV2) :
    host_verify_lease l eHost = true -> l.lease_request_admit = true


DERIVED: Theorem named 'lease_integrity' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem lease_integrity : forall r e_mint e_host l,
  mint_lease r e_mint = Some l ->
  host_verify_lease l e_host = true ->
  AdmitV2 r e_mint = true /\
  lease_policy_hash l = v2_policy_hash e_host /\
  lease_telemetry_hash l = v2_telemetry_hash e_host.

theorem lease_integrity (r : CubieRequest) (eMint eHost : EpochCacheV2) (l : AdmissionLease) :
    mint_lease r eMint = some l ->
    host_verify_lease l eHost = true ->
    AdmitV2 r eMint = true /\
    l.lease_policy_hash = eHost.v2_policy_hash /\
    l.lease_telemetry_hash = eHost.v2_telemetry_hash


DERIVED: Definition named 'host_admit' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition host_admit (l_opt : option AdmissionLease) (e_host : EpochCacheV2) : bool :=
  match l_opt with
  | None => false
  | Some l => host_verify_lease l e_host
  end.

def host_admit (lOpt : Option AdmissionLease) (eHost : EpochCacheV2) : Bool


DERIVED: Theorem named 'bypass_no_lease' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem bypass_no_lease : forall e_host, host_admit None e_host = false.

theorem bypass_no_lease (eHost : EpochCacheV2) :
    host_admit none eHost = false


DERIVED: Definition named 'epoch_advance' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler


DERIVED: Theorem named 'epoch_advance_strictly_increases' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem epoch_advance_strictly_increases : forall e new_pe new_te new_ph new_th e',
  epoch_advance_hash e new_pe new_te new_ph new_th = Some e' ->
  verify_epoch_chain_link 80 (v2_policy_hash e) new_pe new_ph = true /\
  verify_epoch_chain_link 84 (v2_telemetry_hash e) new_te new_th = true.

theorem epoch_advance_strictly_increases
    (e : EpochCacheV2) (newPe newTe newPh newTh : Nat) (e' : EpochCacheV2) :
    epoch_advance_hash e newPe newTe newPh newTh = some e' ->
    verify_epoch_chain_link 80 e.v2_policy_hash newPe newPh = true /\
    verify_epoch_chain_link 84 e.v2_telemetry_hash newTe newTh = true


DERIVED: Theorem named 'epoch_advance_no_rollback' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem epoch_advance_no_rollback : forall e new_pe new_te new_ph new_th,
  verify_epoch_chain_link 80 (v2_policy_hash e) new_pe new_ph = false \/
  verify_epoch_chain_link 84 (v2_telemetry_hash e) new_te new_th = false ->
  epoch_advance_hash e new_pe new_te new_ph new_th = None.

theorem epoch_advance_no_rollback
    (e : EpochCacheV2) (newPe newTe newPh newTh : Nat) :
    verify_epoch_chain_link 80 e.v2_policy_hash newPe newPh = false \/
    verify_epoch_chain_link 84 e.v2_telemetry_hash newTe newTh = false ->
    epoch_advance_hash e newPe newTe newPh newTh = none


DERIVED: Definition named 'is_high_impact' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition is_high_impact (r : CubieRequest) : bool := c1 (policy r).

def is_high_impact (r : CubieRequest) : Bool


DERIVED: Definition named 'ha_mint' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Definition ha_mint (r : CubieRequest) (e : EpochCacheV2) (ha : HAFailureMatrix) : option AdmissionLease :=
  if ha_partitioned ha && is_high_impact r then None else mint_lease r e.

def ha_mint (r : CubieRequest) (e : EpochCacheV2) (ha : HAFailureMatrix) :
    Option AdmissionLease


DERIVED: Theorem named 'ha_split_brain_fail_closed' in the CubieTrustCompilerV2_0 family -- registry statement: V2.0 Trust Compiler

Theorem ha_split_brain_fail_closed : forall r e ha,
  ha_partitioned ha = true ->
  is_high_impact r = true ->
  ha_mint r e ha = None.

theorem ha_split_brain_fail_closed (r : CubieRequest) (e : EpochCacheV2)
    (ha : HAFailureMatrix) :
    ha.ha_partitioned = true ->
    is_high_impact r = true ->
    ha_mint r e ha = none


DERIVED: Definition named 'policy_fresh' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate


DERIVED: Definition named 'telemetry_fresh' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate


DERIVED: Definition named 'Admit' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

def Admit (r : CubieRequest) (e : EpochCache) : Bool


DERIVED: Theorem named 'face_localized_denial_identity' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_identity (r : CubieRequest) (e : EpochCache) :
    face_pass r.identity = false -> Admit r e = false


DERIVED: Theorem named 'face_localized_denial_lineage' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_lineage (r : CubieRequest) (e : EpochCache) :
    face_pass r.lineage = false -> Admit r e = false


DERIVED: Theorem named 'face_localized_denial_runtime' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_runtime (r : CubieRequest) (e : EpochCache) :
    face_pass r.runtime = false -> Admit r e = false


DERIVED: Theorem named 'face_localized_denial_context' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_context (r : CubieRequest) (e : EpochCache) :
    face_pass r.context = false -> Admit r e = false


DERIVED: Theorem named 'face_localized_denial_policy' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_policy (r : CubieRequest) (e : EpochCache) :
    face_pass r.policy = false -> Admit r e = false


DERIVED: Theorem named 'face_localized_denial_outcome' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

theorem face_localized_denial_outcome (r : CubieRequest) (e : EpochCache) :
    face_pass r.outcome = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_identity_implies_denial : forall r e,
  c1 (identity r) = false -> Admit r e = false.

theorem c1_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_identity_implies_denial : forall r e,
  c2 (identity r) = false -> Admit r e = false.

theorem c2_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_identity_implies_denial : forall r e,
  c3 (identity r) = false -> Admit r e = false.

theorem c3_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_identity_implies_denial : forall r e,
  c4 (identity r) = false -> Admit r e = false.

theorem c4_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_identity_implies_denial : forall r e,
  c5 (identity r) = false -> Admit r e = false.

theorem c5_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_identity_implies_denial : forall r e,
  c6 (identity r) = false -> Admit r e = false.

theorem c6_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_identity_implies_denial : forall r e,
  c7 (identity r) = false -> Admit r e = false.

theorem c7_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_identity_implies_denial : forall r e,
  c8 (identity r) = false -> Admit r e = false.

theorem c8_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_identity_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_identity_implies_denial : forall r e,
  c9 (identity r) = false -> Admit r e = false.

theorem c9_failure_identity_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.identity.c9 = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_lineage_implies_denial : forall r e,
  c1 (lineage r) = false -> Admit r e = false.

theorem c1_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_lineage_implies_denial : forall r e,
  c2 (lineage r) = false -> Admit r e = false.

theorem c2_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_lineage_implies_denial : forall r e,
  c3 (lineage r) = false -> Admit r e = false.

theorem c3_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_lineage_implies_denial : forall r e,
  c4 (lineage r) = false -> Admit r e = false.

theorem c4_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_lineage_implies_denial : forall r e,
  c5 (lineage r) = false -> Admit r e = false.

theorem c5_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_lineage_implies_denial : forall r e,
  c6 (lineage r) = false -> Admit r e = false.

theorem c6_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_lineage_implies_denial : forall r e,
  c7 (lineage r) = false -> Admit r e = false.

theorem c7_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_lineage_implies_denial : forall r e,
  c8 (lineage r) = false -> Admit r e = false.

theorem c8_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_lineage_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_lineage_implies_denial : forall r e,
  c9 (lineage r) = false -> Admit r e = false.

