0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1681_bexar_pow_le_pow_base: depends on axioms: propext; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'bexar_pow_le_pow_base' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1681_bexar_pow_le_pow_base : forall a b n, a <= b -> a ^ n <= b ^ n.

theorem cub_1681_bexar_pow_le_pow_base (a b n : Nat) (h : a ≤ b) : a ^ n ≤ b ^ n

proof fn cub_1681_bexar_pow_le_pow_base(a: nat, b: nat, n: nat)
    requires a <= b
    ensures bexar_pow(a, n) <= bexar_pow(b, n)
    decreases n


AXIOM-FREE (0 axioms, live coqc/coqchk-verified)

0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1682_witness_64_byte_atomic: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'witness_64_byte_atomic' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

(empty -- not bound to any bare-metal exec fn/crate)

Coq kernel-checked 8.18.0 (coqc+coqchk live, 2026-08-15); Verus PENDING-VERUS-KERNEL; Lean kernel-checked 4.30.0

proof fn cub_1682_witness_64_byte_atomic() ensures bexar_field_sum() == 64

PENDING -- verus binary not on PATH in this workspace


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1683_belnap_idem: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'belnap_idem' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1683_belnap_idem : forall a : bool, (a && a)%bool = a.

theorem cub_1683_belnap_idem (a : Bool) : (a && a) = a

proof fn cub_1683_belnap_idem(a: bool) ensures bexar_meet(a, a) == a


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1684_belnap_top_unit: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'belnap_top_unit' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1684_belnap_top_unit : forall a : bool, (a && true)%bool = a.

theorem cub_1684_belnap_top_unit (a : Bool) : (a && true) = a

proof fn cub_1684_belnap_top_unit(a: bool) ensures bexar_meet(a, true) == a


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1685_belnap_assoc: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'belnap_assoc' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1685_belnap_assoc : forall a b c : bool, ((a && b) && c)%bool = (a && (b && c))%bool.

theorem cub_1685_belnap_assoc (a b c : Bool) : ((a && b) && c) = (a && (b && c))

proof fn cub_1685_belnap_assoc(a: bool, b: bool, c: bool)
    ensures bexar_meet(bexar_meet(a, b), c) == bexar_meet(a, bexar_meet(b, c))


Coq: AXIOM-FREE (0 axioms, live coqc/coqchk-verified) | Lean: NOT AXIOM-FREE -- depends on: propext

0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1686_vn_symmetry: depends on axioms: propext; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'vn_symmetry' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1686_vn_symmetry : forall a b x : bool,
  (if negb a && b then Some false else if a && negb b then Some true else None) = Some x ->
  (if negb b && a then Some false else if b && negb a then Some true else None) = Some (negb x).

theorem cub_1686_vn_symmetry (a b x : Bool)
    (h : (if !a && b then some false else if a && !b then some true else none) = some x) :
    (if !b && a then some false else if b && !a then some true else none) = some (!x)

proof fn cub_1686_vn_symmetry(a: bool, b: bool, x: bool)
    requires bexar_vn_extract(a, b) == Some(x)
    ensures bexar_vn_extract(b, a) == Some(!x)


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1687_surface_spoofing_kill: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'surface_spoofing_kill' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1687_surface_spoofing_kill : forall jid jpur jtime jver jsco : bool,
  negb (jid && jpur && jtime && false && jver && jsco) = true.

theorem cub_1687_surface_spoofing_kill (jid jpur jtime jver jsco : Bool) :
    !(jid && jpur && jtime && false && jver && jsco) = true

proof fn cub_1687_surface_spoofing_kill(jid: bool, jpur: bool, jtime: bool, jver: bool, jsco: bool)
    ensures !bexar_seam(jid, jpur, jtime, false, jver, jsco)


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1688_seam_requires_lineage: depends on axioms: propext; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'seam_requires_lineage' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1688_seam_requires_lineage : forall jid jpur jtime jlin jver jsco : bool,
  (jid && jpur && jtime && jlin && jver && jsco)%bool = true -> jlin = true.

theorem cub_1688_seam_requires_lineage (jid jpur jtime jlin jver jsco : Bool)
    (h : jid && jpur && jtime && jlin && jver && jsco = true) : jlin = true

proof fn cub_1688_seam_requires_lineage(jid: bool, jpur: bool, jtime: bool, jlin: bool, jver: bool, jsco: bool)
    requires bexar_seam(jid, jpur, jtime, jlin, jver, jsco)
    ensures jlin


Coq: AXIOM-FREE (0 axioms, live coqc/coqchk-verified) | Lean: NOT AXIOM-FREE -- depends on: propext, Classical.choice, Quot.sound

0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1689_goodput_no_overcommit: depends on axioms: propext, Classical.choice, Quot.sound; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'goodput_no_overcommit' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1689_goodput_no_overcommit : forall pool cost,
  cost <= pool -> cost + (pool - cost) = pool /\ (pool - cost) <= pool.

theorem cub_1689_goodput_no_overcommit (pool cost : Nat) (h : cost ≤ pool) :
    cost + (pool - cost) = pool ∧ (pool - cost) ≤ pool

proof fn cub_1689_goodput_no_overcommit(pool: nat, cost: nat)
    requires cost <= pool
    ensures cost + (pool - cost) == pool && (pool - cost) <= pool


Coq: AXIOM-FREE (0 axioms, live coqc/coqchk-verified) | Lean: NOT AXIOM-FREE -- depends on: propext, Quot.sound

0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1690_ha_fail_closed: depends on axioms: propext, Quot.sound; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'ha_fail_closed' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1690_ha_fail_closed : forall base,
  bexar_applied_cost base false <= bexar_applied_cost base true.

theorem cub_1690_ha_fail_closed (base : Nat) :
    bexarAppliedCost base false ≤ bexarAppliedCost base true

proof fn cub_1690_ha_fail_closed(base: nat)
    ensures bexar_applied_cost(base, false) <= bexar_applied_cost(base, true)


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.

AUDIT-ONLY -- no theorem_name in master_theorem_table.csv; kernel status not tracked at row level

AUDIT-ONLY (wiring/invocation only, no theorem_name/statement in source)


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1709_two_pow_pos: depends on axioms: propext; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'two_pow_pos' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1709_two_pow_pos : forall n, 2 ^ n >= 1.

theorem cub_1709_two_pow_pos (n : Nat) : 2 ^ n ≥ 1

proof fn cub_1709_two_pow_pos(n: nat)
    ensures dm_pow(2, n) >= 1
    decreases n


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1710_n_lt_two_pow: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'n_lt_two_pow' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1710_n_lt_two_pow : forall n, n < 2 ^ n.

theorem cub_1710_n_lt_two_pow (n : Nat) : n < 2 ^ n

proof fn cub_1710_n_lt_two_pow(n: nat)
    ensures n < dm_pow(2, n)
    decreases n


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1711_drive_pow_le_pow_base: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'drive_pow_le_pow_base' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1711_drive_pow_le_pow_base : forall a b n, a <= b -> a ^ n <= b ^ n.

theorem cub_1711_drive_pow_le_pow_base (a b n : Nat) (h : a ≤ b) : a ^ n ≤ b ^ n

proof fn cub_1711_drive_pow_le_pow_base(a: nat, b: nat, n: nat)
    requires a <= b
    ensures dm_pow(a, n) <= dm_pow(b, n)
    decreases n


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1712_geometric_complexity_futility: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'geometric_complexity_futility' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1712_geometric_complexity_futility : forall B base, 2 <= base -> B < dm_coord_chain base B.

theorem cub_1712_geometric_complexity_futility (B base : Nat) (h : 2 ≤ base) :
    B < base ^ B

proof fn cub_1712_geometric_complexity_futility(bb: nat, base: nat)
    requires 2 <= base
    ensures bb < dm_coord_chain(base, bb)


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1713_hypercontraction_decay: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'hypercontraction_decay' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1713_hypercontraction_decay : forall f w n, f <= w -> f ^ n <= w ^ n.

theorem cub_1713_hypercontraction_decay (f w n : Nat) (h : f ≤ w) : f ^ n ≤ w ^ n

proof fn cub_1713_hypercontraction_decay(f: nat, w: nat, n: nat)
    requires f <= w
    ensures dm_pow(f, n) <= dm_pow(w, n)


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1714_fano_error_lower_bound: depends on axioms: propext, Quot.sound; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'fano_error_lower_bound' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1714_fano_error_lower_bound : forall rr ii errs,
  rr <= ii + errs -> rr - ii <= errs.

theorem cub_1714_fano_error_lower_bound (rr ii errs : Nat) (h : rr ≤ ii + errs) :
    rr - ii ≤ errs

proof fn cub_1714_fano_error_lower_bound(rr: nat, ii: nat, errs: nat)
    requires rr <= ii + errs
    ensures rr - ii <= errs


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1715_kl_zero_leak_no_advantage: depends on axioms: propext, Quot.sound; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'kl_zero_leak_no_advantage' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1715_kl_zero_leak_no_advantage : forall adv leak,
  adv <= leak -> leak = 0 -> adv = 0.

theorem cub_1715_kl_zero_leak_no_advantage (adv leak : Nat) (h1 : adv ≤ leak) (h2 : leak = 0) :
    adv = 0

proof fn cub_1715_kl_zero_leak_no_advantage(adv: nat, leak: nat)
    requires adv <= leak, leak == 0
    ensures adv == 0


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1716_topological_entropy_exponential: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'topological_entropy_exponential' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1716_topological_entropy_exponential : forall n, n < dm_separated_orbits n.

theorem cub_1716_topological_entropy_exponential (n : Nat) : n < 2 ^ n

proof fn cub_1716_topological_entropy_exponential(n: nat)
    ensures n < dm_separated_orbits(n)


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1717_power_law_monotone: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'power_law_monotone' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1717_power_law_monotone : forall tau tau2 alpha,
  tau <= tau2 -> tau ^ alpha <= tau2 ^ alpha.

theorem cub_1717_power_law_monotone (tau tau2 alpha : Nat) (h : tau ≤ tau2) :
    tau ^ alpha ≤ tau2 ^ alpha

proof fn cub_1717_power_law_monotone(tau: nat, tau2: nat, alpha: nat)
    requires tau <= tau2
    ensures dm_pow(tau, alpha) <= dm_pow(tau2, alpha)


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1718_holevo_accessible_bounded: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'holevo_accessible_bounded' in the CubieDriveMathV1_3Omega family -- registry statement: Drive Math

Theorem cub_1718_holevo_accessible_bounded : forall acc ent cap,
  acc <= ent -> ent <= cap -> acc <= cap.

theorem cub_1718_holevo_accessible_bounded (acc ent cap : Nat) (h1 : acc ≤ ent) (h2 : ent ≤ cap) :
    acc ≤ cap

proof fn cub_1718_holevo_accessible_bounded(acc: nat, ent: nat, cap: nat)
    requires acc <= ent, ent <= cap
    ensures acc <= cap


none (Lean 0 sorry/0 axiom; Coq coqc pass)

DERIVED: Theorem named 'cub_1921_a_page_recursion_correctness' in the CubieCusumAggregator family -- registry statement: Page-CUSUM per-cell recurrence (TEP FAR=0 detector)

Theorem cub_1921_a_page_recursion_correctness :
  forall s z1 z2 k, z1 <= z2 ->
    0 <= cusum_step s z1 k /\ cusum_step s z1 k <= cusum_step s z2 k.

not stated in registry status for this row

theorem cub_1921_a_page_recursion_correctness (s z1 z2 k : Int) (h : z1 ≤ z2) :
    cusumStep s z1 k ≥ 0 ∧ cusumStep s z1 k ≤ cusumStep s z2 k

pub proof fn cub_1921_a_page_recursion_correctness(s: int, z1: int, z2: int, k: int)
    requires
        z1 <= z2,
    ensures
        cusum_step(s, z1, k) >= 0,
        cusum_step(s, z2, k) >= 0,
        cusum_step(s, z1, k) <= cusum_step(s, z2, k),


DERIVED: Theorem named 'CUB2041HolographicExhaustivenessClosed' in the HolographicExhaustivenessClosed family -- registry statement: V6.0 Omega Holographic Exhaustiveness (closed)

Theorem CUB2041HolographicExhaustivenessClosed :
  forall c : AdvClass,
    AdvPlusMisalignment c \/
    AdvEventHorizon c \/
    AdvConditionalLineage c \/
    AdvCausalDiscontinuity c \/
    AdvNonLinearTwist c \/
    AdvPercolation c \/
    AdvToolchain c.


