DERIVED: Theorem named 'corner_admission_requires_internal_evidence' in the RamenCornerConsensusV1193 family -- registry statement: RCC v1.19.3

Theorem corner_admission_requires_internal_evidence :
  exists s : CornerSurface,
    exists c1 c2 : Corner,
      project_corner c1 = s /\
      project_corner c2 = s /\
      writeOK c1 true <> writeOK c2 true.

theorem corner_admission_requires_internal_evidence :
    ∃ s : CornerSurface,
      ∃ c1 c2 : Corner,
        project_corner c1 = s ∧
        project_corner c2 = s ∧
        WriteOK c1 true ≠ WriteOK c2 true


DERIVED: Definition named 'CornerTopologyOK' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition CornerTopologyOK (c : Corner) : bool :=
  (negb (nonce (e1 c) =? nonce (e2 c)) &&
   negb (nonce (e2 c) =? nonce (e3 c)) &&
   negb (nonce (e1 c) =? nonce (e3 c))) &&
  ((target_id (e1 c) =? target_node c) &&
   (target_id (e2 c) =? target_node c) &&
   (target_id (e3 c) =? target_node c)) &&
  ((timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
   (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
   (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))).

not stated in registry status for this row

def CornerTopologyOK (c : Corner) : Bool

(empty -- not bound to any bare-metal exec fn/crate)


DERIVED: Definition named 'CornerK' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition CornerK (c : Corner) : bool :=
  J (e1 c) && J (e2 c) && J (e3 c) && CornerTopologyOK c.


DERIVED: Definition named 'WriteOK' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition WriteOK (c : Corner) (policyOK : bool) : bool :=
  CornerK c && policyOK.

cubie-tools/src/main.rs cubieq-selftest subcommand; cubie-tools/src/runtime_shadow.rs cubieq_selftest_fixture() -> cubie_core::cubieq_wiring::cub_0924_catalog_match_purges_memory; cubie-core/src/cubieq_wiring.rs delegates to cubie_core::cubieq::kinetic_token_decision (Q2 batch 2); verus/cubieq_addendum_spec.rs cub_0924_catalog_match_purges_memory

Q2 batch 2 catalog-match purge witness via shipping kinetic_token_decision; TEST-ANCHORED advisory only.

reviewed audit contract blocks this file-local evidence from the canonical CUB identity

def WriteOK (c : Corner) (policyOK : Bool) : Bool


DERIVED: Definition named 'evaluate_seam' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition evaluate_seam (e : SeamEvidence) : TypedThreshold :=
  {| time_passed    := timestamp e <=? expiry e;
     id_passed      := id_ok e;
     purpose_passed := purpose_ok e;
     lineage_passed := lineage_ok e;
     version_passed := version_ok e;
     scope_passed   := scope_ok e;
     attest_passed  := attest_ok e |}.

cubie-tools/src/main.rs cubieq-selftest subcommand; cubie-tools/src/runtime_shadow.rs cubieq_selftest_fixture() -> cubie_core::cubieq_wiring::cub_0925_expiration_purges_memory; cubie-core/src/cubieq_wiring.rs delegates to cubie_core::cubieq::kinetic_token_decision (Q2 batch 2); verus/cubieq_addendum_spec.rs cub_0925_expiration_purges_memory

Q2 batch 2 expiration purge witness via shipping kinetic_token_decision; TEST-ANCHORED not production blocking.

def evaluate_seam (e : SeamEvidence) : TypedThreshold


DERIVED: Definition named 'is_clean' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition is_clean (t : TypedThreshold) : bool :=
  time_passed t && id_passed t && purpose_passed t &&
  lineage_passed t && version_passed t && scope_passed t && attest_passed t.


DERIVED: Definition named 'evaluate_corner' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition evaluate_corner (c : Corner) (policyOK : bool) : CornerDiagnostics :=
  {| e1_diag := evaluate_seam (e1 c);
     e2_diag := evaluate_seam (e2 c);
     e3_diag := evaluate_seam (e3 c);
     topology_passed := CornerTopologyOK c;
     policy_passed := policyOK |}.

def evaluate_corner (c : Corner) (policyOK : Bool) : CornerDiagnostics


DERIVED: Definition named 'all_passed' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Definition all_passed (d : CornerDiagnostics) : bool :=
  is_clean (e1_diag d) && is_clean (e2_diag d) && is_clean (e3_diag d) &&
  topology_passed d && policy_passed d.


DERIVED: Theorem named 'seam_is_clean_eq_J' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Theorem seam_is_clean_eq_J : forall e : SeamEvidence,
  J e = is_clean (evaluate_seam e).

theorem seam_is_clean_eq_J (e : SeamEvidence) :
  e.J = (evaluate_seam e).is_clean


DERIVED: Theorem named 'corner_authorization_iff_diagnostics_passed' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Theorem corner_authorization_iff_diagnostics_passed : forall (c : Corner) (policyOK : bool),
  WriteOK c policyOK = all_passed (evaluate_corner c policyOK).

theorem corner_authorization_iff_diagnostics_passed (c : Corner) (policyOK : Bool) :
  WriteOK c policyOK = (evaluate_corner c policyOK).all_passed


DERIVED: Theorem named 'explainable_denial_identity' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Theorem explainable_denial_identity : forall c policyOK,
  id_passed (evaluate_seam (e1 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_identity (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e1).id_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_lineage' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Theorem explainable_denial_lineage : forall c policyOK,
  lineage_passed (evaluate_seam (e2 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_lineage (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e2).lineage_passed = false → WriteOK c policyOK = false


DERIVED: Theorem named 'explainable_denial_time_window' in the RamenCornerConsensus_v1_19_addon family -- registry statement: RCC v1.19 add-on

Theorem explainable_denial_time_window : forall c policyOK,
  time_passed (evaluate_seam (e3 c)) = false -> WriteOK c policyOK = false.

theorem explainable_denial_time_window (c : Corner) (policyOK : Bool) :
  (evaluate_seam c.e3).time_passed = false → WriteOK c policyOK = false


DERIVED: Fixpoint named 'ChainOK' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

def ChainOK : List SeamEvidence → Bool
  | [] => true
  | [_] => true
  | e1 :: e2 :: es => (e1.target_id == e2.origin_id) && ChainOK (e2 :: es)

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'contains_node' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'distinct_nodes' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'extract_targets' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Definition named 'is_acyclic' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Definition is_acyclic (p : list SeamEvidence) : bool :=
  match p with
  | [] => true
  | e :: _ => negb (contains_node (origin_id e) (extract_targets p))
              && distinct_nodes (extract_targets p)
  end.

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'NoEscalation' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

def NoEscalation : List SeamEvidence → Bool
  | [] => true
  | [_] => true
  | e1 :: e2 :: es => decide (e2.privilege_level ≤ e1.privilege_level) && NoEscalation (e2 :: es)

-- 4. Autonomous Workflow ------------------------------------------------------
structure Workflow where
  visibleAPI : Nat
  densityOK  : Bool
  path       : List SeamEvidence

def AuthStar (w : Workflow) : Bool


DERIVED: Fixpoint named 'path_valid' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1


DERIVED: Definition named 'AuthStar' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Definition AuthStar (w : Workflow) : bool :=
  match path w with
  | [] => false
  | p => densityOK w && ChainOK p && is_acyclic p && NoEscalation p && path_valid p
  end.


DERIVED: Theorem named 'cyclic_path_rejected' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Theorem cyclic_path_rejected :
  exists (w : Workflow),
    densityOK w = true /\
    path w <> [] /\
    ChainOK (path w) = true /\
    is_acyclic (path w) = false /\
    AuthStar w = false.

theorem cyclic_path_rejected :
  ∃ (w : Workflow),
    w.densityOK = true ∧
    w.path ≠ [] ∧
    ChainOK w.path = true ∧
    is_acyclic w.path = false ∧
    AuthStar w = false


DERIVED: Theorem named 'privilege_escalation_rejected' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Theorem privilege_escalation_rejected : forall e1 e2 es,
  privilege_level e2 > privilege_level e1 ->
  NoEscalation (e1 :: e2 :: es) = false.

theorem privilege_escalation_rejected (e1 e2 : SeamEvidence) (es : List SeamEvidence) :
    e1.privilege_level < e2.privilege_level →
    NoEscalation (e1 :: e2 :: es) = false


DERIVED: Definition named 'CornerConsensus' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Definition CornerConsensus (c : Corner) : bool :=
  J (e1 c) && J (e2 c) && J (e3 c) &&
  (negb (nonce (e1 c) =? nonce (e2 c)) &&
   negb (nonce (e2 c) =? nonce (e3 c)) &&
   negb (nonce (e1 c) =? nonce (e3 c))) &&
  ((target_id (e1 c) =? target_node c) &&
   (target_id (e2 c) =? target_node c) &&
   (target_id (e3 c) =? target_node c)) &&
  ((timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
   (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
   (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))).

bare-metal-tests/tests/cub_ctree_teeth_tests.rs:57 cub_0944_c_tree_base_case_teeth (spec-value pin, closed-form recompute, witness delegation to shipping c_tree(0))

Wave 1 teeth-test anchors c_tree(0) == 1 against the shipping recurrence and geometry consts; runtime wire not claimed.