theorem c9_failure_lineage_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.lineage.c9 = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_runtime_implies_denial : forall r e,
  c1 (runtime r) = false -> Admit r e = false.

theorem c1_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_runtime_implies_denial : forall r e,
  c2 (runtime r) = false -> Admit r e = false.

theorem c2_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_runtime_implies_denial : forall r e,
  c3 (runtime r) = false -> Admit r e = false.

theorem c3_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_runtime_implies_denial : forall r e,
  c4 (runtime r) = false -> Admit r e = false.

theorem c4_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_runtime_implies_denial : forall r e,
  c5 (runtime r) = false -> Admit r e = false.

theorem c5_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_runtime_implies_denial : forall r e,
  c6 (runtime r) = false -> Admit r e = false.

theorem c6_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_runtime_implies_denial : forall r e,
  c7 (runtime r) = false -> Admit r e = false.

theorem c7_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_runtime_implies_denial : forall r e,
  c8 (runtime r) = false -> Admit r e = false.

theorem c8_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_runtime_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_runtime_implies_denial : forall r e,
  c9 (runtime r) = false -> Admit r e = false.

theorem c9_failure_runtime_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.runtime.c9 = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_context_implies_denial : forall r e,
  c1 (context r) = false -> Admit r e = false.

theorem c1_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_context_implies_denial : forall r e,
  c2 (context r) = false -> Admit r e = false.

theorem c2_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_context_implies_denial : forall r e,
  c3 (context r) = false -> Admit r e = false.

theorem c3_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_context_implies_denial : forall r e,
  c4 (context r) = false -> Admit r e = false.

theorem c4_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_context_implies_denial : forall r e,
  c5 (context r) = false -> Admit r e = false.

theorem c5_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_context_implies_denial : forall r e,
  c6 (context r) = false -> Admit r e = false.

theorem c6_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_context_implies_denial : forall r e,
  c7 (context r) = false -> Admit r e = false.

theorem c7_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_context_implies_denial : forall r e,
  c8 (context r) = false -> Admit r e = false.

theorem c8_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_context_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_context_implies_denial : forall r e,
  c9 (context r) = false -> Admit r e = false.

theorem c9_failure_context_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.context.c9 = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_policy_implies_denial : forall r e,
  c1 (policy r) = false -> Admit r e = false.

theorem c1_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_policy_implies_denial : forall r e,
  c2 (policy r) = false -> Admit r e = false.

theorem c2_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_policy_implies_denial : forall r e,
  c3 (policy r) = false -> Admit r e = false.

theorem c3_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_policy_implies_denial : forall r e,
  c4 (policy r) = false -> Admit r e = false.

theorem c4_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_policy_implies_denial : forall r e,
  c5 (policy r) = false -> Admit r e = false.

theorem c5_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_policy_implies_denial : forall r e,
  c6 (policy r) = false -> Admit r e = false.

theorem c6_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_policy_implies_denial : forall r e,
  c7 (policy r) = false -> Admit r e = false.

theorem c7_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_policy_implies_denial : forall r e,
  c8 (policy r) = false -> Admit r e = false.

theorem c8_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_policy_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_policy_implies_denial : forall r e,
  c9 (policy r) = false -> Admit r e = false.

theorem c9_failure_policy_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.policy.c9 = false -> Admit r e = false


DERIVED: Theorem named 'c1_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c1_failure_outcome_implies_denial : forall r e,
  c1 (outcome r) = false -> Admit r e = false.

theorem c1_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c1 = false -> Admit r e = false


DERIVED: Theorem named 'c2_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c2_failure_outcome_implies_denial : forall r e,
  c2 (outcome r) = false -> Admit r e = false.

theorem c2_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c2 = false -> Admit r e = false


DERIVED: Theorem named 'c3_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c3_failure_outcome_implies_denial : forall r e,
  c3 (outcome r) = false -> Admit r e = false.

theorem c3_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c3 = false -> Admit r e = false


DERIVED: Theorem named 'c4_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c4_failure_outcome_implies_denial : forall r e,
  c4 (outcome r) = false -> Admit r e = false.

theorem c4_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c4 = false -> Admit r e = false


DERIVED: Theorem named 'c5_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c5_failure_outcome_implies_denial : forall r e,
  c5 (outcome r) = false -> Admit r e = false.

theorem c5_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c5 = false -> Admit r e = false


DERIVED: Theorem named 'c6_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c6_failure_outcome_implies_denial : forall r e,
  c6 (outcome r) = false -> Admit r e = false.

theorem c6_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c6 = false -> Admit r e = false


DERIVED: Theorem named 'c7_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c7_failure_outcome_implies_denial : forall r e,
  c7 (outcome r) = false -> Admit r e = false.

theorem c7_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c7 = false -> Admit r e = false


DERIVED: Theorem named 'c8_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c8_failure_outcome_implies_denial : forall r e,
  c8 (outcome r) = false -> Admit r e = false.

theorem c8_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c8 = false -> Admit r e = false


DERIVED: Theorem named 'c9_failure_outcome_implies_denial' in the CubieTrustCompilerV2_0_PerPredicate family -- registry statement: V2.0-PP Per-Predicate

Theorem c9_failure_outcome_implies_denial : forall r e,
  c9 (outcome r) = false -> Admit r e = false.

theorem c9_failure_outcome_implies_denial (r : CubieRequest) (e : EpochCache) :
    r.outcome.c9 = false -> Admit r e = false


DERIVED: Definition named 'consumed_hash_ledger' in the CubieTrustCompilerV2_1 family -- registry statement: V2.1 Trust Compiler

Definition consumed_hash_ledger (l : ConsumedHashLedger) : bool :=
  Nat.leb (ledger_count l) (ledger_capacity l).

def consumed_hash_ledger (l : ConsumedHashLedger) : Bool


DERIVED: Definition named 'one_time_execution_lease' in the CubieTrustCompilerV2_1 family -- registry statement: V2.1 Trust Compiler

Definition one_time_execution_lease (lease : OneTimeExecutionLease) : bool :=
  negb (executed lease).

def one_time_execution_lease (lease : OneTimeExecutionLease) : Bool


DERIVED: Theorem named 'replay_rejection' in the CubieTrustCompilerV2_1 family -- registry statement: V2.1 Trust Compiler

Theorem replay_rejection : forall (lease : OneTimeExecutionLease),
  executed lease = true ->
  one_time_execution_lease lease = false.

theorem replay_rejection (lease : OneTimeExecutionLease)
    (h : lease.executed = true) :
    one_time_execution_lease lease = false


DERIVED: Lemma named 'lease_valid_not_executed' in the CubieTrustCompilerV2_1 family -- registry statement: V2.1 Trust Compiler

Lemma lease_valid_not_executed : forall (lease : OneTimeExecutionLease),
  one_time_execution_lease lease = true ->
  executed lease = false.

theorem lease_valid_not_executed (lease : OneTimeExecutionLease)
    (h : one_time_execution_lease lease = true) :
    lease.executed = false


DERIVED: Lemma named 'ledger_valid_implies_count_bounded' in the CubieTrustCompilerV2_1 family -- registry statement: V2.1 Trust Compiler

Lemma ledger_valid_implies_count_bounded : forall (l : ConsumedHashLedger),
  consumed_hash_ledger l = true ->
  ledger_count l <= ledger_capacity l.