DERIVED: Theorem named 'CUB2043_attention_bomb_mitigation' in the TorPreAdmission family -- registry statement: ToR Pre-Admission

Theorem CUB2043_attention_bomb_mitigation :
  forall w,
    head_shape_ok w = false ->
    allow (tor_pre_admit w) = false /\
    reason (tor_pre_admit w) = DenyHeadShape.

theorem CUB2043_attention_bomb_mitigation (w : TorWorkload) :
    headShapeOk w = false ->
    (torPreAdmit w).allow = false ∧
    (torPreAdmit w).reason = TorDeny.headShape


DERIVED: Theorem named 'CUB2044_deterministic_vram_shield' in the TorPreAdmission family -- registry statement: ToR Pre-Admission

Theorem CUB2044_deterministic_vram_shield :
  forall w,
    head_shape_ok w = true ->
    dimensions_nonzero w = true ->
    node_binding_ok w = true ->
    vram_envelope_ok w = false ->
    allow (tor_pre_admit w) = false /\
    reason (tor_pre_admit w) = DenyVramEnvelope.

theorem CUB2044_deterministic_vram_shield (w : TorWorkload) :
    headShapeOk w = true ->
    dimensionsNonzero w = true ->
    nodeBindingOk w = true ->
    vramEnvelopeOk w = false ->
    (torPreAdmit w).allow = false ∧
    (torPreAdmit w).reason = TorDeny.vramEnvelope


DERIVED: Theorem named 'CUB2045_cryptographic_node_binding' in the TorPreAdmission family -- registry statement: ToR Pre-Admission

Theorem CUB2045_cryptographic_node_binding :
  forall w,
    head_shape_ok w = true ->
    dimensions_nonzero w = true ->
    node_binding_ok w = false ->
    allow (tor_pre_admit w) = false /\
    reason (tor_pre_admit w) = DenyNodeBinding.

theorem CUB2045_cryptographic_node_binding (w : TorWorkload) :
    headShapeOk w = true ->
    dimensionsNonzero w = true ->
    nodeBindingOk w = false ->
    (torPreAdmit w).allow = false ∧
    (torPreAdmit w).reason = TorDeny.nodeBinding


DERIVED: Theorem named 'CUB2046_resource_monotonicity' in the TorPreAdmission family -- registry statement: ToR Pre-Admission

Theorem CUB2046_resource_monotonicity :
  forall parent child,
    resource_subprofile_within parent child ->
    kv_cache_required_bytes child <= kv_cache_required_bytes parent.

theorem CUB2046_resource_monotonicity (parent child : TorWorkload) :
    resourceSubprofileWithin parent child ->
    kvCacheRequiredBytes child <= kvCacheRequiredBytes parent


DERIVED: Theorem named 'CUB2049RedblueL06ParityClosed' in the RedblueL06ParityClosed family -- registry statement: Redblue L0.6 Parity

Theorem CUB2049RedblueL06ParityClosed :
  forall adapter_id efuse_or : nat,
    full_l06_denies adapter_id efuse_or = batch_l06_denies adapter_id efuse_or.


DERIVED: Theorem named 'CUB2050OpaL05CrossPathSymmetryClosed' in the OpaL05CrossPathSymmetryClosed family -- registry statement: OPA L0.5 Cross-Path Symmetry

Theorem CUB2050OpaL05CrossPathSymmetryClosed :
  forall fp : nat, g_full fp = g_batch fp.


DERIVED: Theorem named 'cub_2051_a_observe_mode_admit_neutral' in the CubieDetectorAttachment family -- registry statement: Cubie Detector Attachment

Theorem cub_2051_a_observe_mode_admit_neutral :
  forall admit_v detector_fire, admit_observe admit_v detector_fire = admit_v.

theorem cub_2051_a_observe_mode_admit_neutral (admitV detectorFire : Bool) :
    admitObserve admitV detectorFire = admitV

pub proof fn cub_2051_a_observe_mode_admit_neutral(admit_v: bool, detector_fire: bool)
    ensures
        admit_observe(admit_v, detector_fire) == admit_v,


DERIVED: Theorem named 'CUB2052SpecidRecordZero' in the TcgEventLogClosed family -- registry statement: TCG Event Log (RTMR)

Theorem CUB2052SpecidRecordZero :
  forall e, is_specid_header e -> pcr_index e = 0 /\ event_type e = ev_no_action.


DERIVED: Theorem named 'CUB2053DigestSha384' in the TcgEventLogClosed family -- registry statement: TCG Event Log (RTMR)

Theorem CUB2053DigestSha384 :
  forall e, wf_measurement e ->
    digest_alg e = tpm_alg_sha384 /\ length (digest e) = sha384_len.


DERIVED: Theorem named 'CUB2054RtmrPcrInjective' in the TcgEventLogClosed family -- registry statement: TCG Event Log (RTMR)

Theorem CUB2054RtmrPcrInjective :
  forall a b, rtmr_to_pcr a = rtmr_to_pcr b -> a = b.


DERIVED: Theorem named 'CUB2055RoundTrip' in the TcgEventLogClosed family -- registry statement: TCG Event Log (RTMR)

Theorem CUB2055RoundTrip : forall e, parse (serialize e) = e.


DERIVED: Theorem named 'CUB2056LogSizeCons' in the TcgEventLogClosed family -- registry statement: TCG Event Log (RTMR)

Theorem CUB2056LogSizeCons :
  forall e rest, log_size (e :: rest) = record_size e + log_size rest.


DERIVED: Theorem named 'cub_2057_deny_preserves_seal_state' in the FeedStampedDenyBeforeMutate family -- registry statement: Admit Pipeline Proof Binding

Theorem cub_2057_deny_preserves_seal_state :
  forall (s : SealState) (r : FeedReq),
    returns_admitted s r = false ->
    after_state s r = s.

theorem cub_2057_deny_preserves_seal_state (s : SealState) (r : FeedReq) :
    returnsAdmitted s r = false → afterState s r = s

pub proof fn cub_2057_deny_preserves_seal_state(s: SealState, r: FeedReq)
    requires
        returns_admitted(s, r) == false,
    ensures
        after_state(s, r) == s,


DERIVED: Theorem named 'cub_2058_flush_resets_to_identity_storage_baseline' in the BatchFlushFluidBaseline family -- registry statement: Admit Pipeline Proof Binding

Theorem cub_2058_flush_resets_to_identity_storage_baseline :
  forall
    (wreath_digest : list nat -> nat)
    (level2_chain_update : nat -> DigestSlots -> nat -> nat)
    (s : BatchSealState),
    wreath_count (flush_level_model wreath_digest level2_chain_update s) = 0
    /\ wreath_slots (flush_level_model wreath_digest level2_chain_update s) = storage_reset_baseline
    /\ length (wreath_slots (flush_level_model wreath_digest level2_chain_update s)) = wreath_window
    /\ (forall x, In x (wreath_slots (flush_level_model wreath_digest level2_chain_update s)) -> x = identity_flit).

theorem cub_2058_flush_resets_to_identity_storage_baseline
    (wreathDigest : List Nat -> Nat)
    (level2ChainUpdate : Nat -> DigestSlots -> Nat -> Nat)
    (s : BatchSealState) :
    (flushLevelModel wreathDigest level2ChainUpdate s).wreathCount = 0
    ∧ (flushLevelModel wreathDigest level2ChainUpdate s).wreathSlots = storageResetBaseline
    ∧ (flushLevelModel wreathDigest level2ChainUpdate s).wreathSlots.length = wreathWindow
    ∧ ∀ x ∈ (flushLevelModel wreathDigest level2ChainUpdate s).wreathSlots, x = identityFlit

pub proof fn cub_2058_flush_resets_to_identity_storage_baseline(s: BatchSealState)
    ensures
        flush_level_model(s).wreath_count == 0,
        flush_level_model(s).wreath_slots == storage_reset_baseline(),
        flush_level_model(s).wreath_slots.len() == wreath_window(),
        forall|i: int| 0 <= i < wreath_window()
            ==> flush_level_model(s).wreath_slots[i] == identity_flit(),


DERIVED: Theorem named 'cub_2059_enforce_err_fails_closed' in the Art50FailClosed family -- registry statement: EU AI Act Art.50 Gate

Theorem cub_2059_enforce_err_fails_closed :
  enforce SErr = Reject.

theorem cub_2059_enforce_err_fails_closed : enforce .err = .reject

pub proof fn cub_2059_enforce_err_fails_closed()
    ensures
        enforce(SimResult::Err) == Decision::Reject,


DERIVED: Theorem named 'cub_2060_non_pregate_slot_no_mutation' in the MovementSignedAdmit family -- registry statement: Admit Pipeline Proof Binding

Theorem cub_2060_non_pregate_slot_no_mutation :
  forall (r : MoveReq) (key_slot : nat),
    key_slot <> 7 ->
    after r key_slot = r /\ admitted r key_slot = false.

PENDING -- coqc/coqchk not on PATH in this workspace

feature-gated signed-movement admit path: proof/runtime wiring exists, but do not count as deployable until the exact Coq mirror hash is kernel-checked and the signed movement gate is enabled for release

theorem cub_2060_non_pregate_slot_no_mutation (r : MoveReq) (keySlot : Nat) (h : keySlot ≠ 7) :
    afterReq r keySlot = r ∧ admitted r keySlot = false

pub proof fn cub_2060_non_pregate_slot_no_mutation(r: MoveReq, key_slot: u64)
    requires
        key_slot != 7,
    ensures
        after(r, key_slot) == r,
        admitted(r, key_slot) == false,


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.