DERIVED: Definition named 'WriteOK' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Definition WriteOK (c : Corner) (policyOK : bool) : bool :=
  CornerConsensus c && policyOK.

bare-metal-tests/tests/cub_ctree_teeth_tests.rs:86 cub_0945_c_tree_depth1_teeth (spec-value pin, depth-1 recurrence step, closed-form recompute, witness delegation)

Wave 1 teeth-test anchors c_tree(1) == 55 against the shipping recurrence and geometry consts; runtime wire not claimed.


DERIVED: Theorem named 'asynchronous_corner_rejected' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Theorem asynchronous_corner_rejected : forall c policy,
  exec_time c < timestamp (e1 c) -> WriteOK c policy = false.

bare-metal-tests/tests/cub_ctree_teeth_tests.rs:114 cub_0946_c_tree_depth2_teeth (spec-value pin, depth-2 recurrence step, closed-form recompute, witness delegation)

Wave 1 teeth-test anchors c_tree(2) == 2971 against the shipping recurrence and geometry consts; runtime wire not claimed.

theorem asynchronous_corner_rejected (c : Corner) (policy : Bool) :
    c.exec_time < c.e1.timestamp → WriteOK c policy = false


DERIVED: Definition named 'denial_set_size' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Definition denial_set_size (c : Corner) (policyOK : bool) : nat :=
  (if J (e1 c) then 0 else 1) +
  (if J (e2 c) then 0 else 1) +
  (if J (e3 c) then 0 else 1) +
  (if negb (nonce (e1 c) =? nonce (e2 c)) &&
      negb (nonce (e2 c) =? nonce (e3 c)) &&
      negb (nonce (e1 c) =? nonce (e3 c)) then 0 else 1) +
  (if (target_id (e1 c) =? target_node c) &&
      (target_id (e2 c) =? target_node c) &&
      (target_id (e3 c) =? target_node c) then 0 else 1) +
  (if (timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
      (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
      (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))
   then 0 else 1) +
  (if policyOK then 0 else 1).

def denial_set_size (c : Corner) (policyOK : Bool) : Nat


DERIVED: Theorem named 'unified_explainable_denial' in the Ramen_v1_17_1 family -- registry statement: Ramen v1.17.1

Theorem unified_explainable_denial : forall c policyOK,
  WriteOK c policyOK = false <-> denial_set_size c policyOK > 0.

bare-metal-tests/tests/cub_ctree_teeth_tests.rs:144 cub_0948_omega_tree_exponent_depth0_teeth (definitional identity omega_tree_exponent(0) == c_tree(0) recomputed, cross-witness agreement)

Wave 1 teeth-test anchors omega_tree_exponent(0) == 1 against the shipping c_tree recurrence; runtime wire not claimed.

theorem unified_explainable_denial (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = false ↔ denial_set_size c policyOK > 0


DERIVED: Fixpoint named 'ChainOK' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

bare-metal-tests/tests/cub_ctree_teeth_tests.rs:170 cub_0949_omega_tree_exponent_depth1_teeth (definitional identity omega_tree_exponent(1) == c_tree(1) recomputed, closed-form recompute, cross-witness agreement)

Wave 1 teeth-test anchors omega_tree_exponent(1) == 55 against the shipping c_tree recurrence; runtime wire not claimed.

def ChainOK : List SeamEvidence → Bool
  | [] => true
  | [_] => true
  | e1 :: e2 :: es => (e1.target_id == e2.origin_id) && ChainOK (e2 :: es)

def contains_nonce (n : Nat) : List SeamEvidence → Bool
  | [] => false
  | x::xs => (n == x.nonce) || contains_nonce n xs

def distinct_nonces : List SeamEvidence → Bool
  | [] => true
  | x::xs => !(contains_nonce x.nonce xs) && distinct_nonces xs

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'contains_nonce' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

def contains_nonce (n : Nat) : List SeamEvidence → Bool
  | [] => false
  | x::xs => (n == x.nonce) || contains_nonce n xs

def distinct_nonces : List SeamEvidence → Bool
  | [] => true
  | x::xs => !(contains_nonce x.nonce xs) && distinct_nonces xs

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'distinct_nonces' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

def distinct_nonces : List SeamEvidence → Bool
  | [] => true
  | x::xs => !(contains_nonce x.nonce xs) && distinct_nonces xs

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'contains_node' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Fixpoint named 'distinct_nodes' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Fixpoint named 'extract_targets' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'is_acyclic' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Fixpoint named 'NoEscalation' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

def NoEscalation : List SeamEvidence → Bool
  | [] => true
  | [_] => true
  | e1 :: e2 :: es =>
      decide (e2.privilege_level ≤ e1.privilege_level) && NoEscalation (e2 :: es)

-- ==============================================================================
-- SECTION III -- WORKFLOW AND AUTHORIZATION
-- ==============================================================================

structure Workflow where
  visibleAPI : Nat
  densityOK  : Bool
  path       : List SeamEvidence

def AuthStar (w : Workflow) : Bool


DERIVED: Fixpoint named 'path_valid' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'AuthStar' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Definition AuthStar (w : Workflow) : bool :=
  match path w with
  | [] => false
  | p => densityOK w && ChainOK p && distinct_nonces p && is_acyclic p
         && NoEscalation p && path_valid p
  end.


DERIVED: Theorem named 'vacuous_path_rejected' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem vacuous_path_rejected : forall w, path w = [] -> AuthStar w = false.

theorem vacuous_path_rejected (w : Workflow) :
    w.path = [] → AuthStar w = false


DERIVED: Theorem named 'discontinuous_path_rejected' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem discontinuous_path_rejected :
  exists (w_valid w_discontinuous : Workflow),
    path_valid (path w_valid) = true /\
    path_valid (path w_discontinuous) = true /\
    AuthStar w_valid = true /\
    AuthStar w_discontinuous = false.

theorem discontinuous_path_rejected :
    ∃ (w_valid w_discontinuous : Workflow),
      w_valid.path.all SeamEvidence.J = true ∧
      w_discontinuous.path.all SeamEvidence.J = true ∧
      AuthStar w_valid = true ∧
      AuthStar w_discontinuous = false


DERIVED: Theorem named 'path_distinct_nonces_enforced' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem path_distinct_nonces_enforced :
  exists (w_unique w_replay : Workflow),
    densityOK w_unique = true /\ densityOK w_replay = true /\
    ChainOK (path w_unique) = true /\ ChainOK (path w_replay) = true /\
    is_acyclic (path w_unique) = true /\ is_acyclic (path w_replay) = true /\
    NoEscalation (path w_unique) = true /\ NoEscalation (path w_replay) = true /\
    path_valid (path w_unique) = true /\ path_valid (path w_replay) = true /\
    distinct_nonces (path w_unique) = true /\
    distinct_nonces (path w_replay) = false /\
    AuthStar w_unique = true /\
    AuthStar w_replay = false.

theorem path_distinct_nonces_enforced :
    ∃ (w_unique w_replay : Workflow),
      distinct_nonces w_unique.path = true ∧
      distinct_nonces w_replay.path = false ∧
      AuthStar w_unique = true ∧
      AuthStar w_replay = false


DERIVED: Theorem named 'temporal_expiration_enforced' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem temporal_expiration_enforced : forall e : SeamEvidence,
  timestamp e > expiry e -> J e = false.

theorem temporal_expiration_enforced (e : SeamEvidence) (h : e.expiry < e.timestamp) :
    e.J = false


DERIVED: Theorem named 'cyclic_path_rejected' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

theorem cyclic_path_rejected :
    ∃ (w : Workflow),
      w.densityOK = true ∧
      w.path ≠ [] ∧
      ChainOK w.path = true ∧
      is_acyclic w.path = false ∧
      AuthStar w = false


DERIVED: Theorem named 'privilege_escalation_rejected' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'CornerConsensus' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'WriteOK' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

def WriteOK (c : Corner) (policyOK : Bool) : Bool


DERIVED: Theorem named 'cryptographic_independence_enforced' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem cryptographic_independence_enforced : forall c policy,
  nonce (e1 c) = nonce (e2 c) -> WriteOK c policy = false.