DERIVED: def named 'SeamValid' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler


DERIVED: theorem named 'denial_certificate_denies' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem denial_certificate_denies (d : DenialCertificate) : ¬ SeamValid d.seam


DERIVED: def named 'AllSeamsValid' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

def AllSeamsValid (P : Seam → Prop) : List Seam → Prop
  | [] => True
  | e :: es => P e ∧ AllSeamsValid P es

def HasFailedSeam (P : Seam → Prop) : List Seam → Prop
  | [] => False
  | e :: es => ¬ P e ∨ HasFailedSeam P es

theorem failed_implies_not_all
  (P : Seam → Prop) : ∀ xs : List Seam, HasFailedSeam P xs → ¬ AllSeamsValid P xs


DERIVED: def named 'HasFailedSeam' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

def HasFailedSeam (P : Seam → Prop) : List Seam → Prop
  | [] => False
  | e :: es => ¬ P e ∨ HasFailedSeam P es

theorem failed_implies_not_all
  (P : Seam → Prop) : ∀ xs : List Seam, HasFailedSeam P xs → ¬ AllSeamsValid P xs


DERIVED: theorem named 'failed_implies_not_all' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem failed_implies_not_all
  (P : Seam → Prop) : ∀ xs : List Seam, HasFailedSeam P xs → ¬ AllSeamsValid P xs


DERIVED: theorem named 'all_imp_all' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem all_imp_all
  (P Q : Seam → Prop)
  (h_imp : ∀ e : Seam, P e → Q e) :
  ∀ xs : List Seam, AllSeamsValid P xs → AllSeamsValid Q xs


DERIVED: def named 'AuthStar' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

cubie-core/src/derived_candidates.rs:2766 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease; cubie-core/src/derived_candidates.rs:2767 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease; cubie-core/src/derived_candidates.rs:2772 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease

reviewed audit contract blocks this file-local evidence from the canonical CUB identity

def AuthStar (w : Workflow) (a : Action) : Prop


DERIVED: def named 'SameVisibleSurface' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

cubie-core/src/derived_candidates.rs:2769 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected; cubie-core/src/derived_candidates.rs:2769 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected; cubie-core/src/derived_candidates.rs:2773 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected

def SameVisibleSurface (w0 w1 : Workflow) : Prop


DERIVED: theorem named 'surface_spoofing_separation' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem surface_spoofing_separation
  (w0 w1 : Workflow) (a : Action)
  (h_surface : SameVisibleSurface w0 w1)
  (h_visible0 : VisibleOK w0 a)
  (_h_visible1 : VisibleOK w1 a)
  (h_all0 : AllSeamsValid SeamValid (Path w0 a))
  (h_failed1 : HasFailedSeam SeamValid (Path w1 a)) :
  SameVisibleSurface w0 w1 ∧ AuthStar w0 a ∧ ¬ AuthStar w1 a

pub open spec fn permission_attenuation(parent: &PermBudget, child: &PermBudget) -> bool


DERIVED: def named 'CornerConsensus' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

proof fn subagent_containment(parent: &PermBudget, child: &PermBudget)
    requires permission_attenuation(parent, child)
    ensures  (child.perm_scope & parent.perm_scope) == child.perm_scope


DERIVED: def named 'HighImpactWriteOK' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

def HighImpactWriteOK (w : Workflow) (a : Action) (c : Corner) : Prop


DERIVED: theorem named 'corner_consensus_required' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem corner_consensus_required
  (w : Workflow) (a : Action) (c : Corner)
  (h_write : HighImpactWriteOK w a c) :
  SeamValid c.seam1 ∧ SeamValid c.seam2 ∧ SeamValid c.seam3

pub open spec fn waste_ok_decomposition(w: &WasteOKFactors) -> bool


DERIVED: theorem named 'failed_corner_denies_write' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem failed_corner_denies_write
  (w : Workflow) (a : Action) (c : Corner)
  (h_failed : ¬ SeamValid c.seam1 ∨ ¬ SeamValid c.seam2 ∨ ¬ SeamValid c.seam3) :
  ¬ HighImpactWriteOK w a c

pub open spec fn adapter_swap_ok(cached: bool, pcie_ok: bool) -> bool


DERIVED: theorem named 'denial_certificate_at_corner_denies_write' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem denial_certificate_at_corner_denies_write
  (w : Workflow) (a : Action) (c : Corner) (d : DenialCertificate)
  (h_loc : d.seam = c.seam1 ∨ d.seam = c.seam2 ∨ d.seam = c.seam3) :
  ¬ HighImpactWriteOK w a c


DERIVED: def named 'StandardsBackedSeam' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

def StandardsBackedSeam (e : Seam) : Prop

proof fn head_shape_mismatch_implies_waste_zero(
    q_heads:  u32,
    kv_heads: u32,
    w:        &WasteOKFactors,
)
    requires
        !head_shape_ok(q_heads, kv_heads),
        w.kv_budget_ok == head_shape_ok(q_heads, kv_heads),
    ensures
        !waste_ok_decomposition(w)


DERIVED: theorem named 'standards_path_implies_valid_path' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem standards_path_implies_valid_path
  (w : Workflow) (a : Action)
  (h_std : AllSeamsValid StandardsBackedSeam (Path w a)) :
  AllSeamsValid SeamValid (Path w a)

proof fn symmetric_mac_fast_path_constraint(cfg: &FastPathConfig)
    requires !cfg.use_symmetric_mac
    ensures  !symmetric_fast_path_valid(cfg)


DERIVED: def named 'StandardsBackedCorner' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

def StandardsBackedCorner (c : Corner) : Prop


DERIVED: theorem named 'standards_corner_implies_consensus' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem standards_corner_implies_consensus
  (c : Corner) (h_std : StandardsBackedCorner c) :
  CornerConsensus c

pub open spec fn roofline_admission_time(t_compute: u64, t_mem: u64) -> u64


DERIVED: theorem named 'mvp_runtime_trust_compiler_allows' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem mvp_runtime_trust_compiler_allows
  (w : Workflow) (a : Action) (c : Corner)
  (h_high : HighImpact a)
  (h_visible : VisibleOK w a)
  (h_path_std : AllSeamsValid StandardsBackedSeam (Path w a))
  (h_corner_std : StandardsBackedCorner c)
  (h_policy : PolicyOK w a) :
  HighImpactWriteOK w a c

pub open spec fn l_ctx_pessimistic_bound(input_tokens: u64, max_output: u64) -> int


DERIVED: theorem named 'mvp_runtime_trust_compiler_blocks_surface_spoof' in the OAI_Cubie_TrustCompiler_Theorems family -- registry statement: OAI TrustCompiler

theorem mvp_runtime_trust_compiler_blocks_surface_spoof
  (w : Workflow) (a : Action) (c : Corner)
  (h_failed : HasFailedSeam SeamValid (Path w a)) :
  ¬ HighImpactWriteOK w a c

proof fn failure_probability_bound(
    layers1: u64, layers2: u64,
    batch: u64, ctx: u64, h_kv: u64, d_head: u64,
)
    requires layers1 <= layers2
    ensures
        kv_cache_byte_estimator(layers1, batch, ctx, h_kv, d_head) <=
        kv_cache_byte_estimator(layers2, batch, ctx, h_kv, d_head)


DERIVED: Definition named 'SeamValid' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition SeamValid (e : Seam) : Prop :=
  forall r : Requirement, RequirementPass r e.

pub open spec fn cubie_site_tuple(s: &CubieSiteTuple) -> bool


DERIVED: Theorem named 'denial_certificate_denies' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem denial_certificate_denies : forall d : DenialCertificate,
  ~ SeamValid (denial_seam d).

proof fn boundary_site_fraction()
    ensures
        8u64 * 6u64 == 48u64,
        1u64 * 6u64 == 6u64,
        48u64 + 6u64 == 54u64,
        BOUNDARY_FACELETS + CENTER_FACELETS == TOTAL_FACELETS,


DERIVED: Fixpoint named 'AllSeamsValid' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler


DERIVED: Fixpoint named 'HasFailedSeam' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler


DERIVED: Theorem named 'failed_implies_not_all' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem failed_implies_not_all : forall (P : Seam -> Prop) (xs : list Seam),
  HasFailedSeam P xs -> ~ AllSeamsValid P xs.