DERIVED: Theorem named 'intra_realm_requires_subgroup_closure' in the C4AuthorizationGateV2_6 family -- registry statement: CUB integration: cubie-platform

Theorem intra_realm_requires_subgroup_closure :
  forall op : BoundaryCrossingOp,
       is_external op = false ->
       source_realm op = target_realm op ->
       intra_realm_subgroup_closed op true = true.

theorem intra_realm_requires_subgroup_closure (op : BoundaryCrossingOp) :
    op.is_external = false →
    op.source_realm = op.target_realm →
    intra_realm_subgroup_closed op true = true


DERIVED: theorem named 'audit_count_monotone' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem audit_count_monotone (req pol : CubeFlit) :
    (evaluate req pol).auditCount = req.auditCount ∨
    (evaluate req pol).auditCount = req.auditCount + 1


DERIVED: theorem named 'compromised_excluded_from_wreath' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem compromised_excluded_from_wreath
    (s : ApprovedSwarm) (n : CubeFlit) (h : n ∈ s.nodes) :
    n.spoofed = false ∧ n.veFault = false ∧ n.sBitSecure = true ∧
    n.state = HwState.pass


DERIVED: theorem named 'misalignment_triggers_amputation' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem misalignment_triggers_amputation
    (req pol : CubeFlit) (h_al : req.aligned64 = false) :
    (evaluate req pol).state = HwState.tamper ∧
    (evaluate req pol).auditCount = req.auditCount + 1


DERIVED: theorem named 'pass_implies_hwCorrect' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem pass_implies_hwCorrect (req pol : CubeFlit) :
    (evaluate req pol).state = HwState.pass →
    hwCorrect req = true


Lean not assessed in 2026-07-02 import; Coq none (coqchk 2026-08-13)

DERIVED: theorem named 'pass_implies_meet_pass' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

Theorem pass_implies_meet_pass :
  forall req pol : CubeFlit,
    state (evaluate req pol) = HPass ->
    hwMeet (state req) (state pol) = HPass.

theorem pass_implies_meet_pass (req pol : CubeFlit) :
    (evaluate req pol).state = HwState.pass →
    hwMeet req.state pol.state = HwState.pass


DERIVED: theorem named 'sbit_violation_triggers_amputation' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem sbit_violation_triggers_amputation
    (req pol : CubeFlit) (h_sb : req.sBitSecure = false) :
    (evaluate req pol).state = HwState.tamper ∧
    (evaluate req pol).auditCount = req.auditCount + 1


DERIVED: theorem named 'spoof_triggers_amputation' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem spoof_triggers_amputation (req pol : CubeFlit) (h_sp : req.spoofed = true) :
    (evaluate req pol).state = HwState.tamper ∧
    (evaluate req pol).auditCount = req.auditCount + 1


DERIVED: theorem named 've_triggers_amputation' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem ve_triggers_amputation (req pol : CubeFlit) (h_ve : req.veFault = true) :
    (evaluate req pol).state = HwState.tamper ∧
    (evaluate req pol).auditCount = req.auditCount + 1


DERIVED: theorem named 'zero_data_movement_cache' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem zero_data_movement_cache (req pol : CubeFlit) :
    (evaluate req pol).cacheLine = req.cacheLine


DERIVED: theorem named 'zero_data_movement_rdtsc' in the CentillionTrustFabric family -- registry statement: CUB integration: cubie-platform

theorem zero_data_movement_rdtsc (req pol : CubeFlit) :
    (evaluate req pol).rdtsc = req.rdtsc


DERIVED: Theorem named 'and_commutative' in the CubieAndTruthTableV8_0 family -- registry statement: CUB integration: cubie-core

Theorem and_commutative :
  forall (a b : nat),
    cell_valid a -> cell_valid b ->
    cell_and a b = cell_and b a.

theorem and_commutative (a b : Nat) (ha : cellValid a) (hb : cellValid b) :
    cellAnd a b = cellAnd b a


DERIVED: Theorem named 'and_monotone' in the CubieAndTruthTableV8_0 family -- registry statement: CUB integration: cubie-core

Theorem and_monotone :
  forall (a b : nat),
    cell_valid a -> cell_valid b ->
    cell_and a b <= a /\ cell_and a b <= b.

theorem and_monotone (a b : Nat) (ha : cellValid a) (hb : cellValid b) :
    cellAnd a b ≤ a ∧ cellAnd a b ≤ b


DERIVED: Theorem named 'tamper_absorbing' in the CubieAndTruthTableV8_0 family -- registry statement: CUB integration: cubie-core

Theorem tamper_absorbing :
  forall (x : nat),
    cell_valid x ->
    cell_and CELL_TAMPER x = CELL_TAMPER.

theorem tamper_absorbing (x : Nat) (hx : cellValid x) :
    cellAnd CELL_TAMPER x = CELL_TAMPER


DERIVED: Theorem named 'tamper_absorbing_right' in the CubieAndTruthTableV8_0 family -- registry statement: CUB integration: cubie-core

Theorem tamper_absorbing_right :
  forall (x : nat),
    cell_valid x ->
    cell_and x CELL_TAMPER = CELL_TAMPER.

theorem tamper_absorbing_right (x : Nat) (hx : cellValid x) :
    cellAnd x CELL_TAMPER = CELL_TAMPER


DERIVED: Theorem named 'tamper_only_from_contradiction' in the CubieAndTruthTableV8_0 family -- registry statement: CUB integration: cubie-core

Theorem tamper_only_from_contradiction :
  cell_and CELL_PASS CELL_PASS <> CELL_TAMPER /\
  cell_and CELL_FAIL CELL_FAIL <> CELL_TAMPER /\
  cell_and CELL_FLUID CELL_FLUID <> CELL_TAMPER /\
  cell_and CELL_FLUID CELL_PASS <> CELL_TAMPER /\
  cell_and CELL_FLUID CELL_FAIL <> CELL_TAMPER /\
  cell_and CELL_PASS CELL_FAIL = CELL_TAMPER /\
  cell_and CELL_FAIL CELL_PASS = CELL_TAMPER.

theorem tamper_only_from_contradiction :
    cellAnd CELL_PASS CELL_PASS ≠ CELL_TAMPER ∧
    cellAnd CELL_FAIL CELL_FAIL ≠ CELL_TAMPER ∧
    cellAnd CELL_FLUID CELL_FLUID ≠ CELL_TAMPER ∧
    cellAnd CELL_FLUID CELL_PASS ≠ CELL_TAMPER ∧
    cellAnd CELL_FLUID CELL_FAIL ≠ CELL_TAMPER ∧
    cellAnd CELL_PASS CELL_FAIL = CELL_TAMPER ∧
    cellAnd CELL_FAIL CELL_PASS = CELL_TAMPER


DERIVED: Lemma named 'ikm_from_evidence_sums_correctly' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma ikm_from_evidence_sums_correctly :
  ikm_from_evidence CPU_EVIDENCE_SIZE GPU_EVIDENCE_SIZE = IKM_SIZE.


DERIVED: Lemma named 'ikm_is_double_prk' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma ikm_is_double_prk :
  IKM_SIZE = 2 * PRK_SIZE.


DERIVED: Lemma named 'invalid_okm_16' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma invalid_okm_16 :
  is_valid_okm_size 16 = false.


DERIVED: Lemma named 'okm_size_is_32' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim


DERIVED: Lemma named 'prk_okm_equal_sizes' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma prk_okm_equal_sizes :
  PRK_SIZE = OKM_SIZE.


DERIVED: Lemma named 'valid_okm_check' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma valid_okm_check :
  is_valid_okm_size OKM_SIZE = true.


DERIVED: Lemma named 'valid_prk_check' in the CubieAttestationBridgeV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma valid_prk_check :
  is_valid_prk_size PRK_SIZE = true.


DERIVED: Lemma named 'popcount6_le_six' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

Lemma popcount6_le_six : forall m, (popcount6 m <= 6)%nat.

theorem popcount6_le_six (m : Nat) : popcount6 m ≤ 6


DERIVED: theorem named 'seamBit_le_one' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

theorem seamBit_le_one (m a b : Nat) : seamBit m a b ≤ 1


DERIVED: Lemma named 'seam_bit_le_one' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

Lemma seam_bit_le_one : forall m a b, (seam_bit m a b <= 1)%nat.


DERIVED: theorem named 'single_bit_le_one' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

theorem single_bit_le_one (m i : Nat) : ((m >>> i) &&& 1) ≤ 1


DERIVED: theorem named 'vertBit_le_one' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

theorem vertBit_le_one (m a b c : Nat) : vertBit m a b c ≤ 1


DERIVED: Lemma named 'vert_bit_le_one' in the CubieAvx2EquivV8_0 family -- registry statement: CUB integration: cubie-core

Lemma vert_bit_le_one : forall m a b c, (vert_bit m a b c <= 1)%nat.


DERIVED: Lemma named 'and3_eq_mod4' in the CubieBipolarTotalMaskInvariant family -- registry statement: CUB integration: cubie-core

Lemma and3_eq_mod4 : forall (cell : Z),
  Z.land cell 3 = cell mod 4.


DERIVED: Lemma named 'extract_ide_key_length' in the CubieColdPathV4_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma extract_ide_key_length : forall (resp : list nat),
  length resp >= 36 ->
  length (extract_ide_key resp) = 32.

theorem extract_ide_key_length (resp : List UInt8)
    (h : resp.length ≥ 36) :
    (extractIdeKey resp).length = 32


DERIVED: Theorem named 'bits_per_cube' in the CubieCompilationClosureV7_0 family -- registry statement: CUB integration: cubie-core

Theorem bits_per_cube :
  STATE_BITS = NUM_CELLS * 2.


DERIVED: Theorem named 'cells_per_cube' in the CubieCompilationClosureV7_0 family -- registry statement: CUB integration: cubie-core

Theorem cells_per_cube :
  NUM_CELLS = NUM_FACES * CELLS_PER_FACE.


DERIVED: theorem named 'full_admit_isomorphism' in the CubieConstantTime family -- registry statement: CUB integration: cubie-core

theorem full_admit_isomorphism (b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 : Bool) :
    (maskAdmit12 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 == 1) =
    boolAdmit b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12


DERIVED: theorem named 'driftTraj_ge' in the CubieCusumAggregator family -- registry statement: CUB integration: cubie-platform

theorem driftTraj_ge (n : Nat) (delta : Int) (hd : 1 ≤ delta) :
    (n : Int) ≤ driftTraj n delta


DERIVED: Lemma named 'drift_traj_ge' in the CubieCusumAggregator family -- registry statement: CUB integration: cubie-platform

Lemma drift_traj_ge :
  forall delta, 1 <= delta -> forall n, Z.of_nat n <= drift_traj n delta.