theorem cryptographic_independence_enforced (c : Corner) (policy : Bool) :
    c.e1.nonce = c.e2.nonce → WriteOK c policy = false


DERIVED: Theorem named 'asynchronous_corner_rejected' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'denial_set_size' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Theorem named 'unified_explainable_denial' in the Ramen_v1_18 family -- registry statement: Ramen v1.18


DERIVED: Definition named 'seam_surface' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Definition seam_surface (e : SeamEvidence) : SeamSurface :=
  {| ss_nonce := nonce e;
     ss_origin_id := origin_id e;
     ss_target_id := target_id e;
     ss_privilege_level := privilege_level e;
     ss_timestamp := timestamp e;
     ss_expiry := expiry e |}.

def seam_surface (e : SeamEvidence) : SeamSurface


DERIVED: Definition named 'project_surface' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Definition project_surface (w : Workflow) : Surface :=
  {| surf_visibleAPI := visibleAPI w;
     surf_densityOK  := densityOK w;
     surf_seams      := map seam_surface (path w) |}.

def project_surface (w : Workflow) : Surface


DERIVED: Theorem named 'surface_spoofing_separation' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

Theorem surface_spoofing_separation :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\
    AuthStar w_s = false.

theorem surface_spoofing_separation :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧
      AuthStar w_s = false


DERIVED: Corollary named 'authstar_not_surface_determined' in the Ramen_v1_18 family -- registry statement: Ramen v1.18

theorem authstar_not_surface_determined :
    ¬ (∀ w1 w2 : Workflow,
         project_surface w1 = project_surface w2 → AuthStar w1 = AuthStar w2)


DERIVED: Fixpoint named 'ChainOK' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Fixpoint named 'contains_nonce' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Fixpoint named 'distinct_nonces' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Fixpoint named 'contains_node' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

def contains_node (n : Nat) : List Nat → Bool
  | [] => false
  | x::xs => (n == x) || contains_node n xs

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'distinct_nodes' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

def distinct_nodes : List Nat → Bool
  | [] => true
  | x::xs => !(contains_node x xs) && distinct_nodes xs

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'extract_targets' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

def extract_targets : List SeamEvidence → List Nat
  | [] => []
  | e::es => e.target_id :: extract_targets es

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Definition named 'is_acyclic' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition is_acyclic (p : list SeamEvidence) : bool :=
  match p with
  | [] => true
  | e :: _ => negb (contains_node (origin_id e) (extract_targets p))
              && distinct_nodes (extract_targets p)
  end.

def is_acyclic (p : List SeamEvidence) : Bool


DERIVED: Fixpoint named 'NoEscalation' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Fixpoint named 'path_valid' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Definition named 'AuthStar' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Theorem named 'vacuous_path_rejected' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Theorem named 'discontinuous_path_rejected' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Theorem named 'path_distinct_nonces_enforced' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem path_distinct_nonces_enforced :
  exists (w_unique w_replay : Workflow),
    distinct_nonces (path w_unique) = true /\
    distinct_nonces (path w_replay) = false /\
    AuthStar w_unique = true /\
    AuthStar w_replay = false.


DERIVED: Theorem named 'temporal_expiration_enforced' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Theorem named 'cyclic_path_rejected' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem cyclic_path_rejected :
  exists (w : Workflow),
    densityOK w = true /\
    path w <> [] /\
    ChainOK (path w) = true /\
    is_acyclic (path w) = false /\
    AuthStar w = false.


DERIVED: Theorem named 'privilege_escalation_rejected' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem privilege_escalation_rejected : forall e1 e2 es,
  privilege_level e2 > privilege_level e1 ->
  NoEscalation (e1 :: e2 :: es) = false.

theorem privilege_escalation_rejected (e1 e2 : SeamEvidence) (es : List SeamEvidence) :
    e1.privilege_level < e2.privilege_level →
    NoEscalation (e1 :: e2 :: es) = false


DERIVED: Definition named 'CornerConsensus' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition CornerConsensus (c : Corner) : bool :=
  J (e1 c) && J (e2 c) && J (e3 c) &&
  (negb (nonce (e1 c) =? nonce (e2 c)) &&
   negb (nonce (e2 c) =? nonce (e3 c)) &&
   negb (nonce (e1 c) =? nonce (e3 c))) &&
  ((target_id (e1 c) =? target_node c) &&
   (target_id (e2 c) =? target_node c) &&
   (target_id (e3 c) =? target_node c)) &&
  ((timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
   (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
   (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))).


DERIVED: Definition named 'WriteOK' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition WriteOK (c : Corner) (policyOK : bool) : bool :=
  CornerConsensus c && policyOK.


DERIVED: Theorem named 'cryptographic_independence_enforced' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Theorem named 'asynchronous_corner_rejected' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem asynchronous_corner_rejected : forall c policy,
  exec_time c < timestamp (e1 c) -> WriteOK c policy = false.

theorem asynchronous_corner_rejected (c : Corner) (policy : Bool) :
    c.exec_time < c.e1.timestamp → WriteOK c policy = false


DERIVED: Definition named 'denial_set_size' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition denial_set_size (c : Corner) (policyOK : bool) : nat :=
  (if J (e1 c) then 0 else 1) +
  (if J (e2 c) then 0 else 1) +
  (if J (e3 c) then 0 else 1) +
  (if negb (nonce (e1 c) =? nonce (e2 c)) &&
      negb (nonce (e2 c) =? nonce (e3 c)) &&
      negb (nonce (e1 c) =? nonce (e3 c)) then 0 else 1) +
  (if (target_id (e1 c) =? target_node c) &&
      (target_id (e2 c) =? target_node c) &&
      (target_id (e3 c) =? target_node c) then 0 else 1) +
  (if (timestamp (e1 c) <=? exec_time c) && (exec_time c <=? expiry (e1 c)) &&
      (timestamp (e2 c) <=? exec_time c) && (exec_time c <=? expiry (e2 c)) &&
      (timestamp (e3 c) <=? exec_time c) && (exec_time c <=? expiry (e3 c))
   then 0 else 1) +
  (if policyOK then 0 else 1).

def denial_set_size (c : Corner) (policyOK : Bool) : Nat


DERIVED: Theorem named 'unified_explainable_denial' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem unified_explainable_denial : forall c policyOK,
  WriteOK c policyOK = false <-> denial_set_size c policyOK > 0.

theorem unified_explainable_denial (c : Corner) (policyOK : Bool) :
    WriteOK c policyOK = false ↔ denial_set_size c policyOK > 0


DERIVED: Definition named 'seam_surface' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Definition named 'project_surface' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Definition named 'good_seam_2' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition good_seam_2 : SeamEvidence :=
  {| nonce:=2; origin_id:=2; target_id:=3; privilege_level:=40;
     timestamp:=100; expiry:=200; id_ok:=true; purpose_ok:=true;
     lineage_ok:=true; version_ok:=true; scope_ok:=true; attest_ok:=true |}.


DERIVED: Theorem named 'surface_spoofing_separation_id_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_id_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_id_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation_purpose_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_purpose_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_purpose_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation_lineage_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_lineage_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_lineage_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation_version_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_version_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_version_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation_scope_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_scope_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_scope_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation_attest_ok' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation_attest_ok :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation_attest_ok :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Theorem named 'surface_spoofing_separation' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem surface_spoofing_separation :
  exists (w_g w_s : Workflow),
    project_surface w_g = project_surface w_s /\
    AuthStar w_g = true /\ AuthStar w_s = false.

theorem surface_spoofing_separation :
    ∃ (w_g w_s : Workflow),
      project_surface w_g = project_surface w_s ∧
      AuthStar w_g = true ∧ AuthStar w_s = false


DERIVED: Corollary named 'authstar_not_surface_determined' in the Ramen_v1_19 family -- registry statement: Ramen v1.19


DERIVED: Definition named 'time_seam_surface' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition time_seam_surface (e : SeamEvidence) : TimeSurfaceSeam :=
  {| tss_nonce := nonce e;
     tss_origin_id := origin_id e;
     tss_target_id := target_id e;
     tss_privilege_level := privilege_level e;
     tss_id_ok := id_ok e;
     tss_purpose_ok := purpose_ok e;
     tss_lineage_ok := lineage_ok e;
     tss_version_ok := version_ok e;
     tss_scope_ok := scope_ok e;
     tss_attest_ok := attest_ok e |}.

def time_seam_surface (e : SeamEvidence) : TimeSurfaceSeam


DERIVED: Definition named 'project_time_surface' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Definition project_time_surface (w : Workflow) : TimeSurface :=
  {| tsurf_visibleAPI := visibleAPI w;
     tsurf_densityOK  := densityOK w;
     tsurf_seams      := map time_seam_surface (path w) |}.

def project_time_surface (w : Workflow) : TimeSurface


DERIVED: Theorem named 'time_spoofing_separation' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

Theorem time_spoofing_separation :
  exists (w_g w_s : Workflow),
    project_time_surface w_g = project_time_surface w_s /\
    AuthStar w_g = true /\
    AuthStar w_s = false.

theorem time_spoofing_separation :
    ∃ (w_g w_s : Workflow),
      project_time_surface w_g = project_time_surface w_s ∧
      AuthStar w_g = true ∧
      AuthStar w_s = false


DERIVED: Corollary named 'authstar_not_timesurface_determined' in the Ramen_v1_19 family -- registry statement: Ramen v1.19

theorem authstar_not_timesurface_determined :
    ¬ (∀ w1 w2 : Workflow,
         project_time_surface w1 = project_time_surface w2 →
         AuthStar w1 = AuthStar w2)


DERIVED: Definition named 'is_opposite' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition is_opposite (f1 f2 : Face) : bool :=
  match f1, f2 with
  | Who, How => true
  | How, Who => true
  | What, Why => true
  | Why, What => true
  | When, Where => true
  | Where, When => true
  | _, _ => false
  end.