DERIVED: Theorem named 'all_imp_all' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem all_imp_all : forall (P Q : Seam -> Prop),
  (forall e : Seam, P e -> Q e) ->
  forall xs : list Seam, AllSeamsValid P xs -> AllSeamsValid Q xs.


DERIVED: Definition named 'AuthStar' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition AuthStar (w : Workflow) (a : Action) : Prop :=
  VisibleOK w a /\ AllSeamsValid SeamValid (Path w a).


DERIVED: Definition named 'SameVisibleSurface' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition SameVisibleSurface (w0 w1 : Workflow) : Prop :=
  ApiNames w0 = ApiNames w1 /\
  VisibleTelemetry w0 = VisibleTelemetry w1 /\
  VisibleHealthyDensity w0 = VisibleHealthyDensity w1.


DERIVED: Theorem named 'surface_spoofing_separation' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem surface_spoofing_separation : forall (w0 w1 : Workflow) (a : Action),
  SameVisibleSurface w0 w1 ->
  VisibleOK w0 a ->
  VisibleOK w1 a ->
  AllSeamsValid SeamValid (Path w0 a) ->
  HasFailedSeam SeamValid (Path w1 a) ->
  SameVisibleSurface w0 w1 /\ AuthStar w0 a /\ ~ AuthStar w1 a.


DERIVED: Definition named 'CornerConsensus' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition CornerConsensus (c : Corner) : Prop :=
  SeamValid (seam1 c) /\ SeamValid (seam2 c) /\ SeamValid (seam3 c).


DERIVED: Definition named 'HighImpactWriteOK' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition HighImpactWriteOK (w : Workflow) (a : Action) (c : Corner) : Prop :=
  HighImpact a /\ AuthStar w a /\ CornerConsensus c /\ PolicyOK w a.


DERIVED: Theorem named 'corner_consensus_required' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem corner_consensus_required : forall (w : Workflow) (a : Action) (c : Corner),
  HighImpactWriteOK w a c ->
  SeamValid (seam1 c) /\ SeamValid (seam2 c) /\ SeamValid (seam3 c).


DERIVED: Theorem named 'failed_corner_denies_write' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem failed_corner_denies_write : forall (w : Workflow) (a : Action) (c : Corner),
  (~ SeamValid (seam1 c) \/ ~ SeamValid (seam2 c) \/ ~ SeamValid (seam3 c)) ->
  ~ HighImpactWriteOK w a c.


DERIVED: Theorem named 'denial_certificate_at_corner_denies_write' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem denial_certificate_at_corner_denies_write :
  forall (w : Workflow) (a : Action) (c : Corner) (d : DenialCertificate),
  denial_seam d = seam1 c \/ denial_seam d = seam2 c \/ denial_seam d = seam3 c ->
  ~ HighImpactWriteOK w a c.


DERIVED: Definition named 'StandardsBackedSeam' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition StandardsBackedSeam (e : Seam) : Prop :=
  SPIFFE_OK e /\
  ServiceNameBound_OK e /\
  RuntimeAttestation_OK e /\
  SLSA_Provenance_OK e /\
  Sigstore_OK e /\
  InToto_OK e.


DERIVED: Theorem named 'standards_path_implies_valid_path' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem standards_path_implies_valid_path : forall (w : Workflow) (a : Action),
  AllSeamsValid StandardsBackedSeam (Path w a) ->
  AllSeamsValid SeamValid (Path w a).


DERIVED: Definition named 'StandardsBackedCorner' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Definition StandardsBackedCorner (c : Corner) : Prop :=
  StandardsBackedSeam (seam1 c) /\
  StandardsBackedSeam (seam2 c) /\
  StandardsBackedSeam (seam3 c).


DERIVED: Theorem named 'standards_corner_implies_consensus' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem standards_corner_implies_consensus : forall c : Corner,
  StandardsBackedCorner c -> CornerConsensus c.


DERIVED: Theorem named 'mvp_runtime_trust_compiler_allows' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem mvp_runtime_trust_compiler_allows :
  forall (w : Workflow) (a : Action) (c : Corner),
  HighImpact a ->
  VisibleOK w a ->
  AllSeamsValid StandardsBackedSeam (Path w a) ->
  StandardsBackedCorner c ->
  PolicyOK w a ->
  HighImpactWriteOK w a c.


DERIVED: Theorem named 'mvp_runtime_trust_compiler_blocks_surface_spoof' in the OAI_cubie_trust_compiler_theorems family -- registry statement: OAI TrustCompiler

Theorem mvp_runtime_trust_compiler_blocks_surface_spoof :
  forall (w : Workflow) (a : Action) (c : Corner),
  HasFailedSeam SeamValid (Path w a) ->
  ~ HighImpactWriteOK w a c.


DERIVED: Fixpoint named 'C_tree' in the OmegaEight family -- registry statement: v1.13 OmegaEight

def C_tree : Nat → Nat
  | 0     => 1
  | n + 1 => 54 ^ (n + 1) + C_tree n

theorem C_tree_at_0 : C_tree 0 = 1


DERIVED: Theorem named 'C_tree_at_0' in the OmegaEight family -- registry statement: v1.13 OmegaEight


DERIVED: Theorem named 'C_tree_at_1' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem C_tree_at_1 : C_tree 1 = 54 + 1.


DERIVED: Theorem named 'C_tree_at_2' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem C_tree_at_2 : C_tree 2 = 54 * 54 + 54 + 1.

theorem C_tree_at_2 : C_tree 2 = 54 * 54 + 54 + 1


DERIVED: Theorem named 'C_tree_geometric_series_lower' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem C_tree_geometric_series_lower :
  forall N : nat, 54 ^ N <= 53 * C_tree N + 1.

theorem C_tree_geometric_series_lower :
    ∀ N : Nat, 54 ^ N ≤ 53 * C_tree N + 1


DERIVED: Definition named 'Omega_tree' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Definition Omega_tree (R N : nat) : nat := R ^ C_tree N.


DERIVED: Theorem named 'Omega_tree_at_0' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem Omega_tree_at_0 : forall R, Omega_tree R 0 = R * 1.

theorem Omega_tree_at_0 : ∀ R, Omega_tree R 0 = R * 1


DERIVED: Theorem named 'Omega_tree_at_1' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem Omega_tree_at_1 : forall R, Omega_tree R 1 = R ^ 55.

theorem Omega_tree_at_1 : ∀ R, Omega_tree R 1 = R ^ 55


DERIVED: Theorem named 'Omega_tree_grows' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem Omega_tree_grows :
  forall R N, R >= 2 -> Omega_tree R (S N) >= Omega_tree R N.

theorem Omega_tree_grows :
    ∀ R N, R ≥ 2 → Omega_tree R (N + 1) ≥ Omega_tree R N


DERIVED: Theorem named 'T8_3_strict_ambiguity_holds' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_3_strict_ambiguity_holds :
  forall y, ambiguity y >= 2.

theorem T8_3_strict_ambiguity_holds :
    ∀ y, ambiguity y ≥ 2


DERIVED: Theorem named 'T8_4_adversary_strictly_bounded' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_4_adversary_strictly_bounded :
  forall tau, B tau < R_states.

theorem T8_4_adversary_strictly_bounded :
    ∀ tau, B tau < R_states


DERIVED: Lemma named 'pow_lt_compat_general' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Lemma pow_lt_compat_general :
  forall a b N, 0 < b -> a < b -> a ^ (S N) < b ^ (S N).