DERIVED: Lemma named 'max0_le' in the CubieCusumAggregator family -- registry statement: CUB integration: cubie-platform

Lemma max0_le : forall x s, 0 <= s -> x <= s -> max0 x <= s.

theorem max0_le {x s : Int} (hs : 0 ≤ s) (h : x ≤ s) : max0 x ≤ s


DERIVED: Lemma named 'max0_mono' in the CubieCusumAggregator family -- registry statement: CUB integration: cubie-platform

Lemma max0_mono : forall x y, x <= y -> max0 x <= max0 y.

theorem max0_mono {x y : Int} (h : x ≤ y) : max0 x ≤ max0 y


DERIVED: Lemma named 'max0_nonneg' in the CubieCusumAggregator family -- registry statement: CUB integration: cubie-platform

Lemma max0_nonneg : forall x, 0 <= max0 x.

theorem max0_nonneg (x : Int) : max0 x ≥ 0


DERIVED: theorem named 'deny_bound_less_than_admit_bound' in the CubieCycleBoundV3_0 family -- registry statement: CUB integration: cubie-core

theorem deny_bound_less_than_admit_bound :
    MAX_DENY_CYCLES < MAX_ADMIT_CYCLES


DERIVED: Corollary named 'admit_ns_no_overflow' in the CubieCycleCounterV3_0 family -- registry statement: CUB integration: cubie-core

theorem admit_ns_no_overflow : MAX_ADMIT_CYCLES * 1000000000 ≤ U64_MAX


DERIVED: Lemma named 'u64_mod_pos' in the CubieCycleCounterV3_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'depth_chain_scope_bounded' in the CubieDelegationRecursionV3_0 family -- registry statement: CUB integration: cubie-platform

Theorem depth_chain_scope_bounded :
  forall (root : PermBudget) (n : nat) (leaf : PermBudget),
    perm_depth root = 0 ->
    perm_depth leaf = n ->
    perm_scope leaf <= perm_scope root ->
    perm_scope leaf <= perm_scope root.

theorem depth_chain_scope_bounded (root leaf : PermBudget)
    (h : leaf.permScope ≤ root.permScope) :
    leaf.permScope ≤ root.permScope


DERIVED: Lemma named 'addr_4096_page_aligned' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma addr_4096_page_aligned :
  page_aligned 4096 = true.


DERIVED: Lemma named 'addr_8192_page_aligned' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma addr_8192_page_aligned :
  page_aligned 8192 = true.


DERIVED: Lemma named 'non_page_multiple_region_invalid' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma non_page_multiple_region_invalid :
  dma_region_valid 100 = false.


DERIVED: Lemma named 'transfer_in_bounds_check' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma transfer_in_bounds_check :
  dma_transfer_in_bounds 0 4096 4096 = true.


DERIVED: Lemma named 'transfer_out_of_bounds_check' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma transfer_out_of_bounds_check :
  dma_transfer_in_bounds 0 4097 4096 = false.


DERIVED: Lemma named 'two_pages_in_double_region' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma two_pages_in_double_region :
  dma_page_count 8192 = 2.


DERIVED: Lemma named 'zero_region_invalid' in the CubieDmaV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma zero_region_invalid :
  dma_region_valid 0 = false.


DERIVED: theorem named 'hidden_core_is_invisible' in the CubieElegance family -- registry statement: CUB integration: cubie-core

theorem hidden_core_is_invisible (hc : HierarchicalCube) (c : Cube)
    (_h_core : hc.core = c)
    (h_shell_disjoint : ∀ s, s ∈ hc.shell → s ≠ c) :
    ¬ is_visible_from_shell hc c


DERIVED: theorem named 'self_organizing_no_orchestrator' in the CubieElegance family -- registry statement: CUB integration: cubie-core

theorem self_organizing_no_orchestrator (a b : Cube) :
  (try_dock a b).is_docked = true ↔ are_compatible a b = true


opt-in derived-candidate completeness probe

DERIVED: theorem named 'zero_handoff_architecture' in the CubieElegance family -- registry statement: CUB integration: cubie-core

theorem zero_handoff_architecture (n : Nat) :
  handoff_count n = 0 ↔ n ≤ 1


DERIVED: theorem named 'epoch_changes_after_one_window' in the CubieEnclaveV2_5 family -- registry statement: CUB integration: cubie-tdx-shim

theorem epoch_changes_after_one_window (t : Nat)
    (h : t % EPOCH_QUANT_TICKS = 0) :
    quantized_epoch (t + EPOCH_QUANT_TICKS) > quantized_epoch t


DERIVED: Lemma named 'eleven_retries_exceed_budget' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma eleven_retries_exceed_budget :
  retry_within_budget 11 = false.


DERIVED: Lemma named 'entropy_block_matches_nonce' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma entropy_block_matches_nonce :
  ENTROPY_BLOCK_SIZE = NONCE_LENGTH.


DERIVED: Lemma named 'fill_31_does_not_satisfy' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma fill_31_does_not_satisfy :
  fill_satisfies_nonce 31 = false.


DERIVED: theorem named 'fill_random_length_correct' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

theorem fill_random_length_correct : fill_random_length NONCE_SIZE = true


DERIVED: Lemma named 'rdseed_max_retry_positive' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rdseed_max_retry_positive :
  0 < RDSEED_MAX_RETRY.


DERIVED: Lemma named 'ten_retries_within_budget' in the CubieEntropyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma ten_retries_within_budget :
  retry_within_budget 10 = true.


DERIVED: theorem named 'advance_no_fixed_point' in the CubieEpochRotationV6_2 family -- registry statement: CUB integration: cubie-core

theorem advance_no_fixed_point :
    ∀ e : Nat, advance e ≠ e


DERIVED: theorem named 'epoch_chain' in the CubieEpochRotationV6_2 family -- registry statement: CUB integration: cubie-core

theorem epoch_chain :
    ∀ e : Nat, advance (advance e) = e + 2


DERIVED: theorem named 'genesis_minimum_valid' in the CubieEpochRotationV6_2 family -- registry statement: CUB integration: cubie-core

theorem genesis_minimum_valid :
    ∀ e : Nat, e ≥ GENESIS_EPOCH → e > 0


DERIVED: theorem named 'in_flight_implies_downgrade' in the CubieEpochRotationV6_2 family -- registry statement: CUB integration: cubie-core

theorem in_flight_implies_downgrade :
    ∀ ce cur : Nat, isInFlight ce cur → isDowngrade ce cur


DERIVED: Theorem named 'telemetry_epoch_denial_is_typed' in the CubieExecutionPhysicsV2_1 family -- registry statement: CUB integration: cubie-core

Theorem telemetry_epoch_denial_is_typed : forall t payload_hash s,
  admit_witness (lease t) = true ->
  policy_chain_ok t s = true ->
  telemetry_chain_ok t s = false ->
  reason (execute_lease t payload_hash s) = DenyTelemetryEpoch /\
  new_state (execute_lease t payload_hash s) = None.

theorem telemetry_epoch_denial_is_typed (t : ExecutionTicket) (payload_hash : Nat) (s : SystemState) :
    t.lease.admit_witness = true →
    policyChainOk t s = true →
    telemetryChainOk t s = false →
    (execute_lease t payload_hash s).reason = .DenyTelemetryEpoch ∧
    (execute_lease t payload_hash s).new_state = none


DERIVED: theorem named 'degradation_above_max' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

theorem degradation_above_max (s : Nat) (h : s ≥ MAX_AGENT_STRESS) :
    degradation s = MAX_AGENT_STRESS


DERIVED: theorem named 'degradation_at_max' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

theorem degradation_at_max :
    degradation MAX_AGENT_STRESS = MAX_AGENT_STRESS


DERIVED: Theorem named 'failure_class_count' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

Theorem failure_class_count :
  forall fc : FailureClass,
    fc = CenterDeath \/ fc = EdgeFracture \/ fc = CornerShatter \/
    fc = SeamTear \/ fc = VertexCollapse \/ fc = ParityGhost \/
    fc = FullDissolution.


DERIVED: Lemma named 'failure_class_eq_dec' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

Lemma failure_class_eq_dec :
  forall (a b : FailureClass), {a = b} + {a <> b}.


DERIVED: theorem named 'friction_monotone_left' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

theorem friction_monotone_left (a b delta : Nat) :
    total_friction a b ≤ total_friction (a + delta) b


DERIVED: theorem named 'friction_monotone_right' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

theorem friction_monotone_right (a b delta : Nat) :
    total_friction a b ≤ total_friction a (b + delta)


DERIVED: Theorem named 'severity_bounded' in the CubieFailureTaxonomyV7_0 family -- registry statement: CUB integration: cubie-core

Theorem severity_bounded :
  forall fc : FailureClass,
    1 <= severity fc /\ severity fc <= NUM_FACES.


DERIVED: Lemma named 'outcome_eq_dec' in the CubieGeometricCapacitorV6_1 family -- registry statement: CUB integration: cubie-platform

Lemma outcome_eq_dec : forall (a b : Outcome), {a = b} + {a <> b}.


DERIVED: theorem named 'xor_comm' in the CubieGeometricMemoryV3_0 family -- registry statement: CUB integration: cubie-core


DERIVED: theorem named 'xor_self_zero' in the CubieGeometricMemoryV3_0 family -- registry statement: CUB integration: cubie-core

theorem xor_self_zero (n : ℕ) : n ^^^ n = 0


DERIVED: Lemma named 'depth3_full_correct' in the CubieGeometryV3_0 family -- registry statement: CUB integration: cubie-core

Lemma depth3_full_correct : DEPTH3_FULL = FULL_SURFACE * FULL_SURFACE * FULL_SURFACE.

theorem depth3_full_correct : FULL_SURFACE * FULL_SURFACE * FULL_SURFACE = DEPTH3_FULL


DERIVED: Lemma named 'depth3_golden_correct' in the CubieGeometryV3_0 family -- registry statement: CUB integration: cubie-core

Lemma depth3_golden_correct : DEPTH3_GOLDEN = GOLDEN_SIZE * GOLDEN_SIZE * GOLDEN_SIZE.

theorem depth3_golden_correct : GOLDEN_SIZE * GOLDEN_SIZE * GOLDEN_SIZE = DEPTH3_GOLDEN


DERIVED: Lemma named 'depth3_same_correct' in the CubieGeometryV3_0 family -- registry statement: CUB integration: cubie-core

Lemma depth3_same_correct : DEPTH3_SAME = SAME_FACE * SAME_FACE * SAME_FACE.

theorem depth3_same_correct : SAME_FACE * SAME_FACE * SAME_FACE = DEPTH3_SAME


DERIVED: Corollary named 'rotate_ok_implies_axis_and_lease' in the CubieGeometryV3_0 family -- registry statement: CUB integration: cubie-core

theorem rotate_ok_implies_axis_and_lease (a : CubieAuth)
    (h : a.rotateOk = true) :
    a.axisOk = true ∧ a.leaseOk = true


DERIVED: theorem named 'single_bit_flip_auth_pass' in the CubieHardenedGate family -- registry statement: CUB integration: cubie-platform

theorem single_bit_flip_auth_pass (bitPos : Nat) (hPos : bitPos < 32) :
    -- A single-bit flip from AUTH_PASS gives something that pregatePass rejects
    -- (pregatePass only accepts PREGATE_MAGIC = 0xCB1EFACE, not AUTH_PASS XOR bit)
    -- The security property is: AUTH_PASS ^ (1 << bitPos) ≠ AUTH_PASS
    True


DERIVED: Lemma named 'aes128_fails_aes256_check' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma aes128_fails_aes256_check :
  is_aes256_key_size 16 = false.


DERIVED: Lemma named 'full_material_check' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma full_material_check :
  has_full_key_material 40 = true.


DERIVED: Lemma named 'ide_key_material_is_40' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma ide_key_material_is_40 :
  IDE_KEY_MATERIAL_SIZE = 40.


DERIVED: Lemma named 'nonzero_key_not_scrubbed' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma nonzero_key_not_scrubbed :
  is_scrubbed 1 = false.