DERIVED: Definition named 'face_eqb' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition face_eqb (f1 f2 : Face) : bool :=
  match f1, f2 with
  | Who, Who => true | What, What => true | When, When => true
  | Where, Where => true | Why, Why => true | How, How => true
  | _, _ => false
  end.


DERIVED: Definition named 'edge_valid' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition edge_valid (e : Edge12) : bool :=
  negb (face_eqb (e_f1 e) (e_f2 e)) && negb (is_opposite (e_f1 e) (e_f2 e)).


DERIVED: Definition named 'corner_valid' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition corner_valid (c : Corner8) : bool :=
  negb (face_eqb (c_f1 c) (c_f2 c)) && negb (face_eqb (c_f2 c) (c_f3 c)) && negb (face_eqb (c_f1 c) (c_f3 c)) &&
  negb (is_opposite (c_f1 c) (c_f2 c)) && negb (is_opposite (c_f2 c) (c_f3 c)) && negb (is_opposite (c_f1 c) (c_f3 c)).


DERIVED: Definition named 'severity_score' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition severity_score (d : TokenDecision) : nat :=
  match d with
  | Production  => 0
  | Constrained => 1
  | Challenge   => 2
  | Escalate    => 3
  | Synthetic   => 4
  | HardBlock   => 5
  end.

def severity_score (d : TokenDecision) : Nat


DERIVED: Definition named 'AuthMaster' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Definition AuthMaster (s : SystemState) : bool :=
  auth_v1_10_passed s && static_kinetic_sep_ok s && edge_map_ok s &&
  corner_map_ok s && token_decision_ok s && expiration_ok s && catalog_ok s &&
  synthetic_sim_ok s && attribution_ok s && petri_handoff_ok s &&
  bigraph_ok s && proof_status_ok s && runtime_slo_ok s &&
  decision_is_production (decision s).

cubie-platform/src/cycle_counter.rs:229 cub_1017_admission_latency_fits_u64: no-arg; ensures result == (MAX_ADMIT_CYCLES <= u64::MAX), a trivially-true bound flagged absurd_extreme_comparisons (:227)

Plan Wave 2 no-arg-const rule: the bound MAX_ADMIT_CYCLES <= u64::MAX is true by type; recomputing it writes zero request-specific information. STANDALONE-BY-DESIGN; a rebuilt non-trivial latency bound is out of scope for this lane.


DERIVED: Theorem named 'static_kinetic_separation_enforced' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Theorem static_kinetic_separation_enforced : forall s : SystemState,
  static_kinetic_sep_ok s = false -> AuthMaster s = false.

theorem static_kinetic_separation_enforced (s : SystemState) :
  s.static_kinetic_sep_ok = false → AuthMaster s = false


DERIVED: Theorem named 'topological_closure_enforced' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Theorem topological_closure_enforced :
  edge_valid {| e_f1 := Who; e_f2 := How |} = false /\
  corner_valid {| c_f1 := Who; c_f2 := What; c_f3 := How |} = false.

theorem topological_closure_enforced :
  Edge12.valid ⟨Face.Who, Face.How⟩ = false ∧
  Corner8.valid ⟨Face.Who, Face.What, Face.How⟩ = false


DERIVED: Theorem named 'lattice_monotonicity_enforced' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Theorem lattice_monotonicity_enforced : forall s : SystemState,
  severity_score (decision s) >= severity_score Synthetic ->
  AuthMaster s = false.

theorem lattice_monotonicity_enforced (s : SystemState) :
  severity_score s.decision ≥ severity_score TokenDecision.Synthetic →
  AuthMaster s = false


DERIVED: Theorem named 'epistemic_discipline_collapse' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Theorem epistemic_discipline_collapse : forall s : SystemState,
  proof_status_ok s = false -> AuthMaster s = false.

theorem epistemic_discipline_collapse (s : SystemState) :
  s.proof_status_ok = false → AuthMaster s = false


DERIVED: Theorem named 'v1_10_subsumption_enforced' in the SemanticCalculus_v1_11 family -- registry statement: SemanticCalculus v1.11

Theorem v1_10_subsumption_enforced : forall s : SystemState,
  AuthMaster s = true -> auth_v1_10_passed s = true.

theorem v1_10_subsumption_enforced (s : SystemState) :
  AuthMaster s = true → s.auth_v1_10_passed = true


DERIVED: Definition named 'ManifoldValid' in the TheoremOmega4 family -- registry statement: Omega 4.0

Definition ManifoldValid (x : ActionTensor) : Prop :=
  Ax1_Thermodynamic x /\
  Ax2_Relativistic x /\
  Ax3_Informational x /\
  Ax4_Topological x /\
  Ax5_Geometric x.

def ManifoldValid (x : ActionTensor) : Prop


DERIVED: Theorem named 'omega_4_absolute' in the TheoremOmega4 family -- registry statement: Omega 4.0

Theorem omega_4_absolute : forall x, Adversarial x ->
  RoutedToPhotonicTarpit x /\ ~ MutatesPhysicalReality x.

theorem omega_4_absolute (x : ActionTensor) (h_adv : Adversarial x) :
  RoutedToPhotonicTarpit x ∧ ¬ MutatesPhysicalReality x


DERIVED: Definition named 'SentinelManifoldValid' in the TheoremOmega6 family -- registry statement: v1.10 TheoremOmega6

Definition SentinelManifoldValid
  (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop :=
    FractalDepth x <= StaticEventHorizon
 /\ ConditionalCompressibilityGap x s >= ExpertLineageFloor
 /\ EntangledTwistedParity x s k >= SurfaceFaceParity x
 /\ (GenerativePercolationDepth x <= PercolationCriticalLimit
        \/ AttestedInMacroRegistry x)
 /\ ToolchainTensorHash x = OrthogonalCrossCompileHash x
 /\ EphemeralTokenNonce x = AuthorizedSingleUseMint x s k.

def SentinelManifoldValid
    (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop


DERIVED: Theorem named 'omega_6_0_sentinel_absolute' in the TheoremOmega6 family -- registry statement: v1.10 TheoremOmega6

Theorem omega_6_0_sentinel_absolute :
  forall x s k, Adversarial x ->
    SentinelContainmentFailure x s k
 /\ RoutedToPhotonicTarpit x
 /\ ~ MutatesPhysicalReality x.

theorem omega_6_0_sentinel_absolute :
  ∀ x s k, Adversarial x →
    SentinelContainmentFailure x s k
  ∧ RoutedToPhotonicTarpit x
  ∧ ¬ MutatesPhysicalReality x


DERIVED: Definition named 'ManifoldValid' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Definition ManifoldValid (x : ActionTensor) : Prop :=
  Ax1_Thermodynamic x /\ Ax2_Relativistic x /\ Ax3_Informational x /\
  Ax4_Topological x /\ Ax5_Geometric x.

cubie-platform/src/capacity.rs:1137 weighted_seam_distance (proper metric, WEIGHTED_SEAM_MAX == 28; VERUS-BOUND, UNINVOKED on the admit path); bare-metal-tests/tests/v3_interop.rs:173/:180/:187 cub_1027 zero-self-distance, symmetry, and bounded-by-28 teeth-tests

Plan Wave 6 capacity v3 cluster: the weighted-seam-distance metric witness is anchored by real metric-property teeth-tests; runtime shadow wire is Wave 6 future work, not claimed. TEST-ANCHORED.