theorem pow_lt_compat_general :
    ∀ a b N, 0 < b → a < b → a ^ (N + 1) < b ^ (N + 1)


DERIVED: Theorem named 'T8_4_error_prob_decays' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_4_error_prob_decays :
  forall tau N, N >= 1 -> R_states >= 1 -> B tau ^ N < R_states ^ N.

theorem T8_4_error_prob_decays :
    ∀ tau N, N ≥ 1 → R_states ≥ 1 → B tau ^ N < R_states ^ N


DERIVED: Definition named 'EntropyMarginOK' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Definition EntropyMarginOK (tau N : nat) : Prop :=
  B tau ^ N <= epsilon_c.

cubie-core/src/hardened_gate_wiring.rs:77 cub_0765_magic_hamming_distance: no-arg, returns the constant HG_AUTH_PASS ^ HG_AUTH_FAIL; ensures distance == 0xFFFF_FFFF (proven-implication constant over two shipping consts); bare-metal-tests/tests/hardened_gate_direct.rs:25 exercises the distinct hardened_gate.rs const-fn twin, not this wiring witness

Plan Wave 2 / lane rule: a no-arg constant witness with no named consumer is a costume trap; the wiring.rs copy is UNINVOKED and the production pre-gate never calls it. STANDALONE-BY-DESIGN; rebuild-to-read-a-shipping-const is out of scope for this lane.

def EntropyMarginOK (tau N : Nat) : Prop


DERIVED: Theorem named 'T8_5_entropy_margin_holds' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_5_entropy_margin_holds :
  forall tau N, EntropyMarginOK tau N.

cubie-core/src/hardened_gate_wiring.rs:92 cub_0766_magic_words_distinct: no-arg, returns HG_AUTH_PASS != HG_AUTH_FAIL; ensures distinct (constant true over the two shipping consts); bare-metal-tests/tests/hardened_gate_direct.rs:43 exercises the hardened_gate.rs const-fn twin

Plan Wave 2 / lane rule: no-arg constant witness, no named consumer, wiring.rs copy UNINVOKED. STANDALONE-BY-DESIGN.

theorem T8_5_entropy_margin_holds :
    ∀ tau N, EntropyMarginOK tau N


DERIVED: Definition named 'J_uv' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Definition J_uv (u v : Node) : Prop :=
  FaceMatch u v /\ ColorMatch u v /\
  EdgeOK_seam u v /\ CornerOK_seam u v /\
  HandoffOK u v.


DERIVED: Theorem named 'T8_6_J_uv_decomposes' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_6_J_uv_decomposes :
  forall u v, J_uv u v ->
  FaceMatch u v /\ ColorMatch u v /\
  EdgeOK_seam u v /\ CornerOK_seam u v /\
  HandoffOK u v.

theorem T8_6_J_uv_decomposes :
    ∀ u v, J_uv u v →
      FaceMatch u v ∧ ColorMatch u v ∧
      EdgeOK_seam u v ∧ CornerOK_seam u v ∧
      HandoffOK u v


DERIVED: Theorem named 'T8_6_J_uv_face_required' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_6_J_uv_face_required :
  forall u v, J_uv u v -> FaceMatch u v.

theorem T8_6_J_uv_face_required :
    ∀ u v, J_uv u v → FaceMatch u v


DERIVED: Theorem named 'T8_6_J_uv_handoff_required' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_6_J_uv_handoff_required :
  forall u v, J_uv u v -> HandoffOK u v.

theorem T8_6_J_uv_handoff_required :
    ∀ u v, J_uv u v → HandoffOK u v


DERIVED: Definition named 'Auth_v113' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Definition Auth_v113 : Prop :=
  Auth_v112 /\
  RubikStateOK /\
  EntropyMarginOK tau_runtime N_runtime /\
  ProjectionAmbiguityAware /\
  MacroUniformityOK /\
  SeamOK.


DERIVED: Theorem named 'T8_7_Auth_v113_implies_v112' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_7_Auth_v113_implies_v112 :
  Auth_v113 -> Auth_v112.

theorem T8_7_Auth_v113_implies_v112 :
    Auth_v113 → Auth_v112


DERIVED: Theorem named 'T8_7_Auth_v113_implies_seam' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_7_Auth_v113_implies_seam :
  Auth_v113 -> SeamOK.

theorem T8_7_Auth_v113_implies_seam :
    Auth_v113 → SeamOK


DERIVED: Theorem named 'T8_7_Auth_v113_implies_entropy' in the OmegaEight family -- registry statement: v1.13 OmegaEight

Theorem T8_7_Auth_v113_implies_entropy :
  Auth_v113 -> EntropyMarginOK tau_runtime N_runtime.

theorem T8_7_Auth_v113_implies_entropy :
    Auth_v113 → EntropyMarginOK tau_runtime N_runtime


DERIVED: Theorem named 'hierarchical_self_similarity_holds' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem hierarchical_self_similarity_holds :
  forall x g N,
    N >= 1 ->
    PlusAt x g N ->
    PlusAt x g 1.

theorem hierarchical_self_similarity_holds :
  ∀ x g N, N ≥ 1 → PlusAt x g N → PlusAt x g 1


DERIVED: Theorem named 'depth_propagation_blocks_macro' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem depth_propagation_blocks_macro :
  forall x g N,
    N >= 1 ->
    ~ PlusAt x g 1 ->
    ~ PlusAt x g N.

theorem depth_propagation_blocks_macro :
  ∀ x g N, N ≥ 1 → ¬ PlusAt x g 1 → ¬ PlusAt x g N


DERIVED: Theorem named 'counterfeit_chip_blocks_assembly' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem counterfeit_chip_blocks_assembly :
  forall x g,
    ~ PlusAt x g 1 ->
    forall N, N >= 1 -> ~ PlusAt x g N.

theorem counterfeit_chip_blocks_assembly :
  ∀ x g, ¬ PlusAt x g 1 → ∀ N, N ≥ 1 → ¬ PlusAt x g N


DERIVED: Definition named 'PetriLive' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Definition PetriLive (p : PetriPlace) : Prop :=
  petri_can_fire p \/ petri_eventually p.


DERIVED: Theorem named 'petri_liveness_no_deadlock' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem petri_liveness_no_deadlock :
  forall p, petri_bounded p -> PetriLive p.

theorem petri_liveness_no_deadlock :
  ∀ p, petri_bounded p → PetriLive p


DERIVED: Theorem named 'petri_liveness_composes' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem petri_liveness_composes :
  forall p1 p2,
    petri_bounded p1 ->
    petri_bounded p2 ->
    PetriLive p1 /\ PetriLive p2.

theorem petri_liveness_composes :
  ∀ p1 p2, petri_bounded p1 → petri_bounded p2 →
    PetriLive p1 ∧ PetriLive p2


DERIVED: Theorem named 'dijkstra_self_stabilization_bounded' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem dijkstra_self_stabilization_bounded :
  forall s : SystemState,
    exists k : nat,
      k <= convergence_bound s /\
      is_legal (Nat.iter k step s).

theorem dijkstra_self_stabilization_bounded :
  ∀ s : SystemState,
    ∃ k : Nat,
      k ≤ convergence_bound s ∧
      is_legal (step_iter k s)


DERIVED: Theorem named 'dijkstra_no_permanent_corruption' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem dijkstra_no_permanent_corruption :
  forall s : SystemState,
    exists k : nat, is_legal (Nat.iter k step s).

theorem dijkstra_no_permanent_corruption :
  ∀ s : SystemState, ∃ k : Nat, is_legal (step_iter k s)


DERIVED: Theorem named 'csp_refusal_equivalence' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem csp_refusal_equivalence :
  forall (S : Specification) (t : Trace),
    implementation_refuses (impl_of_spec S) t <->
    specification_refuses S t.