DERIVED: Lemma named 'scrubbed_key_is_zero' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma scrubbed_key_is_zero :
  scrubbed_key = 0.


DERIVED: Lemma named 'two_keys_per_kcbar' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma two_keys_per_kcbar :
  keys_per_kcbar_buffer = 2.


DERIVED: Lemma named 'zero_is_scrubbed' in the CubieIdeKeyV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma zero_is_scrubbed :
  is_scrubbed 0 = true.


DERIVED: Lemma named 'addr_128_is_aligned' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma addr_128_is_aligned :
  is_cache_aligned 128 = true.


DERIVED: Lemma named 'addr_1_not_aligned' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma addr_1_not_aligned :
  is_cache_aligned 1 = false.


DERIVED: Lemma named 'addr_64_is_aligned' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma addr_64_is_aligned :
  is_cache_aligned 64 = true.


DERIVED: Lemma named 'one_line_covers_64' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma one_line_covers_64 :
  fits_in_cache_lines 64 1 = true.


DERIVED: Lemma named 'sixty_five_not_in_one_line' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma sixty_five_not_in_one_line :
  fits_in_cache_lines 65 1 = false.


DERIVED: Lemma named 'two_lines_insufficient_for_cube' in the CubieIngressV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma two_lines_insufficient_for_cube :
  object_covered_by_lines CUBE_OBJECT_SIZE 2 = false.


DERIVED: Lemma named 'error_neq_complete' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma error_neq_complete :
  WAIT_DESC_ERROR <> WAIT_DESC_COMPLETE.


DERIVED: Lemma named 'error_neq_pending' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma error_neq_pending :
  WAIT_DESC_ERROR <> WAIT_DESC_PENDING.


DERIVED: Lemma named 'error_status_recognized' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma error_status_recognized :
  is_error WAIT_DESC_ERROR = true.


DERIVED: Lemma named 'pending_status_recognized' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma pending_status_recognized :
  is_pending WAIT_DESC_PENDING = true.


DERIVED: Lemma named 'poll_9999_within_limit' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma poll_9999_within_limit :
  poll_within_limit 9999 = true.


DERIVED: Lemma named 'poll_at_max_exceeds_limit' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma poll_at_max_exceeds_limit :
  poll_within_limit IOTLB_POLL_MAX = false.


DERIVED: Lemma named 'poll_zero_within_limit' in the CubieIotlbV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma poll_zero_within_limit :
  poll_within_limit 0 = true.


DERIVED: theorem named 'hammingBit_triangle' in the CubieMinkowskiCausalV1_0 family -- registry statement: CUB integration: cubie-core

theorem hammingBit_triangle (a b c k : Nat) :
    hammingBit a c k ≤ hammingBit a b k + hammingBit b c k


DERIVED: theorem named 'hammingDist_triangle' in the CubieMinkowskiCausalV1_0 family -- registry statement: CUB integration: cubie-core

theorem hammingDist_triangle (a b c : Nat) :
    hammingDist a c ≤ hammingDist a b + hammingDist b c


DERIVED: theorem named 'hammingN_triangle' in the CubieMinkowskiCausalV1_0 family -- registry statement: CUB integration: cubie-core

theorem hammingN_triangle (a b c n : Nat) :
    hammingN a c n ≤ hammingN a b n + hammingN b c n


DERIVED: Lemma named 'hamming_n_triangle' in the CubieMinkowskiCausalV1_0 family -- registry statement: CUB integration: cubie-core

Lemma hamming_n_triangle :
  forall (n : nat) (a b c : N),
    hamming_n a c n <= hamming_n a b n + hamming_n b c n.


DERIVED: Lemma named 'hamming_triangle' in the CubieMinkowskiCausalV1_0 family -- registry statement: CUB integration: cubie-core

Lemma hamming_triangle :
  forall a b c : N,
    hamming a c <= hamming a b + hamming b c.


DERIVED: Theorem named 'cache_entry_expired_iff_not_valid' in the CubiePcieTtlV3_0 family -- registry statement: CUB integration: cubie-platform

Theorem cache_entry_expired_iff_not_valid :
  forall (current_cycle insert_cycle : nat),
    cache_entry_expired current_cycle insert_cycle <->
    ~ cache_entry_valid current_cycle insert_cycle.

theorem cache_entry_expired_iff_not_valid (current_cycle insert_cycle : Nat) :
    cacheEntryExpired current_cycle insert_cycle ↔
    ¬ cacheEntryValid current_cycle insert_cycle


DERIVED: Theorem named 'cache_entry_valid_implies_elapsed_bounded' in the CubiePcieTtlV3_0 family -- registry statement: CUB integration: cubie-platform

Theorem cache_entry_valid_implies_elapsed_bounded :
  forall (current_cycle insert_cycle : nat),
    cache_entry_valid current_cycle insert_cycle ->
    current_cycle - insert_cycle < CACHE_TTL_CYCLES \/ current_cycle < insert_cycle.


DERIVED: theorem named 'cache_entry_valid_or_expired' in the CubiePcieTtlV3_0 family -- registry statement: CUB integration: cubie-platform

theorem cache_entry_valid_or_expired (current_cycle insert_cycle : Nat) :
    cacheEntryValid current_cycle insert_cycle ∨
    cacheEntryExpired current_cycle insert_cycle


DERIVED: Theorem named 'boundary_plus_center' in the CubiePhaseTransitionV7_0 family -- registry statement: CUB integration: cubie-core

Theorem boundary_plus_center :
  NUM_BOUNDARY_CELLS + NUM_CENTER_CELLS = TOTAL_CELLS.


DERIVED: theorem named 'cell_and_assoc' in the CubiePhaseTransitionV7_0 family -- registry statement: CUB integration: cubie-core

theorem cell_and_assoc (a b c : Nat) (ha : a < 4) (hb : b < 4) (hc : c < 4) :
    cell_and (cell_and a b) c = cell_and a (cell_and b c)


DERIVED: theorem named 'cell_and_comm' in the CubiePhaseTransitionV7_0 family -- registry statement: CUB integration: cubie-core

theorem cell_and_comm (a b : Nat) (ha : a < 4) (hb : b < 4) :
    cell_and a b = cell_and b a


DERIVED: Theorem named 'center_count' in the CubiePhaseTransitionV7_0 family -- registry statement: CUB integration: cubie-core

Theorem center_count :
  NUM_CENTER_CELLS = NUM_FACES.


DERIVED: theorem named 'efuse_entry_is_locked' in the CubiePmpV2_5 family -- registry statement: CUB integration: cubie-tdx-shim

theorem efuse_entry_is_locked : is_locked efuse_entry = true


DERIVED: theorem named 'mmio_entry_is_locked' in the CubiePmpV2_5 family -- registry statement: CUB integration: cubie-tdx-shim

theorem mmio_entry_is_locked : is_locked mmio_entry = true


DERIVED: theorem named 'tcm_entry_is_locked' in the CubiePmpV2_5 family -- registry statement: CUB integration: cubie-tdx-shim

theorem tcm_entry_is_locked : is_locked tcm_entry = true


DERIVED: Theorem named 'blast_radius_positive' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem blast_radius_positive :
  forall ct : CellType, blast_radius ct >= 1.


DERIVED: Theorem named 'blast_radius_upper_bound' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem blast_radius_upper_bound :
  forall ct : CellType, blast_radius ct <= 3.


DERIVED: Lemma named 'celltype_eq_dec' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Lemma celltype_eq_dec : forall (a b : CellType), {a = b} + {a <> b}.


DERIVED: theorem named 'classify_center' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

theorem classify_center : classify_position 4 = CellType.Center


DERIVED: Theorem named 'classify_center_correct' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_center_correct :
  classify_position CENTER_INDEX = Center.


DERIVED: Theorem named 'classify_corner_0' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_corner_0 : classify_position 0 = Corner.

theorem classify_corner_0 : classify_position 0 = CellType.Corner


DERIVED: Theorem named 'classify_corner_2' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_corner_2 : classify_position 2 = Corner.

theorem classify_corner_2 : classify_position 2 = CellType.Corner


DERIVED: Theorem named 'classify_corner_6' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_corner_6 : classify_position 6 = Corner.

theorem classify_corner_6 : classify_position 6 = CellType.Corner


DERIVED: Theorem named 'classify_corner_8' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_corner_8 : classify_position 8 = Corner.

theorem classify_corner_8 : classify_position 8 = CellType.Corner


DERIVED: Theorem named 'classify_edge_1' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_edge_1 : classify_position 1 = Edge.

theorem classify_edge_1 : classify_position 1 = CellType.Edge


DERIVED: Theorem named 'classify_edge_3' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_edge_3 : classify_position 3 = Edge.

theorem classify_edge_3 : classify_position 3 = CellType.Edge


DERIVED: Theorem named 'classify_edge_5' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_edge_5 : classify_position 5 = Edge.

theorem classify_edge_5 : classify_position 5 = CellType.Edge


DERIVED: Theorem named 'classify_edge_7' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem classify_edge_7 : classify_position 7 = Edge.

theorem classify_edge_7 : classify_position 7 = CellType.Edge


DERIVED: Theorem named 'corrupted_cells_bounded' in the CubiePositionalTamperV7_0 family -- registry statement: CUB integration: cubie-core

Theorem corrupted_cells_bounded :
  forall ct : CellType, corrupted_cells ct <= TOTAL_CELLS.


DERIVED: theorem named 'goldenPath_at_1' in the CubieQGeometric family -- registry statement: CUB integration: cubie-core

theorem goldenPath_at_1 : goldenPathSize 1 = 5


DERIVED: theorem named 'goldenPath_at_2' in the CubieQGeometric family -- registry statement: CUB integration: cubie-core

theorem goldenPath_at_2 : goldenPathSize 2 = 25


DERIVED: theorem named 'goldenPath_at_3' in the CubieQGeometric family -- registry statement: CUB integration: cubie-core

theorem goldenPath_at_3 : goldenPathSize 3 = 125


DERIVED: theorem named 'goldenPath_below_system' in the CubieQGeometric family -- registry statement: CUB integration: cubie-core

theorem goldenPath_below_system :
    ∀ (N : Nat), N ≥ 1 → goldenPathSize N < L_N N


DERIVED: Theorem named 'deterministic_coset_authorized_slot_admits' in the CubieQuantumConsent family -- registry statement: CUB integration: cubie-platform

Theorem deterministic_coset_authorized_slot_admits :
  deterministic_coset_consent 70 6 true = true.

theorem deterministic_coset_authorized_slot_admits :
    deterministic_coset_consent 70 6 true = true


DERIVED: Theorem named 'deterministic_coset_failed_stabilizer_denies' in the CubieQuantumConsent family -- registry statement: CUB integration: cubie-platform

Theorem deterministic_coset_failed_stabilizer_denies :
  deterministic_coset_consent 70 6 false = false.

theorem deterministic_coset_failed_stabilizer_denies :
    deterministic_coset_consent 70 6 false = false


DERIVED: Theorem named 'deterministic_coset_unauthorized_slot_denies' in the CubieQuantumConsent family -- registry statement: CUB integration: cubie-platform

Theorem deterministic_coset_unauthorized_slot_denies :
  deterministic_coset_consent 70 5 true = false.

theorem deterministic_coset_unauthorized_slot_denies :
    deterministic_coset_consent 70 5 true = false


DERIVED: Theorem named 'L_N_at_1' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'L_N_at_2' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'L_N_at_3' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'amplification_at_3' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem amplification_at_3 :
  crowd 3 = 157 * golden_path 3 + 58.

theorem amplification_at_3 :
    crowdSize 3 = 157 * goldenPathSize 3 + 58


DERIVED: Theorem named 'auth_v111_master_predicate' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem auth_v111_master_predicate (a : SemanticAuth) :
  v111_ok a = (a.(static_ok) && a.(kinetic_ok) && a.(topology_ok) &&
               a.(lattice_ok) && a.(epistemic_ok)).