DERIVED: Theorem named 'omega_4_3_falsification' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Theorem omega_4_3_falsification : forall x, Adversarial x ->
  ContainmentFailure x /\ RoutedToPhotonicTarpit x /\ ~ MutatesPhysicalReality x.

cubie-platform/src/capacity.rs:584 topology_bloom_probe and :618 bloom_insert (TOPOLOGY_BLOOM geometric-memory fast path; VERUS-BOUND, UNINVOKED on the admit verdict path); bare-metal-tests/tests/admit_batch4_test.rs:342-375 scalar bloom_insert + topology_bloom_probe vs accel_bloom_insert equivalence teeth-test (both-branch present/absent)

Plan Wave 6 capacity v3 cluster: the geometric-memory bloom fast-path insert/probe pair is anchored by a real scalar-vs-accel equivalence teeth-test; runtime shadow fast-path activation is Wave 6 future work, not claimed. TEST-ANCHORED.

theorem omega_4_3_falsification (x : ActionTensor) (h_adv : Adversarial x) :
  ContainmentFailure x ∧ RoutedToPhotonicTarpit x ∧ ¬ MutatesPhysicalReality x


DERIVED: Theorem named 'orchestration_violation_implies_containment' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Theorem orchestration_violation_implies_containment :
  forall x, ~ (OrchestrationTempo x <= HumanChannelCapacity x) ->
  ContainmentFailure x /\ ~ ManifoldValid x.

theorem orchestration_violation_implies_containment
  (x : ActionTensor)
  (h_violation : ¬(OrchestrationTempo x ≤ HumanChannelCapacity x)) :
  ContainmentFailure x ∧ ¬ ManifoldValid x


DERIVED: Theorem named 'intent_violation_implies_containment' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Theorem intent_violation_implies_containment :
  forall x, ~ (ActualDelta x <= OperatorAuthorizedDelta x) ->
  ContainmentFailure x /\ ~ ManifoldValid x.

theorem intent_violation_implies_containment
  (x : ActionTensor)
  (h_violation : ¬(ActualDelta x ≤ OperatorAuthorizedDelta x)) :
  ContainmentFailure x ∧ ¬ ManifoldValid x


DERIVED: Theorem named 'provenance_violation_implies_containment' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Theorem provenance_violation_implies_containment :
  forall x, ~ (ProvenanceLevel x <= OperatorTrustScope x) ->
  ContainmentFailure x /\ ~ ManifoldValid x.

theorem provenance_violation_implies_containment
  (x : ActionTensor)
  (h_violation : ¬(ProvenanceLevel x ≤ OperatorTrustScope x)) :
  ContainmentFailure x ∧ ¬ ManifoldValid x


DERIVED: Theorem named 'toolchain_violation_implies_containment' in the TheoremOmega_v4_3 family -- registry statement: Omega 4.3

Theorem toolchain_violation_implies_containment :
  forall x, ~ (ToolchainIntegrityHash x = AttestedIntegrityHash x) ->
  ContainmentFailure x /\ ~ ManifoldValid x.

theorem toolchain_violation_implies_containment
  (x : ActionTensor)
  (h_violation : ¬(ToolchainIntegrityHash x = AttestedIntegrityHash x)) :
  ContainmentFailure x ∧ ¬ ManifoldValid x


DERIVED: Definition named 'OperationalFractalManifoldValid' in the TheoremOmega_v5_0 family -- registry statement: Omega 5.0

Definition OperationalFractalManifoldValid (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop :=
  FractalDepth x <= StaticEventHorizon /\
  ConditionalCompressibilityGap x s >= ExpertLineageFloor /\
  EntangledTwistedParity x s k >= SurfaceFaceParity x /\
  (GenerativePercolationDepth x <= PercolationCriticalLimit \/ AttestedInMacroRegistry x) /\
  ToolchainTensorHash x = OrthogonalCrossCompileHash x.

def OperationalFractalManifoldValid (x : ActionTensor) (s : SessionState) (k : HardwareKey) : Prop


DERIVED: Theorem named 'omega_5_0_production_absolute' in the TheoremOmega_v5_0 family -- registry statement: Omega 5.0

Theorem omega_5_0_production_absolute : forall x s k, Adversarial x ->
  OperationalContainmentFailure x s k /\ RoutedToPhotonicTarpit x /\ ~ MutatesPhysicalReality x.

theorem omega_5_0_production_absolute (x : ActionTensor) (s : SessionState) (k : HardwareKey) (h_adv : Adversarial x) :
  OperationalContainmentFailure x s k ∧ RoutedToPhotonicTarpit x ∧ ¬ MutatesPhysicalReality x


DERIVED: Definition named 'GeometricallyAligned' in the TheoremOmega_v6_0 family -- registry statement: Omega 6.0 (precanonical)

Definition GeometricallyAligned (x : ActionTensor) (g : GeometricFingerprint) : Prop :=
  InPlusConfiguration x g /\ ~ CrowdConfiguration x g.

def GeometricallyAligned (x : ActionTensor) (g : GeometricFingerprint) : Prop


DERIVED: Definition named 'HolographicGoodputManifoldValid' in the TheoremOmega_v6_0 family -- registry statement: Omega 6.0 (precanonical)

Definition HolographicGoodputManifoldValid
    (x : ActionTensor) (s : SessionState) (k : HardwareKey)
    (c : CausalClock) (g : GeometricFingerprint) : Prop :=
  GeometricallyAligned x g /\
  FractalDepth x <= StaticEventHorizon /\
  ConditionalCompressibilityGap x s >= ExpertLineageFloor /\
  CausalLineageWitness x s c /\
  EntangledTwistedParity x s k >= SurfaceFaceParity x /\
  (GenerativePercolationDepth x <= PercolationCriticalLimit \/ AttestedInMacroRegistry x) /\
  ToolchainTensorHash x = OrthogonalCrossCompileHash x.

def HolographicGoodputManifoldValid
    (x : ActionTensor) (s : SessionState) (k : HardwareKey)
    (c : CausalClock) (g : GeometricFingerprint) : Prop


DERIVED: Theorem named 'omega_6_0_holographic_absolute' in the TheoremOmega_v6_0 family -- registry statement: Omega 6.0 (precanonical)

Theorem omega_6_0_holographic_absolute :
  forall x s k c g, Adversarial x ->
    HolographicContainmentFailure x s k c g /\
    RoutedToPhotonicTarpit x /\
    ~ MutatesPhysicalReality x.

theorem omega_6_0_holographic_absolute
    (x : ActionTensor) (s : SessionState) (k : HardwareKey)
    (c : CausalClock) (g : GeometricFingerprint) (h_adv : Adversarial x) :
  HolographicContainmentFailure x s k c g ∧
  RoutedToPhotonicTarpit x ∧
  ¬ MutatesPhysicalReality x


DERIVED: Definition named 'seam_denials' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition seam_denials (s : ToRSeam) : nat :=
  bool_to_failure (id_ok s) + bool_to_failure (attest_ok s) +
  bool_to_failure (prov_ok s) + bool_to_failure (time_ok s) +
  bool_to_failure (lin_ok s) + bool_to_failure (scope_ok s) +
  bool_to_failure (waste_ok s).


DERIVED: Lemma named 'seam_denial_iff' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Lemma seam_denial_iff : forall s : ToRSeam,
  J s = true <-> seam_denials s = 0.

theorem seam_denial_iff (s : ToRSeam) : s.J = false <-> seam_denials s > 0


DERIVED: Definition named 'CornerK' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition CornerK (c : RackCorner) : bool :=
  J (s1 c) && J (s2 c) && J (s3 c) &&
  negb (Nat.eqb (nonce (s1 c)) (nonce (s2 c))) &&
  negb (Nat.eqb (nonce (s2 c)) (nonce (s3 c))) &&
  negb (Nat.eqb (nonce (s1 c)) (nonce (s3 c))) &&
  Nat.eqb (target_id (s1 c)) (target_node c) &&
  Nat.eqb (target_id (s2 c)) (target_node c) &&
  Nat.eqb (target_id (s3 c)) (target_node c).

cubie-core/src/replay.rs:75 payload_hash_matches(stored_hash, recomputed_hash): request-varying tamper predicate (result == (stored == recomputed); mismatch forces deny), VERUS-BOUND but UNINVOKED on the admit path; bare-metal-tests/tests/replay.rs:63/:71 cub_1040_payload_hash_match and cub_1040_payload_hash_mismatch both-branch tamper teeth-tests

Lane per-CUB read: the payload-hash tamper predicate is request-varying and anchored by a real both-branch tamper-detection teeth-test; its runtime wire is the Wave 6 sequence_check_and_update replay lane (not this lane). TEST-ANCHORED, no runtime call site claimed.