theorem csp_refusal_equivalence :
  ∀ (S : Specification) (t : Trace),
    implementation_refuses (impl_of_spec S) t ↔
    specification_refuses S t


DERIVED: Theorem named 'tarpit_no_false_admit' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem tarpit_no_false_admit :
  forall (S : Specification) (t : Trace),
    specification_refuses S t ->
    implementation_refuses (impl_of_spec S) t.

theorem tarpit_no_false_admit :
  ∀ (S : Specification) (t : Trace),
    specification_refuses S t →
    implementation_refuses (impl_of_spec S) t


DERIVED: Theorem named 'tarpit_no_false_refusal' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem tarpit_no_false_refusal :
  forall (S : Specification) (t : Trace),
    ~ specification_refuses S t ->
    ~ implementation_refuses (impl_of_spec S) t.

theorem tarpit_no_false_refusal :
  ∀ (S : Specification) (t : Trace),
    ¬ specification_refuses S t →
    ¬ implementation_refuses (impl_of_spec S) t


DERIVED: Theorem named 'bisimulation_environment_indistinguishability' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem bisimulation_environment_indistinguishability :
  forall (E : Environment) (I : Implementation),
    env_observes_impl E I <-> env_observes_spec E (spec_of_impl I).

theorem bisimulation_environment_indistinguishability :
  ∀ (E : Environment) (I : Implementation),
    env_observes_impl E I ↔ env_observes_spec E (spec_of_impl I)


DERIVED: Theorem named 'adversary_cannot_distinguish' in the OmegaSeven family -- registry statement: v1.10 OmegaSeven

Theorem adversary_cannot_distinguish :
  forall (E : Environment) (I : Implementation),
    env_observes_impl E I ->
    env_observes_spec E (spec_of_impl I).

theorem adversary_cannot_distinguish :
  ∀ (E : Environment) (I : Implementation),
    env_observes_impl E I →
    env_observes_spec E (spec_of_impl I)


DERIVED: Definition named 'CornerTopologyOK' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition CornerTopologyOK (c : Corner) : bool :=
  (negb (nonce (e1 c) =? nonce (e2 c)) &&
   negb (nonce (e2 c) =? nonce (e3 c)) &&
   negb (nonce (e1 c) =? nonce (e3 c))) &&
  ((target_id (e1 c) =? target_node c) &&
   (target_id (e2 c) =? target_node c) &&
   (target_id (e3 c) =? target_node c)) &&
  ((timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
   (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
   (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))).

def CornerTopologyOK (c : Corner) : Bool


DERIVED: Definition named 'CornerK' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition CornerK (c : Corner) : bool :=
  J (e1 c) && J (e2 c) && J (e3 c) && CornerTopologyOK c.


DERIVED: Definition named 'WriteOK' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition WriteOK (c : Corner) (policyOK : bool) : bool :=
  CornerK c && policyOK.

def WriteOK (c : Corner) (policyOK : Bool) : Bool


DERIVED: Definition named 'evaluate_seam' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition evaluate_seam (e : SeamEvidence) : TypedThreshold :=
  {| time_passed    := timestamp e <=? expiry e;
     id_passed      := id_ok e;
     purpose_passed := purpose_ok e;
     lineage_passed := lineage_ok e;
     version_passed := version_ok e;
     scope_passed   := scope_ok e;
     attest_passed  := attest_ok e |}.

def evaluate_seam (e : SeamEvidence) : TypedThreshold


DERIVED: Definition named 'is_clean' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition is_clean (t : TypedThreshold) : bool :=
  time_passed t && id_passed t && purpose_passed t &&
  lineage_passed t && version_passed t && scope_passed t && attest_passed t.


DERIVED: Definition named 'evaluate_corner' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition evaluate_corner (c : Corner) (policyOK : bool) : CornerDiagnostics :=
  {| e1_diag := evaluate_seam (e1 c);
     e2_diag := evaluate_seam (e2 c);
     e3_diag := evaluate_seam (e3 c);
     topology_passed := CornerTopologyOK c;
     policy_passed := policyOK |}.

def evaluate_corner (c : Corner) (policyOK : Bool) : CornerDiagnostics


DERIVED: Definition named 'all_passed' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition all_passed (d : CornerDiagnostics) : bool :=
  is_clean (e1_diag d) && is_clean (e2_diag d) && is_clean (e3_diag d) &&
  topology_passed d && policy_passed d.


DERIVED: Theorem named 'seam_is_clean_eq_J' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem seam_is_clean_eq_J : forall e : SeamEvidence,
  J e = is_clean (evaluate_seam e).

theorem seam_is_clean_eq_J (e : SeamEvidence) :
  e.J = (evaluate_seam e).is_clean


DERIVED: Theorem named 'corner_authorization_iff_diagnostics_passed' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem corner_authorization_iff_diagnostics_passed : forall (c : Corner) (policyOK : bool),
  WriteOK c policyOK = all_passed (evaluate_corner c policyOK).

theorem corner_authorization_iff_diagnostics_passed (c : Corner) (policyOK : Bool) :
  WriteOK c policyOK = (evaluate_corner c policyOK).all_passed


DERIVED: Theorem named 'explainable_denial_identity' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_identity : forall c policyOK,
  id_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_identity (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).id_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_lineage : forall c policyOK,
  lineage_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_lineage (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).lineage_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_time_window : forall c policyOK,
  time_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_time_window (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).time_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_time_window_seam1 : forall c policyOK,
  time_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_time_window_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).time_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_purpose_seam1 : forall c policyOK,
  purpose_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_purpose_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).purpose_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_lineage_seam1 : forall c policyOK,
  lineage_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_lineage_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).lineage_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_version_seam1 : forall c policyOK,
  version_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_version_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).version_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_scope_seam1 : forall c policyOK,
  scope_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_scope_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).scope_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam1' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_attest_seam1 : forall c policyOK,
  attest_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_attest_seam1 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).attest_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_time_window_seam2 : forall c policyOK,
  time_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_time_window_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).time_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_identity_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_identity_seam2 : forall c policyOK,
  id_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_identity_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).id_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_purpose_seam2 : forall c policyOK,
  purpose_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_purpose_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).purpose_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_version_seam2 : forall c policyOK,
  version_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_version_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).version_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_scope_seam2 : forall c policyOK,
  scope_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_scope_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).scope_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam2' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_attest_seam2 : forall c policyOK,
  attest_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_attest_seam2 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).attest_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_identity_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_identity_seam3 : forall c policyOK,
  id_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_identity_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).id_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_purpose_seam3 : forall c policyOK,
  purpose_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_purpose_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).purpose_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_lineage_seam3 : forall c policyOK,
  lineage_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_lineage_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).lineage_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_version_seam3 : forall c policyOK,
  version_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

cubie-tools/src/main.rs topology-selftest subcommand (cargo run -p cubie-tools -- topology-selftest); cubie-tools/src/runtime_shadow.rs topology_selftest_fixture() -> cubie_core::cube_topology::cub_0815_zero_state_zero_dims; verus/cubie_bitboard_spec.rs + bare-metal-tests/tests/cube_topology_polytope.rs (test anchor)

Q0 plain candidate (cube_topology.rs): zero-state dimensional count witness is exercised on every topology-selftest run. TEST-ANCHORED host consumption; not admit hot-path.

theorem explainable_denial_version_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).version_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_scope_seam3 : forall c policyOK,
  scope_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_scope_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).scope_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam3' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_attest_seam3 : forall c policyOK,
  attest_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_attest_seam3 (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).attest_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_topology' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_topology : forall c policyOK,
  topology_passed (evaluate_corner c policyOK) = false -> WriteOK c policyOK = false.

theorem explainable_denial_topology (c : Corner) (policyOK : Bool) :
  (evaluate_corner c policyOK).topology_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_policy' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem explainable_denial_policy : forall c policyOK,
  policy_passed (evaluate_corner c policyOK) = false -> WriteOK c policyOK = false.

theorem explainable_denial_policy (c : Corner) (policyOK : Bool) :
  (evaluate_corner c policyOK).policy_passed = false → WriteOK c policyOK = false


DERIVED: Definition named 'wit_seam_a' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition wit_seam_a : SeamEvidence := {|
  nonce := 1; origin_id := 1; target_id := 5; privilege_level := 50;
  timestamp := 100; expiry := 200;
  id_ok := true; purpose_ok := true; lineage_ok := true;
  version_ok := true; scope_ok := true; attest_ok := true |}.