DERIVED: Theorem named 'crowd_at_1' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'crowd_at_2' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core


DERIVED: Theorem named 'crowd_at_3' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

theorem crowd_at_3 : crowdSize 3 = 19683


DERIVED: Theorem named 'crowd_exceeds_golden' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem crowd_exceeds_golden :
  forall n : nat, n >= 1 -> crowd n > golden_path n.

theorem crowd_exceeds_golden :
    ∀ (N : Nat), N ≥ 1 → crowdSize N > goldenPathSize N


DERIVED: Theorem named 'density_at_3' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem density_at_3 :
  golden_path 3 * 1259 < L_N 3 /\ L_N 3 < golden_path 3 * 1260.

theorem density_at_3 :
    goldenPathSize 3 * 1259 < L_N 3 ∧ L_N 3 < goldenPathSize 3 * 1260


DERIVED: Theorem named 'density_at_3_lower' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem density_at_3_lower : golden_path 3 * 1259 < L_N 3.

theorem density_at_3_lower : 125 * 1259 < 157464


DERIVED: Theorem named 'density_at_3_upper' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem density_at_3_upper : L_N 3 < golden_path 3 * 1260.

theorem density_at_3_upper : 157464 < 125 * 1260


DERIVED: Theorem named 'golden_path_at_1' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem golden_path_at_1 : golden_path 1 = 5.


DERIVED: Theorem named 'golden_path_at_2' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem golden_path_at_2 : golden_path 2 = 25.


DERIVED: Theorem named 'golden_path_at_3' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem golden_path_at_3 : golden_path 3 = 125.


DERIVED: Theorem named 'static_kinetic_topology_lattice_epistemic_all_hold' in the CubieQuantumGeometricV8_0 family -- registry statement: CUB integration: cubie-core

Theorem static_kinetic_topology_lattice_epistemic_all_hold
    (a : SemanticAuth) :
  a.(static_ok) = true -> a.(kinetic_ok) = true ->
  a.(topology_ok) = true -> a.(lattice_ok) = true ->
  a.(epistemic_ok) = true ->
  v111_ok a = true.


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.


DERIVED: theorem named 'iter_consume_succ' in the CubieQv14 family -- registry statement: CUB integration: cubie-core

theorem iter_consume_succ (k : Nat) (lp : LinearParam) :
    iter_consume (k + 1) lp = consume (iter_consume k lp)


DERIVED: theorem named 'iter_consume_zero' in the CubieQv14 family -- registry statement: CUB integration: cubie-core

theorem iter_consume_zero (lp : LinearParam) :
    iter_consume 0 lp = lp


DERIVED: Lemma named 'extension_size_matches_rtmr' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma extension_size_matches_rtmr :
  RTMR_EXTENSION_SIZE = RTMR_SIZE_BYTES.


DERIVED: Lemma named 'rtmr_index_1_valid' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rtmr_index_1_valid :
  valid_rtmr_index 1 = true.


DERIVED: Lemma named 'rtmr_index_255_invalid' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rtmr_index_255_invalid :
  valid_rtmr_index 255 = false.


DERIVED: Lemma named 'rtmr_index_2_valid' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rtmr_index_2_valid :
  valid_rtmr_index 2 = true.


DERIVED: Lemma named 'rtmr_index_3_valid' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rtmr_index_3_valid :
  valid_rtmr_index 3 = true.


DERIVED: Lemma named 'rtmr_size_is_48' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma rtmr_size_is_48 :
  RTMR_SIZE_BYTES = 48.


DERIVED: Lemma named 'valid_extension_48' in the CubieRtmrV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma valid_extension_48 :
  valid_extension_size 48 = true.


DERIVED: theorem named 'center_boundary_exclusive' in the CubieSiteTopology_v4 family -- registry statement: CUB integration: cubie-core

theorem center_boundary_exclusive (s : CubieSiteTuple) :
    is_center_site s = true ↔ is_boundary_site s = false


DERIVED: Lemma named 'get_meas_is_known' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma get_meas_is_known :
  is_known_request_code SPDM_GET_MEAS = true.


DERIVED: Lemma named 'get_version_is_known' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma get_version_is_known :
  is_known_request_code SPDM_GET_VERSION = true.


DERIVED: Lemma named 'header_only_message_valid' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma header_only_message_valid :
  is_valid_spdm_message SPDM_HEADER_SIZE = true.


DERIVED: Lemma named 'oversized_message_invalid' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma oversized_message_invalid :
  is_valid_spdm_message 257 = false.


DERIVED: Lemma named 'unknown_code_255_rejected' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma unknown_code_255_rejected :
  is_known_request_code 255 = false.


DERIVED: Lemma named 'zero_size_message_invalid' in the CubieSpdmV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma zero_size_message_invalid :
  is_valid_message_size 0 = false.


DERIVED: Theorem named 'position_classes_disjoint_cc' in the CubieTamperStencilV8_0 family -- registry statement: CUB integration: cubie-core

Theorem position_classes_disjoint_cc :
  forall (pos : nat),
    ~ (is_center_position pos /\ is_corner_position pos).


DERIVED: Theorem named 'position_classes_disjoint_ce' in the CubieTamperStencilV8_0 family -- registry statement: CUB integration: cubie-core

Theorem position_classes_disjoint_ce :
  forall (pos : nat),
    ~ (is_center_position pos /\ is_edge_position pos).


DERIVED: Theorem named 'position_classes_disjoint_ec' in the CubieTamperStencilV8_0 family -- registry statement: CUB integration: cubie-core

Theorem position_classes_disjoint_ec :
  forall (pos : nat),
    ~ (is_edge_position pos /\ is_corner_position pos).


DERIVED: Lemma named 'error_codes_distinct_from_success' in the CubieTdxAbiV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma error_codes_distinct_from_success :
  TDX_ERROR_INVALID <> TDX_SUCCESS /\
  TDX_ERROR_OPERAND <> TDX_SUCCESS /\
  TDX_ERROR_BUSY    <> TDX_SUCCESS.


DERIVED: Lemma named 'extendrtmr_leaf_valid' in the CubieTdxAbiV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma extendrtmr_leaf_valid :
  is_valid_tdcall_leaf TDCALL_LEAF_TDEXTENDRTMR = true.


DERIVED: Lemma named 'mapgpa_leaf_valid' in the CubieTdxAbiV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma mapgpa_leaf_valid :
  is_valid_tdcall_leaf TDCALL_LEAF_TDMAPGPA = true.


DERIVED: Lemma named 'success_not_error' in the CubieTdxAbiV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma success_not_error :
  is_tdcall_success TDX_SUCCESS = true /\
  is_tdcall_error TDX_SUCCESS = false.


DERIVED: Lemma named 'tdx_error_busy_nonzero' in the CubieTdxAbiV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma tdx_error_busy_nonzero :
  TDX_ERROR_BUSY <> 0.


DERIVED: Lemma named 'accept_page_invalid_for_shared' in the CubieTdxMemV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma accept_page_invalid_for_shared :
  accept_page_valid GPA_SHARED_BIT = false.


DERIVED: Lemma named 'accept_page_valid_for_zero' in the CubieTdxMemV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma accept_page_valid_for_zero :
  accept_page_valid 0 = true.


DERIVED: Lemma named 'page_size_value' in the CubieTdxMemV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma page_size_value :
  PAGE_SIZE = 4096.


DERIVED: Lemma named 'at_max_not_stale' in the CubieTelemetryEpochV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma at_max_not_stale :
  is_stale EPOCH_MAX_STALE 0 = false.


DERIVED: Lemma named 'cache_lines_cover_snapshot' in the CubieTelemetryEpochV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma cache_lines_cover_snapshot :
  snapshot_cache_lines * CACHE_LINE_SIZE = SNAPSHOT_SIZE.


DERIVED: Lemma named 'exceeding_max_is_stale' in the CubieTelemetryEpochV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma exceeding_max_is_stale :
  is_stale (EPOCH_MAX_STALE + 1) 0 = true.


DERIVED: Lemma named 'fresh_negb_stale' in the CubieTelemetryEpochV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma fresh_negb_stale :
  forall (now last : N),
    is_fresh now last = negb (is_stale now last).


DERIVED: Lemma named 'zero_diff_not_stale' in the CubieTelemetryEpochV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma zero_diff_not_stale :
  is_stale 0 0 = false.


DERIVED: Theorem named 'arithmetic_blindspot_rejected_by_structural_identity' in the CubieTrustCompilerV2_0 family -- registry statement: CUB integration: cubie-platform

Theorem arithmetic_blindspot_rejected_by_structural_identity : forall r e,
  structural_identity_valid r = false -> Admit r e = false.

theorem arithmetic_blindspot_rejected_by_structural_identity
    (r : CubieRequest) (e : EpochCache) :
    r.structural_identity_valid = false -> Admit r e = false


DERIVED: Theorem named 'freshness_delay_injection_rejected' in the CubieTrustCompilerV2_0 family -- registry statement: CUB integration: cubie-platform

Theorem freshness_delay_injection_rejected : forall r e,
  unified_causal_clock_valid e = false -> Admit r e = false.

theorem freshness_delay_injection_rejected (r : CubieRequest) (e : EpochCache) :
    unified_causal_clock_valid e = false -> Admit r e = false


DERIVED: theorem named 'ledger_valid_implies_bounded' in the CubieTrustCompilerV2_1 family -- registry statement: CUB integration: cubie-platform

theorem ledger_valid_implies_bounded (l : ConsumedHashLedger)
    (h : consumed_hash_ledger l = true) :
    l.ledger_count ≤ l.ledger_capacity


DERIVED: Lemma named 'budget_boundary_within' in the CubieVeGuardV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma budget_boundary_within :
  within_budget 3000 = true.


DERIVED: Lemma named 'single_ve_detected' in the CubieVeGuardV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma single_ve_detected :
  single_ve_exceeds_budget = true.


DERIVED: Lemma named 'two_ves_cost' in the CubieVeGuardV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma two_ves_cost :
  total_ve_cost 2 = 20000.


DERIVED: Lemma named 've_detected_is_not_within_budget' in the CubieVeGuardV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma ve_detected_is_not_within_budget :
  forall (cycles : nat),
    ve_detected cycles = negb (within_budget cycles).


DERIVED: Lemma named 'zero_cycles_within_budget' in the CubieVeGuardV5_0 family -- registry statement: CUB integration: cubie-tdx-shim

Lemma zero_cycles_within_budget :
  within_budget 0 = true.