DERIVED: Definition named 'corner_denials' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition corner_denials (c : RackCorner) : nat :=
  bool_to_failure (J (s1 c)) + bool_to_failure (J (s2 c)) +
  bool_to_failure (J (s3 c)) +
  bool_to_failure (negb (Nat.eqb (nonce (s1 c)) (nonce (s2 c)))) +
  bool_to_failure (negb (Nat.eqb (nonce (s2 c)) (nonce (s3 c)))) +
  bool_to_failure (negb (Nat.eqb (nonce (s1 c)) (nonce (s3 c)))) +
  bool_to_failure (Nat.eqb (target_id (s1 c)) (target_node c)) +
  bool_to_failure (Nat.eqb (target_id (s2 c)) (target_node c)) +
  bool_to_failure (Nat.eqb (target_id (s3 c)) (target_node c)).

def corner_denials (c : RackCorner) : Nat


DERIVED: Theorem named 'explainable_corner_consensus' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Theorem explainable_corner_consensus : forall c : RackCorner,
  CornerK c = true <-> corner_denials c = 0.

theorem explainable_corner_consensus (c : RackCorner) :
    (c.K = true ↔ corner_denials c = 0)


DERIVED: Definition named 'is_fresh' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition is_fresh (c : EpochCache) : bool :=
  Nat.leb (dcgm_epoch_age c) (max_staleness c).


DERIVED: Definition named 'issue_lease' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition issue_lease (c : RackCorner) : option AdmissionLease :=
  if CornerK c then Some (mkAdmissionLease true true) else None.

def issue_lease (c : RackCorner) : Option AdmissionLease


DERIVED: Definition named 'host_verifier_admit' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Definition host_verifier_admit (l_opt : option AdmissionLease) (cache : EpochCache) : bool :=
  match l_opt with
  | None => false
  | Some l => issued_by_tor l && corner_approved l && is_fresh cache
  end.

def host_verifier_admit (l_opt : Option AdmissionLease) (cache : EpochCache) : Bool


DERIVED: Theorem named 'host_bypass_rejected' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Theorem host_bypass_rejected : forall cache,
  host_verifier_admit None cache = false.

theorem host_bypass_rejected (cache : EpochCache) : host_verifier_admit none cache = false


DERIVED: Theorem named 'goodput_firewall_containment' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Theorem goodput_firewall_containment : forall c cache,
  CornerK c = false -> host_verifier_admit (issue_lease c) cache = false.

cubie-platform/src/admit.rs:563 fast-deny comment binding (vertices_all_pass agreement with fast_evaluate_topology); bare-metal-tests/tests/cub_1047_vertex_fast_deny.rs:45,59,92 property tests (solved state, random adversarial, one face broken); bare-metal-tests/tests/cub_corner_consensus_real_proof.rs:68,79,86,168 corner-consensus completeness tests

Adversarial review corrected the FUNCTION-IMPL anomaly: CUB-1047 is comment-bound to the live fast-deny path plus test-anchored, NOT a phantom. The scraped named_fn value cub_1047_ comes from the goodput.rs declared-range note (reconciled in the same change), not from a real fn definition.

theorem goodput_firewall_containment (c : RackCorner) (cache : EpochCache) :
    c.K = false -> host_verifier_admit (issue_lease c) cache = false


DERIVED: Theorem named 'epoch_staleness_rejected' in the ToRAdmissionCompilerV1_30 family -- registry statement: V1.30 ToR Admission

Theorem epoch_staleness_rejected : forall l cache,
  Nat.lt (max_staleness cache) (dcgm_epoch_age cache) ->
  host_verifier_admit (Some l) cache = false.

theorem epoch_staleness_rejected (l : AdmissionLease) (cache : EpochCache) :
    cache.max_staleness < cache.dcgm_epoch_age -> host_verifier_admit (some l) cache = false


DERIVED: Definition named 'CornerK' in the ToRCornerSpoofingV1_31 family -- registry statement: V1.31 ToR Corner Spoofing

Definition CornerK (c : RackCorner) : bool :=
  J (s1 c) && J (s2 c) && J (s3 c).


DERIVED: Definition named 'WriteOK' in the ToRCornerSpoofingV1_31 family -- registry statement: V1.31 ToR Corner Spoofing

Definition WriteOK (c : RackCorner) (policyOK : bool) : bool :=
  CornerK c && policyOK.

def WriteOK (c : RackCorner) (policyOK : Bool) : Bool


DERIVED: Definition named 'omega_bool_eq_dec' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition omega_bool_eq_dec (b c : bool) : {b = c} + {b <> c}.


DERIVED: Lemma named 'omega_bool_not_false_true' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Lemma omega_bool_not_false_true : forall b : bool, b <> false -> b = true.


DERIVED: Lemma named 'omega_bool_not_true_false' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Lemma omega_bool_not_true_false : forall b : bool, b <> true -> b = false.


DERIVED: Definition named 'static_face_eq_dec' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition static_face_eq_dec (a b : StaticFace) : {a = b} + {a <> b}.

cubie-platform/src/capacity.rs capacity_shadow_byte reads the live DimensionalBaseline via dimensional_regression_alert and packs it into DIMENSIONAL_REGRESSION (bit7), behind capacity_shadow_state; cubie-platform/src/admit.rs record_capacity_shadow_for records the byte (verdict-neutral tail) when the feature is on; bare-metal-tests/tests/capacity_shadow.rs shadow_stateful_bits_are_dynamic_after_training: bit7 is constant-0 fresh (run 1) and 100/200 after training (run 2)

Wave 6a shadow (opt-in): CUB-1054 dimensional-baseline regression recorded shadow-only, reading the EXISTING baseline store (no new cell). Two-run dynamism proven. PROVENANCE-WIRE; not new coverage.


DERIVED: Definition named 'face_valid_bool' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition face_valid_bool (c : AssembledCube) (f : StaticFace) : bool :=
  face_ok (static_face c f).


DERIVED: Definition named 'all_static_faces_valid' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition all_static_faces_valid (c : AssembledCube) : bool :=
  andb (face_valid_bool c FaceIdentity)
  (andb (face_valid_bool c FaceMethod)
  (andb (face_valid_bool c FaceTopology)
  (andb (face_valid_bool c FaceTemporal)
  (andb (face_valid_bool c FaceJustification)
        (face_valid_bool c FaceAggregate))))).

cubie-platform/src/capacity.rs:1495 dimensional_baseline_observe (EMA-blended per-adapter dimensional baseline; VERUS-BOUND, UNINVOKED on the admit path); bare-metal-tests/tests/v3_interop.rs:533-625 dimensional_baseline_observe / dimensional_baseline_get teeth-tests (observation update, per-adapter isolation)

Plan Wave 6 capacity v3 cluster: the dimensional-baseline observation witness is anchored by real observe/get teeth-tests; runtime shadow wire is Wave 6 future work, not claimed. TEST-ANCHORED.


DERIVED: Definition named 'all_edges_consistent' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition all_edges_consistent (c : AssembledCube) : bool :=
  andb (edge_ok c Edge00)
  (andb (edge_ok c Edge01)
  (andb (edge_ok c Edge02)
  (andb (edge_ok c Edge03)
  (andb (edge_ok c Edge04)
  (andb (edge_ok c Edge05)
  (andb (edge_ok c Edge06)
  (andb (edge_ok c Edge07)
  (andb (edge_ok c Edge08)
  (andb (edge_ok c Edge09)
  (andb (edge_ok c Edge10)
        (edge_ok c Edge11))))))))))).


DERIVED: Definition named 'all_corners_consistent' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition all_corners_consistent (c : AssembledCube) : bool :=
  andb (corner_ok c Corner00)
  (andb (corner_ok c Corner01)
  (andb (corner_ok c Corner02)
  (andb (corner_ok c Corner03)
  (andb (corner_ok c Corner04)
  (andb (corner_ok c Corner05)
  (andb (corner_ok c Corner06)
        (corner_ok c Corner07))))))).


DERIVED: Definition named 'assembled_coherent' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition assembled_coherent (c : AssembledCube) : bool :=
  andb (all_static_faces_valid c)
       (andb (all_edges_consistent c) (all_corners_consistent c)).


DERIVED: Theorem named 'assembled_coherent_implies_faces' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem assembled_coherent_implies_faces : forall c : AssembledCube,
  assembled_coherent c = true -> all_static_faces_valid c = true.


DERIVED: Theorem named 'assembled_coherent_implies_edges' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem assembled_coherent_implies_edges : forall c : AssembledCube,
  assembled_coherent c = true -> all_edges_consistent c = true.


DERIVED: Theorem named 'assembled_coherent_implies_corners' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem assembled_coherent_implies_corners : forall c : AssembledCube,
  assembled_coherent c = true -> all_corners_consistent c = true.