DERIVED: Definition named 'wit_seam_b' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition wit_seam_b : SeamEvidence := {|
  nonce := 2; origin_id := 2; target_id := 5; privilege_level := 50;
  timestamp := 110; expiry := 200;
  id_ok := true; purpose_ok := true; lineage_ok := true;
  version_ok := true; scope_ok := true; attest_ok := true |}.


DERIVED: Definition named 'wit_seam_c' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition wit_seam_c : SeamEvidence := {|
  nonce := 3; origin_id := 3; target_id := 5; privilege_level := 50;
  timestamp := 120; expiry := 200;
  id_ok := true; purpose_ok := true; lineage_ok := true;
  version_ok := true; scope_ok := true; attest_ok := true |}.


DERIVED: Definition named 'wit_corner' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Definition wit_corner : Corner := {|
  target_node := 5; exec_time := 150;
  e1 := wit_seam_a; e2 := wit_seam_b; e3 := wit_seam_c |}.


DERIVED: Theorem named 'good_corner_exists' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem good_corner_exists :
  exists (c : Corner) (policyOK : bool), WriteOK c policyOK = true.

theorem good_corner_exists :
  ∃ (c : Corner) (policyOK : Bool), WriteOK c policyOK = true


DERIVED: Theorem named 'bad_corner_exists' in the RamenCornerConsensusV1191 family -- registry statement: RCC v1.19.1

Theorem bad_corner_exists :
  exists (c : Corner) (policyOK : bool), WriteOK c policyOK = false.

theorem bad_corner_exists :
  ∃ (c : Corner) (policyOK : Bool), WriteOK c policyOK = false


DERIVED: Definition named 'CornerTopologyOK' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

def CornerTopologyOK (c : Corner) : Bool


DERIVED: Definition named 'CornerK' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'WriteOK' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

def WriteOK (c : Corner) (policyOK : Bool) : Bool


DERIVED: Definition named 'evaluate_seam' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

def evaluate_seam (e : SeamEvidence) : TypedThreshold


DERIVED: Definition named 'is_clean' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'evaluate_corner' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

def evaluate_corner (c : Corner) (policyOK : Bool) : CornerDiagnostics


DERIVED: Definition named 'all_passed' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Theorem named 'seam_is_clean_eq_J' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem seam_is_clean_eq_J (e : SeamEvidence) : e.J = (evaluate_seam e).is_clean


DERIVED: Theorem named 'corner_authorization_iff_diagnostics_passed' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem corner_authorization_iff_diagnostics_passed (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = (evaluate_corner c policyOK).all_passed


DERIVED: Theorem named 'explainable_denial_identity' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_identity (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).id_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_lineage (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).lineage_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_time_window (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).time_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_time_window_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).time_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_purpose_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).purpose_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_lineage_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).lineage_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_version_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).version_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_scope_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).scope_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_attest_seam1 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e1).attest_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

cubie-tools/src/main.rs output-state-selftest subcommand; cubie-tools/src/runtime_shadow.rs output_state_selftest_fixture() -> cubie_core::output_state_wiring::cub_0844_all_distinct_codes_hamming_8; cubie-core/src/output_state_wiring.rs exec witness (Q2 batch 2); verus/cubie_output_state_spec.rs cub_0844_all_distinct_codes_hamming_8; bare-metal-tests/tests/output_state.rs cub_0844_all_distinct_codes_hd_8_or_more

Q2 WIRE-ELIGIBLE batch 2: pairwise OutputState Hamming >= 8 witness on output-state-selftest face. TEST-ANCHORED advisory only.

theorem explainable_denial_time_window_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).time_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_identity_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_identity_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).id_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_purpose_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).purpose_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_version_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).version_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_scope_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).scope_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_attest_seam2 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e2).attest_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_identity_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_identity_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).id_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_purpose_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_purpose_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).purpose_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_lineage_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).lineage_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_version_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_version_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).version_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_scope_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_scope_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).scope_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_attest_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_attest_seam3 (c : Corner) (policyOK : Bool) :
    (evaluate_seam c.e3).attest_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_topology' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_topology (c : Corner) (policyOK : Bool) :
    (evaluate_corner c policyOK).topology_passed = false -> WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_policy' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem explainable_denial_policy (c : Corner) (policyOK : Bool) :
    (evaluate_corner c policyOK).policy_passed = false -> WriteOK c policyOK = false


DERIVED: Definition named 'wit_seam_a' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'wit_seam_b' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'wit_seam_c' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'wit_corner' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Theorem named 'good_corner_exists' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

file-local theorem numbering in the cited sources collides with this canonical ID; the wiring-audit evidence below describes the file-local theorem, not this record (see the CUB-ID DISAMBIGUATION markers)

theorem good_corner_exists : ∃ (c : Corner) (policyOK : Bool), WriteOK c policyOK = true


DERIVED: Theorem named 'bad_corner_exists' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem bad_corner_exists : ∃ (c : Corner) (policyOK : Bool), WriteOK c policyOK = false


DERIVED: Lemma named 'all_passed_decomp' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'is_clean_decomp' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Theorem named 'authorization_implies_time_window_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_time_window_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).time_passed = true


DERIVED: Theorem named 'authorization_implies_identity_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_identity_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).id_passed = true


DERIVED: Theorem named 'authorization_implies_purpose_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_purpose_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).purpose_passed = true


DERIVED: Theorem named 'authorization_implies_lineage_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_lineage_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).lineage_passed = true


DERIVED: Theorem named 'authorization_implies_version_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_version_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).version_passed = true


DERIVED: Theorem named 'authorization_implies_scope_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_scope_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).scope_passed = true


DERIVED: Theorem named 'authorization_implies_attest_seam1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_attest_seam1 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e1).attest_passed = true


DERIVED: Theorem named 'authorization_implies_time_window_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_time_window_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).time_passed = true


DERIVED: Theorem named 'authorization_implies_identity_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_identity_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).id_passed = true


DERIVED: Theorem named 'authorization_implies_purpose_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_purpose_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).purpose_passed = true


DERIVED: Theorem named 'authorization_implies_lineage_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_lineage_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).lineage_passed = true


DERIVED: Theorem named 'authorization_implies_version_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_version_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).version_passed = true


DERIVED: Theorem named 'authorization_implies_scope_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_scope_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).scope_passed = true


DERIVED: Theorem named 'authorization_implies_attest_seam2' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_attest_seam2 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e2).attest_passed = true


DERIVED: Theorem named 'authorization_implies_time_window_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_time_window_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).time_passed = true


DERIVED: Theorem named 'authorization_implies_identity_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_identity_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).id_passed = true


DERIVED: Theorem named 'authorization_implies_purpose_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_purpose_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).purpose_passed = true


DERIVED: Theorem named 'authorization_implies_lineage_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_lineage_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).lineage_passed = true


DERIVED: Theorem named 'authorization_implies_version_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_version_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).version_passed = true