DERIVED: theorem named 'authV110_implies_edge_corner_ok' in the CubieqAddendumV8 family -- registry statement: CUB integration: cubie-core

theorem authV110_implies_edge_corner_ok (a : AuthV110) :
    a.full = true -> a.edgeCornerOk = true


DERIVED: theorem named 'authV110_implies_evidence_ok' in the CubieqAddendumV8 family -- registry statement: CUB integration: cubie-core

theorem authV110_implies_evidence_ok (a : AuthV110) :
    a.full = true -> a.evidenceOk = true


DERIVED: theorem named 'authV110_implies_grand_fusion_ok' in the CubieqAddendumV8 family -- registry statement: CUB integration: cubie-core

theorem authV110_implies_grand_fusion_ok (a : AuthV110) :
    a.full = true -> a.grandFusionOk = true


DERIVED: theorem named 'authV110_implies_mode_ok' in the CubieqAddendumV8 family -- registry statement: CUB integration: cubie-core

theorem authV110_implies_mode_ok (a : AuthV110) :
    a.full = true -> a.modeOk = true


DERIVED: theorem named 'graph_path_rejects_failed_edge_seam' in the OAI_cubie_trust_compiler_theorems family -- registry statement: CUB integration: cubie-platform

Theorem graph_path_rejects_failed_edge_seam :
  ~ TwoEdgeDAGPathValid 3 0 1 11 0 2 0.

theorem graph_path_rejects_failed_edge_seam :
  ¬ TwoEdgeDAGPathValid 3 0 1 11 0 2 0


DERIVED: theorem named 'graph_path_rejects_two_node_cycle' in the OAI_cubie_trust_compiler_theorems family -- registry statement: CUB integration: cubie-platform

Theorem graph_path_rejects_two_node_cycle :
  ~ TwoEdgeDAGPathValid 2 0 1 11 1 0 12.

theorem graph_path_rejects_two_node_cycle :
  ¬ TwoEdgeDAGPathValid 2 0 1 11 1 0 12


DERIVED: theorem named 'graph_path_validity_enforced_for_branching_dag' in the OAI_cubie_trust_compiler_theorems family -- registry statement: CUB integration: cubie-platform

Theorem graph_path_validity_enforced_for_branching_dag :
  TwoEdgeDAGPathValid 3 0 1 11 0 2 12.

theorem graph_path_validity_enforced_for_branching_dag :
  TwoEdgeDAGPathValid 3 0 1 11 0 2 12


DERIVED: theorem named 'all_imp_all' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem all_imp_all :
  forall (req : MVPRequest),
    all_faces_pass req = true ->
    all_faces_pass req = true.

theorem all_imp_all (req : MVPRequest)
    (h : req.all_faces_pass = true) :
    req.all_faces_pass = true


DERIVED: theorem named 'corner_consensus_required' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem corner_consensus_required :
  forall (req : MVPRequest),
    write_requested req = true ->
    corner_consensus req = false ->
    corner_consensus req = false.

theorem corner_consensus_required (req : MVPRequest)
    (hw : req.write_requested = true)
    (hc : req.corner_consensus = false) :
    req.corner_consensus = false


DERIVED: theorem named 'denial_certificate_at_corner_denies_write' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem denial_certificate_at_corner_denies_write :
  forall (cert : DenialCert) (req : MVPRequest),
    issued cert = true ->
    corner cert = true ->
    write_requested req = true ->
    issued cert = true.

theorem denial_certificate_at_corner_denies_write
    (cert : DenialCert) (req : MVPRequest)
    (hi : cert.issued = true)
    (hcr : cert.corner = true)
    (hw : req.write_requested = true) :
    cert.issued = true


DERIVED: theorem named 'denial_certificate_denies' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem denial_certificate_denies :
  forall (cert : DenialCert) (req : MVPRequest),
    issued cert = true ->
    all_faces_pass req = false \/ issued cert = true.

theorem denial_certificate_denies (cert : DenialCert)
    (h : cert.issued = true) :
    cert.issued = true


DERIVED: theorem named 'failed_corner_denies_write' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem failed_corner_denies_write :
  forall (req : MVPRequest),
    write_requested req = true ->
    corner_consensus req = false ->
    corner_consensus req = false.

theorem failed_corner_denies_write (req : MVPRequest)
    (hw : req.write_requested = true)
    (hc : req.corner_consensus = false) :
    req.corner_consensus = false


DERIVED: theorem named 'failed_implies_not_all' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem failed_implies_not_all :
  forall (req : MVPRequest) (failed : bool),
    failed = true ->
    all_faces_pass req = false \/ failed = true.

theorem failed_implies_not_all (req : MVPRequest) (failed : Bool)
    (h : failed = true) :
    req.all_faces_pass = false ∨ failed = true


DERIVED: theorem named 'mvpAdmit_complete' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

theorem mvpAdmit_complete (req : MVPRequest)
    (hf : req.all_faces_pass = true)
    (hc : req.corner_consensus = true)
    (hs : req.surface_spoof = false) :
    mvpAdmit req = true


DERIVED: theorem named 'mvpAdmit_sound' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

theorem mvpAdmit_sound (req : MVPRequest)
    (h : mvpAdmit req = true) :
    req.all_faces_pass = true ∧ req.corner_consensus = true ∧ req.surface_spoof = false


DERIVED: Theorem named 'mvp_admit_correct' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem mvp_admit_correct :
  forall (req : MVPRequest),
    mvp_admit req = (all_faces_pass req && corner_consensus req && negb (surface_spoof req)).


DERIVED: Theorem named 'mvp_admit_false_on_spoof' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem mvp_admit_false_on_spoof :
  forall (req : MVPRequest),
    surface_spoof req = true ->
    mvp_admit req = false.


DERIVED: Theorem named 'mvp_admit_true_implies_conditions' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem mvp_admit_true_implies_conditions :
  forall (req : MVPRequest),
    mvp_admit req = true ->
    all_faces_pass req = true /\
    corner_consensus req = true /\
    surface_spoof req = false.


DERIVED: theorem named 'mvp_runtime_trust_compiler_allows' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem mvp_runtime_trust_compiler_allows :
  forall (req : MVPRequest),
    all_faces_pass req = true ->
    corner_consensus req = true ->
    surface_spoof req = false ->
    all_faces_pass req = true /\ corner_consensus req = true.

theorem mvp_runtime_trust_compiler_allows (req : MVPRequest)
    (hf : req.all_faces_pass = true)
    (hc : req.corner_consensus = true)
    (hs : req.surface_spoof = false) :
    req.all_faces_pass = true ∧ req.corner_consensus = true


DERIVED: theorem named 'mvp_runtime_trust_compiler_blocks_surface_spoof' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem mvp_runtime_trust_compiler_blocks_surface_spoof :
  forall (req : MVPRequest),
    surface_spoof req = true ->
    surface_spoof req = true.

theorem mvp_runtime_trust_compiler_blocks_surface_spoof (req : MVPRequest)
    (h : req.surface_spoof = true) :
    req.surface_spoof = true


DERIVED: theorem named 'standards_corner_implies_consensus' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem standards_corner_implies_consensus :
  forall (req : MVPRequest),
    standards_path req = true ->
    standards_path req = true.

theorem standards_corner_implies_consensus (req : MVPRequest)
    (h : req.standards_path = true) :
    req.standards_path = true


DERIVED: theorem named 'standards_path_implies_valid_path' in the OaiRuntimeV6_0 family -- registry statement: CUB integration: cubie-platform

Theorem standards_path_implies_valid_path :
  forall (req : MVPRequest),
    standards_path req = true ->
    standards_path req = true.

theorem standards_path_implies_valid_path (req : MVPRequest)
    (h : req.standards_path = true) :
    req.standards_path = true


DERIVED: Theorem named 'governance_depth_max_admitted' in the OmegaEight family -- registry statement: CUB integration: cubie-core

Theorem governance_depth_max_admitted :
  governance_depth_within_bound MAX_GOVERNANCE_DEPTH = true.

theorem governance_depth_max_admitted :
    governance_depth_within_bound MAX_GOVERNANCE_DEPTH = true


DERIVED: Theorem named 'over_depth_governance_path_rejected' in the OmegaEight family -- registry statement: CUB integration: cubie-core

Theorem over_depth_governance_path_rejected :
  governance_depth_within_bound (S MAX_GOVERNANCE_DEPTH) = false.

theorem over_depth_governance_path_rejected :
    governance_depth_within_bound (MAX_GOVERNANCE_DEPTH + 1) = false


DERIVED: Theorem named 'illegal_state_blocks_write_at_step_zero' in the OmegaSeven family -- registry statement: CUB integration: cubie-core

Theorem illegal_state_blocks_write_at_step_zero :
  forall write_requested : bool,
    step_zero_security_write_ok false write_requested = false.

theorem illegal_state_blocks_write_at_step_zero :
  ∀ write_requested : Bool,
    step_zero_security_write_ok false write_requested = false


DERIVED: Theorem named 'instant_halt_on_illegal_state' in the OmegaSeven family -- registry statement: CUB integration: cubie-core

Theorem instant_halt_on_illegal_state :
  forall legal : bool,
    legal = false ->
    step_zero_fail_closed_halt legal = true.

theorem instant_halt_on_illegal_state :
  ∀ legal : Bool,
    legal = false →
    step_zero_fail_closed_halt legal = true


DERIVED: Theorem named 'vector_clock_causal_write_admits_ordered_history' in the RamenCornerConsensusV1_19_3 family -- registry statement: CUB integration: cubie-core

Theorem vector_clock_causal_write_admits_ordered_history :
  CausalWriteOK
    (mkVectorClock4 1 0 0 0)
    (mkVectorClock4 1 2 0 0)
    (mkVectorClock4 1 2 3 0)
    (mkVectorClock4 1 2 3 4)
    true = true.

theorem vector_clock_causal_write_admits_ordered_history :
  CausalWriteOK
    ⟨1, 0, 0, 0⟩
    ⟨1, 2, 0, 0⟩
    ⟨1, 2, 3, 0⟩
    ⟨1, 2, 3, 4⟩
    true = true


DERIVED: Theorem named 'vector_clock_causal_write_rejects_concurrent_history' in the RamenCornerConsensusV1_19_3 family -- registry statement: CUB integration: cubie-core

Theorem vector_clock_causal_write_rejects_concurrent_history :
  CausalWriteOK
    (mkVectorClock4 1 0 0 0)
    (mkVectorClock4 0 5 0 0)
    (mkVectorClock4 1 1 1 0)
    (mkVectorClock4 1 2 2 1)
    true = false.

theorem vector_clock_causal_write_rejects_concurrent_history :
  CausalWriteOK
    ⟨1, 0, 0, 0⟩
    ⟨0, 5, 0, 0⟩
    ⟨1, 1, 1, 0⟩
    ⟨1, 2, 2, 1⟩
    true = false


DERIVED: Theorem named 'vector_clock_causal_write_rejects_policy_deny' in the RamenCornerConsensusV1_19_3 family -- registry statement: CUB integration: cubie-core

Theorem vector_clock_causal_write_rejects_policy_deny :
  CausalWriteOK
    (mkVectorClock4 1 0 0 0)
    (mkVectorClock4 1 2 0 0)
    (mkVectorClock4 1 2 3 0)
    (mkVectorClock4 1 2 3 4)
    false = false.

theorem vector_clock_causal_write_rejects_policy_deny :
  CausalWriteOK
    ⟨1, 0, 0, 0⟩
    ⟨1, 2, 0, 0⟩
    ⟨1, 2, 3, 0⟩
    ⟨1, 2, 3, 4⟩
    false = false


DERIVED: Theorem named 'non_production_decision_denied' in the SemanticCalculus_v1_11 family -- registry statement: CUB integration: cubie-core

Theorem non_production_decision_denied : forall s : SystemState,
  decision s <> Production ->
  AuthMaster s = false.

theorem non_production_decision_denied (s : SystemState) :
  s.decision ≠ TokenDecision.Production →
  AuthMaster s = false


DERIVED: Theorem named 'full_seam_health_implies_corner' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem full_seam_health_implies_corner :
  forall c : RackCorner,
    J (s1 c) = true ->
    J (s2 c) = true ->
    J (s3 c) = true ->
    CornerK c = true.