DERIVED: Definition named 'GodsNumber' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Definition named 'classify_partial_access' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition classify_partial_access (d : nat) : PartialAccessLevel :=
  if Nat.eqb d 0 then PA_Solved
  else if Nat.leb d 3 then PA_NearSolved
  else if Nat.leb d 10 then PA_Workable
  else if Nat.leb d GodsNumber then PA_Distant
  else PA_Inconsistent.


DERIVED: Definition named 'distance_access' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition distance_access (distance : CoherenceDistance) : PartialAccessLevel :=
  classify_partial_access (d_global distance).


DERIVED: Theorem named 'classify_partial_access_zero' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem classify_partial_access_zero :
  classify_partial_access 0 = PA_Solved.


DERIVED: Theorem named 'classify_partial_access_twenty_one' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem classify_partial_access_twenty_one :
  classify_partial_access 21 = PA_Inconsistent.


DERIVED: Definition named 'consume_param' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition consume_param (p : LinearHandoffParam) : LinearHandoffParam :=
  {| lhp_id := lhp_id p;
     lhp_context := lhp_context p;
     lhp_state := Consumed |}.


DERIVED: Definition named 'reusable_after_consume' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition reusable_after_consume (p : LinearHandoffParam) : Prop :=
  lhp_state (consume_param p) = Unconsumed.


DERIVED: Theorem named 'no_reuse_after_consume' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem no_reuse_after_consume : forall p : LinearHandoffParam,
  ~ reusable_after_consume p.

theorem no_reuse_after_consume (p : LinearHandoffParam) :
    ¬ reusableAfterConsume p


DERIVED: Definition named 'handoff_param_allowed' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition handoff_param_allowed
  (src tgt : ContextDomain) (p : LinearHandoffParam) : bool :=
  match lhp_state p with
  | Consumed => false
  | Unconsumed =>
      andb (brewer_nash_compliant src tgt)
           (brewer_nash_compliant (lhp_context p) tgt)
  end.


DERIVED: Theorem named 'consumed_param_not_allowed' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem consumed_param_not_allowed : forall src tgt p,
  lhp_state p = Consumed ->
  handoff_param_allowed src tgt p = false.

theorem consumed_param_not_allowed (src tgt : ContextDomain) (p : LinearHandoffParam)
    (h : p.lhpState = .Consumed) :
    handoffParamAllowed src tgt p = false


DERIVED: Fixpoint named 'consume_params' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Theorem named 'consume_params_length' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem consume_params_length : forall ps : list LinearHandoffParam,
  length (consume_params ps) = length ps.


DERIVED: Definition named 'black_book_closed' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition black_book_closed (g : HandoffGraph) : Prop :=
  forall h : Handoff, In h (graph_handoffs g) -> valid_handoff h.


DERIVED: Theorem named 'empty_black_book_closed' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem empty_black_book_closed :
  black_book_closed {| graph_cubes := nil; graph_handoffs := nil |}.

theorem empty_black_book_closed :
    blackBookClosed { graphCubes


DERIVED: Definition named 'evaluate_grand_fusion_certified' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition evaluate_grand_fusion_certified
  (req : ActiveRequest) (M : LocalManifold)
  : MinskyKLine req M + GrandFusionSafe req M.


DERIVED: Theorem named 'certified_grand_fusion_total' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem certified_grand_fusion_total : forall (req : ActiveRequest) (M : LocalManifold),
  (exists w : MinskyKLine req M, evaluate_grand_fusion_certified req M = inl w) \/
  (exists s : GrandFusionSafe req M, evaluate_grand_fusion_certified req M = inr s).

theorem certified_grand_fusion_total (req : ActiveRequest) (M : LocalManifold) :
    (∃ w : MinskyKLine req M, evaluateGrandFusionCertified req M = .inl w) ∨
    (∃ s : GrandFusionSafe req M, evaluateGrandFusionCertified req M = .inr s)


DERIVED: Definition named 'request_clean_bool' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition request_clean_bool (req : ActiveRequest) (M : LocalManifold) : bool :=
  match evaluate_grand_fusion_certified req M with
  | inl _ => false
  | inr _ => true
  end.


DERIVED: Fixpoint named 'all_requests_clean_bool' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Definition named 'coordinated_chaos' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition coordinated_chaos (mb : MasterBlock) (M : LocalManifold) : Prop :=
  all_requests_clean_bool (mb_requests mb) M = true /\
  aggregate_coherent mb = false.


DERIVED: Definition named 'evaluate_master_block' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition evaluate_master_block
  (mb : MasterBlock) (M : LocalManifold)
  : AggregateKLine mb M + unit.


DERIVED: Theorem named 'master_block_total' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem master_block_total : forall (mb : MasterBlock) (M : LocalManifold),
  (exists w : AggregateKLine mb M, evaluate_master_block mb M = inl w) \/
  (evaluate_master_block mb M = inr tt).

theorem master_block_total (mb : MasterBlock) (M : LocalManifold) :
    (∃ w : AggregateKLine mb M, evaluateMasterBlock mb M = .inl w) ∨
    (evaluateMasterBlock mb M = .inr ())


DERIVED: Definition named 'request_anon_pointer' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition request_anon_pointer (req : ActiveRequest) : N :=
  anon_pointer unit (zk_ex req).


DERIVED: Definition named 'kinetic_token_decision' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Definition kinetic_token_decision
  (ac : AssembledCube)
  (ledger : ExpirationLedger)
  (catalog : BadActorCatalog)
  (req : ActiveRequest)
  (M : LocalManifold)
  : TokenDecision :=
  let p := request_anon_pointer req in
  if catalog_matches catalog p then PurgeTokenFromMemory
  else if internally_expired ledger p then PurgeTokenFromMemory
  else
    match evaluate_grand_fusion_certified req M with
    | inl _ => InvalidateAndBurnAccess
    | inr _ =>
        if assembled_coherent ac then IssueProductionToken
        else InvalidateAndBurnAccess
    end.


DERIVED: Theorem named 'catalog_match_routes_synthetic' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Theorem named 'expiration_routes_synthetic' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Theorem named 'coherent_clean_fresh_issues_production' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum

Theorem coherent_clean_fresh_issues_production :
  forall ac ledger catalog req M safe,
    catalog_matches catalog (request_anon_pointer req) = false ->
    internally_expired ledger (request_anon_pointer req) = false ->
    evaluate_grand_fusion_certified req M = inr safe ->
    assembled_coherent ac = true ->
    kinetic_token_decision ac ledger catalog req M = IssueProductionToken.

theorem coherent_clean_fresh_issues_production
    (ac : AssembledCube) (ledger : ExpirationLedger)
    (catalog : BadActorCatalog) (req : ActiveRequest) (M : LocalManifold)
    (safe : GrandFusionSafe req M)
    (hCat  : catalog.catalogMatches (requestAnonPointer req) = false)
    (hExp  : ledger.internallyExpired (requestAnonPointer req) = false)
    (hSafe : evaluateGrandFusionCertified req M = .inr safe)
    (hCoh  : assembledCoherentBool ac = true) :
    kineticTokenDecision ac ledger catalog req M = .IssueProductionToken


DERIVED: Theorem named 'partial_static_coherence_constrains_token' in the cubieq_omega_incremental_append family -- registry statement: CubieQ Omega Addendum


DERIVED: Definition named 'access_pattern_eq_dec' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition access_pattern_eq_dec (a b : AccessPattern) : {a = b} + {a <> b}.


DERIVED: Definition named 'pattern_cardinality' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition pattern_cardinality (p : AccessPattern) : nat :=
  match p with
  | PatternPlus => 5%nat
  | PatternCross => 5%nat
  | PatternWholeFace => 9%nat
  | PatternDiagonalLine => 3%nat
  | PatternLShape => 3%nat
  | PatternCustom _ n => n
  end.


DERIVED: Definition named 'default_t0_pattern' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition default_t0_pattern : AccessPattern := PatternPlus.


DERIVED: Fixpoint named 'nat_pow' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum


DERIVED: Definition named 'recursive_pattern_cardinality' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition recursive_pattern_cardinality (p : AccessPattern) (depth : nat) : nat :=
  nat_pow (pattern_cardinality p) depth.