DERIVED: Theorem named 'authorization_implies_scope_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_scope_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).scope_passed = true


DERIVED: Theorem named 'authorization_implies_attest_seam3' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_attest_seam3 (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_seam c.e3).attest_passed = true


DERIVED: Theorem named 'authorization_implies_topology' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_topology (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_corner c policyOK).topology_passed = true


DERIVED: Theorem named 'authorization_implies_policy' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem authorization_implies_policy (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = true -> (evaluate_corner c policyOK).policy_passed = true


DERIVED: Definition named 'bool_to_failure' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'seam_failure_count' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'all_passed_count' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Definition named 'denial_count' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'sum_zero_iff' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'bool_to_failure_zero_iff' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'bool_to_failure_le_1' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'seam_failure_count_zero_iff' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'seam_failure_count_le_7' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Lemma named 'all_passed_count_zero_iff' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner


DERIVED: Theorem named 'denial_count_zero_iff_authorized' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem denial_count_zero_iff_authorized (c : Corner) (policyOK : Bool) :
    denialCount c policyOK = 0 ↔ WriteOK c policyOK = true


DERIVED: Theorem named 'denial_count_positive_iff_denied' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem denial_count_positive_iff_denied (c : Corner) (policyOK : Bool) :
    denialCount c policyOK > 0 ↔ WriteOK c policyOK = false


DERIVED: Theorem named 'denial_count_bounded' in the RamenCornerConsensusV1192 family -- registry statement: V1.19.2 Ramen Corner

theorem denial_count_bounded (c : Corner) (policyOK : Bool) : denialCount c policyOK ≤ 23


DERIVED: Definition named 'seam_J' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition seam_J (e : SeamEvidence) : bool :=
  Nat.leb (se_timestamp e) (se_expiry e) &&
  se_id_ok e && se_purpose_ok e && se_lineage_ok e &&
  se_version_ok e && se_scope_ok e && se_attest_ok e.


DERIVED: Definition named 'cornerTopologyOK' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition cornerTopologyOK (c : Corner) : bool :=
  (negb (Nat.eqb (se_nonce (co_e1 c)) (se_nonce (co_e2 c))) &&
   negb (Nat.eqb (se_nonce (co_e2 c)) (se_nonce (co_e3 c))) &&
   negb (Nat.eqb (se_nonce (co_e1 c)) (se_nonce (co_e3 c)))) &&
  (Nat.eqb (se_target_id (co_e1 c)) (co_target_node c) &&
   Nat.eqb (se_target_id (co_e2 c)) (co_target_node c) &&
   Nat.eqb (se_target_id (co_e3 c)) (co_target_node c)) &&
  (Nat.leb (se_timestamp (co_e1 c)) (co_exec_time c) &&
   Nat.leb (co_exec_time c) (se_expiry (co_e1 c)) &&
   Nat.leb (se_timestamp (co_e2 c)) (co_exec_time c) &&
   Nat.leb (co_exec_time c) (se_expiry (co_e2 c)) &&
   Nat.leb (se_timestamp (co_e3 c)) (co_exec_time c) &&
   Nat.leb (co_exec_time c) (se_expiry (co_e3 c))).


DERIVED: Definition named 'corner_K' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition corner_K (c : Corner) : bool :=
  seam_J (co_e1 c) && seam_J (co_e2 c) && seam_J (co_e3 c) &&
  cornerTopologyOK c.


DERIVED: Definition named 'writeOK' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition writeOK (c : Corner) (policyOK : bool) : bool :=
  corner_K c && policyOK.


DERIVED: Definition named 'project_seam' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition project_seam (e : SeamEvidence) : SeamSurface :=
  mkSeamSurface
    (se_nonce e) (se_origin_id e) (se_target_id e)
    (se_privilege_level e) (se_timestamp e) (se_expiry e).

def project_seam (e : SeamEvidence) : SeamSurface


DERIVED: Definition named 'project_corner' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition project_corner (c : Corner) : CornerSurface :=
  mkCornerSurface
    (co_target_node c) (co_exec_time c)
    (project_seam (co_e1 c))
    (project_seam (co_e2 c))
    (project_seam (co_e3 c)).

def project_corner (c : Corner) : CornerSurface


DERIVED: Definition named 'seam_surface_eq' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition seam_surface_eq (a b : SeamSurface) : bool :=
  Nat.eqb (ss_nonce a) (ss_nonce b) &&
  Nat.eqb (ss_origin_id a) (ss_origin_id b) &&
  Nat.eqb (ss_target_id a) (ss_target_id b) &&
  Nat.eqb (ss_privilege_level a) (ss_privilege_level b) &&
  Nat.eqb (ss_timestamp a) (ss_timestamp b) &&
  Nat.eqb (ss_expiry a) (ss_expiry b).


DERIVED: Definition named 'corner_surface_eq' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition corner_surface_eq (a b : CornerSurface) : bool :=
  Nat.eqb (cs_target_node a) (cs_target_node b) &&
  Nat.eqb (cs_exec_time a) (cs_exec_time b) &&
  seam_surface_eq (cs_e1 a) (cs_e1 b) &&
  seam_surface_eq (cs_e2 a) (cs_e2 b) &&
  seam_surface_eq (cs_e3 a) (cs_e3 b).


DERIVED: Definition named 'wit_seam_a_pass' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_seam_a_pass : SeamEvidence :=
  mkSeamEvidence 1 11 100 1 10 100 true true true true true true.


DERIVED: Definition named 'wit_seam_a_fail' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_seam_a_fail : SeamEvidence :=
  mkSeamEvidence 1 11 100 1 10 100 false true true true true true.


DERIVED: Definition named 'wit_seam_b' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_seam_b : SeamEvidence :=
  mkSeamEvidence 2 22 100 1 10 100 true true true true true true.


DERIVED: Definition named 'wit_seam_c' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_seam_c : SeamEvidence :=
  mkSeamEvidence 3 33 100 1 10 100 true true true true true true.


DERIVED: Definition named 'wit_corner_genuine' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_corner_genuine : Corner :=
  mkCorner 100 50 wit_seam_a_pass wit_seam_b wit_seam_c.


DERIVED: Definition named 'wit_corner_spoof' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Definition wit_corner_spoof : Corner :=
  mkCorner 100 50 wit_seam_a_fail wit_seam_b wit_seam_c.


DERIVED: Lemma named 'wit_corners_same_surface' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Lemma wit_corners_same_surface :
  project_corner wit_corner_genuine = project_corner wit_corner_spoof.


DERIVED: Lemma named 'wit_genuine_K_true' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Lemma wit_genuine_K_true :
  corner_K wit_corner_genuine = true.


DERIVED: Lemma named 'wit_spoof_K_false' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Lemma wit_spoof_K_false :
  corner_K wit_corner_spoof = false.


DERIVED: Theorem named 'corner_surface_spoofing_separation' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Theorem corner_surface_spoofing_separation :
  exists c1 c2 : Corner,
    project_corner c1 = project_corner c2 /\
    corner_K c1 = true /\
    corner_K c2 = false.

theorem corner_surface_spoofing_separation :
    ∃ c1 c2 : Corner,
      project_corner c1 = project_corner c2 ∧
      c1.K = true ∧
      c2.K = false


DERIVED: Theorem named 'writeOK_not_corner_surface_determined' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Theorem writeOK_not_corner_surface_determined :
  ~ (forall c1 c2 : Corner,
      project_corner c1 = project_corner c2 ->
      writeOK c1 true = writeOK c2 true).

theorem writeOK_not_corner_surface_determined :
    ¬ (∀ c1 c2 : Corner,
        project_corner c1 = project_corner c2 →
        WriteOK c1 true = WriteOK c2 true)