DERIVED: Lemma named 'genuine_corner_K' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Lemma genuine_corner_K : CornerK genuine_corner = true.


DERIVED: Lemma named 'genuine_seam_J' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Lemma genuine_seam_J : J genuine_seam = true.


DERIVED: Theorem named 'policy_alone_cannot_grant_write' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem policy_alone_cannot_grant_write :
  forall c : RackCorner,
    CornerK c = false ->
    WriteOK c true = false.


DERIVED: Theorem named 'single_seam_failure_defeats_corner' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem single_seam_failure_defeats_corner :
  forall c : RackCorner,
    J (s1 c) = false \/ J (s2 c) = false \/ J (s3 c) = false ->
    CornerK c = false.


DERIVED: Lemma named 'spoofed_corner_K' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Lemma spoofed_corner_K : CornerK spoofed_corner = false.


DERIVED: Lemma named 'spoofed_seam_J' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Lemma spoofed_seam_J : J spoofed_seam = false.


DERIVED: Theorem named 'spoofing_blindness' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem spoofing_blindness :
  ~ (forall c1 c2 : RackCorner,
       project_corner c1 shared_surface = project_corner c2 shared_surface ->
       CornerK c1 = CornerK c2).


DERIVED: Theorem named 'writeOK_monotone_cornerK' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem writeOK_monotone_cornerK :
  forall c : RackCorner, forall p : bool,
    CornerK c = false ->
    WriteOK c p = false.


DERIVED: Theorem named 'writeOK_not_surface_determined' in the ToRCornerSpoofingV1_31 family -- registry statement: CUB integration: cubie-core

Theorem writeOK_not_surface_determined :
  ~ (forall c1 c2 : RackCorner,
       project_corner c1 shared_surface = project_corner c2 shared_surface ->
       WriteOK c1 true = WriteOK c2 true).


DERIVED: theorem named 'assembledCoherent_implies_corners' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem assembledCoherent_implies_corners (c : AssembledCube)
    (h : assembledCoherentBool c = true) : allCornersConsistent c = true


DERIVED: theorem named 'assembledCoherent_implies_edges' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem assembledCoherent_implies_edges (c : AssembledCube)
    (h : assembledCoherentBool c = true) : allEdgesConsistent c = true


DERIVED: theorem named 'assembledCoherent_implies_faces' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem assembledCoherent_implies_faces (c : AssembledCube)
    (h : assembledCoherentBool c = true) : allStaticFacesValid c = true


DERIVED: Theorem named 'catalog_match_purges_memory' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

Theorem catalog_match_purges_memory :
  forall ac ledger catalog req M,
    catalog_matches catalog (request_anon_pointer req) = true ->
    kinetic_token_decision ac ledger catalog req M = PurgeTokenFromMemory.

theorem catalog_match_purges_memory
    (ac : AssembledCube) (ledger : ExpirationLedger)
    (catalog : BadActorCatalog) (req : ActiveRequest) (M : LocalManifold)
    (h : catalog.catalogMatches (requestAnonPointer req) = true) :
    kineticTokenDecision ac ledger catalog req M = .PurgeTokenFromMemory


DERIVED: theorem named 'classifyPartialAccess_twentyOne' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem classifyPartialAccess_twentyOne :
    classifyPartialAccess 21 = .PA_Inconsistent


DERIVED: theorem named 'classifyPartialAccess_zero' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem classifyPartialAccess_zero :
    classifyPartialAccess 0 = .PA_Solved


DERIVED: theorem named 'consumeParams_length' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

theorem consumeParams_length (ps : List LinearHandoffParam) :
    (consumeParams ps).length = ps.length


DERIVED: Theorem named 'expiration_purges_memory' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

Theorem expiration_purges_memory :
  forall ac ledger catalog req M,
    catalog_matches catalog (request_anon_pointer req) = false ->
    internally_expired ledger (request_anon_pointer req) = true ->
    kinetic_token_decision ac ledger catalog req M = PurgeTokenFromMemory.

theorem expiration_purges_memory
    (ac : AssembledCube) (ledger : ExpirationLedger)
    (catalog : BadActorCatalog) (req : ActiveRequest) (M : LocalManifold)
    (hCat : catalog.catalogMatches (requestAnonPointer req) = false)
    (hExp : ledger.internallyExpired (requestAnonPointer req) = true) :
    kineticTokenDecision ac ledger catalog req M = .PurgeTokenFromMemory


DERIVED: Theorem named 'structural_incoherence_trips_absolute_block' in the cubieq_omega_incremental_append family -- registry statement: CUB integration: cubie-core

Theorem structural_incoherence_trips_absolute_block :
  forall ac ledger catalog req M safe,
    catalog_matches catalog (request_anon_pointer req) = false ->
    internally_expired ledger (request_anon_pointer req) = false ->
    evaluate_grand_fusion_certified req M = inr safe ->
    assembled_coherent ac = false ->
    kinetic_token_decision ac ledger catalog req M = InvalidateAndBurnAccess.

theorem structural_incoherence_trips_absolute_block
    (ac : AssembledCube) (ledger : ExpirationLedger)
    (catalog : BadActorCatalog) (req : ActiveRequest) (M : LocalManifold)
    (safe : GrandFusionSafe req M)
    (hCat   : catalog.catalogMatches (requestAnonPointer req) = false)
    (hExp   : ledger.internallyExpired (requestAnonPointer req) = false)
    (hSafe  : evaluateGrandFusionCertified req M = .inr safe)
    (hCoh   : assembledCoherentBool ac = false) :
    kineticTokenDecision ac ledger catalog req M = .InvalidateAndBurnAccess


DERIVED: theorem named 'authV1_10_implies_edge_corner_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CUB integration: cubie-core

theorem authV1_10_implies_edge_corner_ok
    (ac : AssembledCube) (req : ActiveRequest) (M : LocalManifold)
    (env : OmegaAuthEnvelope)
    (h : authV1_10Bool ac req M env = true) :
    edgeCornerOkBool ac = true


DERIVED: theorem named 'authV1_10_implies_evidence_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CUB integration: cubie-core

theorem authV1_10_implies_evidence_ok
    (ac : AssembledCube) (req : ActiveRequest) (M : LocalManifold)
    (env : OmegaAuthEnvelope)
    (h : authV1_10Bool ac req M env = true) :
    evidenceRecordOkBool env.oaeEvidence = true


DERIVED: theorem named 'authV1_10_implies_grand_fusion_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CUB integration: cubie-core

theorem authV1_10_implies_grand_fusion_ok
    (ac : AssembledCube) (req : ActiveRequest) (M : LocalManifold)
    (env : OmegaAuthEnvelope)
    (h : authV1_10Bool ac req M env = true) :
    grandFusionOkBool req M = true


DERIVED: theorem named 'authV1_10_implies_mode_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CUB integration: cubie-core

theorem authV1_10_implies_mode_ok
    (ac : AssembledCube) (req : ActiveRequest) (M : LocalManifold)
    (env : OmegaAuthEnvelope)
    (h : authV1_10Bool ac req M env = true) :
    readWriteModeOkBool ac env.oaeAction = true


DERIVED: Theorem named 'bigraph_place_assoc' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem bigraph_place_assoc : forall h g f,
  composePlace (composePlace h g) f = composePlace h (composePlace g f).


DERIVED: Theorem named 'fano_error_lower_bound' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem fano_error_lower_bound : forall R I errs, R <= I + errs -> R - I <= errs.


DERIVED: theorem named 'geometric_complexity_futility' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem geometric_complexity_futility : forall B base,
  2 <= base -> B < coordChain base B.

theorem geometric_complexity_futility (B base : Nat) (h : 2 ≤ base) :
    B < coordChain base B


DERIVED: theorem named 'grg_exact' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem grg_exact : forall (St : Type) (seed : St) (step : St -> St) (n : nat),
  grg seed step (S n) = step (grg seed step n).

theorem grg_exact {α : Type} (seed : α) (step : α → α) (n : Nat) :
    Nat.iterate step (n + 1) seed = step (Nat.iterate step n seed)

pub proof fn cub_3044_grg_exact<St>(
    seed: St,
    step: spec_fn(St) -> St,
    n: nat,
)
    ensures
        grg(seed, step, n + 1) == step(grg(seed, step, n)),


DERIVED: Theorem named 'holevo_accessible_bounded' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem holevo_accessible_bounded : forall acc ent cap,
  acc <= ent -> ent <= cap -> acc <= cap.


DERIVED: Theorem named 'hypercontraction_decay' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem hypercontraction_decay : forall f w n, f <= w -> f ^ n <= w ^ n.


DERIVED: Theorem named 'judgmental_congruence' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem judgmental_congruence : forall (A B : Type) (f : A -> B) (a a' : A),
  a = a' -> f a = f a'.


DERIVED: Theorem named 'judgmental_substitution' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem judgmental_substitution : forall (A : Type) (P : A -> Prop) (a a' : A),
  a = a' -> P a -> P a'.


DERIVED: Theorem named 'kl_zero_leak_no_advantage' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem kl_zero_leak_no_advantage : forall adv leak, adv <= leak -> leak = 0 -> adv = 0.


DERIVED: Theorem named 'knill_laflamme_correctable' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem knill_laflamme_correctable : forall (L St : Type) (enc : L -> St) (err : St -> St),
  Recoverable enc err <-> InjectiveC (fun l => err (enc l)).


DERIVED: Theorem named 'koopman_tracks_orbit' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem koopman_tracks_orbit : forall (St : Type) (phi : St -> St) (f : St -> nat) (n : nat) (x : St),
  koopman phi f n x = f (iterate phi n x).


DERIVED: theorem named 'n_lt_two_pow' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Lemma n_lt_two_pow : forall n, n < 2 ^ n.

theorem n_lt_two_pow (n : Nat) : n < 2 ^ n


DERIVED: Theorem named 'nesting_monotone' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem nesting_monotone : forall base K K',
  1 <= base -> K <= K' -> coordChain base K <= coordChain base K'.


DERIVED: Theorem named 'power_law_monotone' in the v1_3_DriveMathFormalization_0521 family -- registry statement: CUB integration: cubie-core

Theorem power_law_monotone : forall tau tau' alpha,
  tau <= tau' -> tau ^ alpha <= tau' ^ alpha.