DERIVED: Theorem named 'plus_cardinality_five' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem plus_cardinality_five : pattern_cardinality PatternPlus = 5%nat.

theorem plus_cardinality_five :
    patternCardinality .PatternPlus = 5


DERIVED: Theorem named 'recursive_pattern_depth_zero' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem recursive_pattern_depth_zero : forall p,
  recursive_pattern_cardinality p 0 = 1%nat.

theorem recursive_pattern_depth_zero (p : AccessPattern) :
    recursivePatternCardinality p 0 = 1


DERIVED: Theorem named 'whole_face_has_more_cells_than_plus' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem whole_face_has_more_cells_than_plus :
  (pattern_cardinality PatternPlus < pattern_cardinality PatternWholeFace)%nat.

theorem whole_face_has_more_cells_than_plus :
    patternCardinality .PatternPlus < patternCardinality .PatternWholeFace


DERIVED: Fixpoint named 'all_axes_authorized_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum


DERIVED: Definition named 'linear_lease_available_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition linear_lease_available_b (lease : option LinearHandoffParam) : bool :=
  match lease with
  | None => false
  | Some p =>
      match lhp_state p with
      | Unconsumed => true
      | Consumed => false
      end
  end.


DERIVED: Definition named 'lease_consumed_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition lease_consumed_b (lease : option LinearHandoffParam) : bool :=
  match lease with
  | None => false
  | Some p =>
      match lhp_state p with
      | Unconsumed => false
      | Consumed => true
      end
  end.


DERIVED: Definition named 'context_hash_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition context_hash_ok_b (expected observed : N) : bool :=
  N.eqb expected observed.


DERIVED: Definition named 'partial_access_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition partial_access_ok_b (p : PartialAccessLevel) : bool :=
  match p with
  | PA_Inconsistent => false
  | _ => true
  end.


DERIVED: Definition named 'distance_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition distance_ok_b (cd : CoherenceDistance) : bool :=
  partial_access_ok_b (distance_access cd).


DERIVED: Definition named 'observe_mode_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition observe_mode_ok_b (ac : AssembledCube) (r : CubieActionRequest) : bool :=
  andb (pattern_ok_b ac (car_face r) (car_pattern r))
  (andb (distance_ok_b (car_distance r))
  (andb (can_observe_b ac (car_actor r))
        (context_hash_ok_b (car_expected_context_hash r)
                           (car_observed_context_hash r)))).


DERIVED: Definition named 'rotate_mode_extra_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition rotate_mode_extra_ok_b (ac : AssembledCube) (r : CubieActionRequest) : bool :=
  andb (all_axes_authorized_b ac (car_actor r) (car_axes r))
  (andb (linear_lease_available_b (car_lease r))
        (cayley_transition_ok_b (car_prior_topology r) (car_next_topology r))).


DERIVED: Definition named 'read_write_mode_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition read_write_mode_ok_b (ac : AssembledCube) (r : CubieActionRequest) : bool :=
  match car_mode r with
  | ObserveMode => observe_mode_ok_b ac r
  | RotateMode => andb (observe_mode_ok_b ac r) (rotate_mode_extra_ok_b ac r)
  end.


DERIVED: Theorem named 'no_axes_authorization_is_trivial' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem no_axes_authorization_is_trivial : forall ac actor,
  all_axes_authorized_b ac actor nil = true.

theorem no_axes_authorization_is_trivial (ac : AssembledCube) (actor : ActorRef) :
    allAxesAuthorizedBool ac actor [] = true


DERIVED: Theorem named 'consumed_lease_unavailable' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem consumed_lease_unavailable : forall p,
  lhp_state p = Consumed -> linear_lease_available_b (Some p) = false.

theorem consumed_lease_unavailable (p : LinearHandoffParam)
    (h : lhpState p = .Consumed) :
    linearLeaseAvailableBool (some p) = false


DERIVED: Theorem named 'context_hash_ok_refl' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem context_hash_ok_refl : forall h,
  context_hash_ok_b h h = true.

theorem context_hash_ok_refl (hash : UInt64) :
    contextHashOkBool hash hash = true


DERIVED: Theorem named 'rotate_ok_implies_observe_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem rotate_ok_implies_observe_ok : forall ac r,
  car_mode r = RotateMode ->
  read_write_mode_ok_b ac r = true ->
  observe_mode_ok_b ac r = true.

theorem rotate_ok_implies_observe_ok (ac : AssembledCube) (r : CubieActionRequest)
    (hMode : r.carMode = .RotateMode)
    (hOk   : readWriteModeOkBool ac r = true) :
    observeModeOkBool ac r = true


DERIVED: Definition named 'stochastic_handoff_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition stochastic_handoff_ok_b (h : StochasticHandoff) : bool :=
  andb (sh_vrf_proof_valid h)
       (N.eqb (sh_downstream_cube h)
              (expected_vrf_downstream
                 (sh_seed_hash h)
                 (sh_context_hash h)
                 (sh_upstream_cube h))).


DERIVED: Theorem named 'stochastic_handoff_requires_vrf_proof' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem stochastic_handoff_requires_vrf_proof : forall h,
  stochastic_handoff_ok_b h = true -> sh_vrf_proof_valid h = true.

theorem stochastic_handoff_requires_vrf_proof (h : StochasticHandoff)
    (hOk : stochasticHandoffOkBool h = true) :
    h.shVrfProofValid = true


DERIVED: Definition named 'cached_macrograph_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition cached_macrograph_ok_b (cert : MacroGraphCert) : bool :=
  andb (macrograph_attested cert) (macrograph_cached cert).


DERIVED: Definition named 'macrograph_ok_or_percolation_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition macrograph_ok_or_percolation_ok_b
  (cert : MacroGraphCert) (g : HandoffGraph) : bool :=
  orb (cached_macrograph_ok_b cert) (rogue_percolation_ok_b g).


DERIVED: Theorem named 'attested_cached_macrograph_passes' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem attested_cached_macrograph_passes : forall cert g,
  macrograph_attested cert = true ->
  macrograph_cached cert = true ->
  macrograph_ok_or_percolation_ok_b cert g = true.

theorem attested_cached_macrograph_passes
    (cert : MacroGraphCert) (g : HandoffGraph)
    (hAtt   : cert.macrographAttested = true)
    (hCache : cert.macrographCached = true) :
    macrographOkOrPercolationOkBool cert g = true


DERIVED: Definition named 'dual_audit_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition dual_audit_ok_b (v : DualAuditView) : bool :=
  andb (duality_ok v)
       (andb (assembled_coherent (operator_cube_view v))
             (assembled_coherent (auditor_cube_view v))).


DERIVED: Theorem named 'dual_audit_ok_implies_duality_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem dual_audit_ok_implies_duality_ok : forall v,
  dual_audit_ok_b v = true -> duality_ok v = true.

theorem dual_audit_ok_implies_duality_ok (v : DualAuditView)
    (h : dualAuditOkBool v = true) :
    v.dualityOk = true


DERIVED: Definition named 'center_move_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition center_move_ok_b (mv : CenterMove) (current_clock : nat) : bool :=
  andb (center_move_authorized mv)
       (Nat.ltb current_clock (center_move_clock mv)).


DERIVED: Theorem named 'center_move_requires_authority' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem center_move_requires_authority : forall mv clk,
  center_move_ok_b mv clk = true -> center_move_authorized mv = true.

theorem center_move_requires_authority (mv : CenterMove) (clk : Nat)
    (h : centerMoveOkBool mv clk = true) :
    mv.centerMoveAuthorized = true


DERIVED: Definition named 'how_stale_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition how_stale_b (oc : ObservationCube) (threshold : nat) : bool :=
  Nat.leb (obs_how_last_active_clock oc + threshold)%nat (obs_now_clock oc).


DERIVED: Definition named 'reclaim_if_how_stale_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition reclaim_if_how_stale_b (oc : ObservationCube) (threshold : nat) : bool :=
  how_stale_b oc threshold.


DERIVED: Theorem named 'stale_how_reclaims' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem stale_how_reclaims : forall oc threshold,
  how_stale_b oc threshold = true ->
  reclaim_if_how_stale_b oc threshold = true.

theorem stale_how_reclaims (oc : ObservationCube) (threshold : Nat)
    (h : howStaleBool oc threshold = true) :
    reclaimIfHowStaleBool oc threshold = true


DERIVED: Definition named 'proof_ref_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition proof_ref_ok_b (n : N) : bool :=
  negb (N.eqb n 0%N).


DERIVED: Definition named 'evidence_record_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition evidence_record_ok_b (ev : EvidenceRecord) : bool :=
  andb (proof_ref_ok_b (ev_proof_ref ev))
       (context_hash_ok_b (dv_context_hash (ev_vector ev))
                          (dv_context_hash (ev_vector ev))).


DERIVED: Definition named 'grand_fusion_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition grand_fusion_ok_b (req : ActiveRequest) (M : LocalManifold) : bool :=
  match evaluate_grand_fusion_certified req M with
  | inl _ => false
  | inr _ => true
  end.


DERIVED: Definition named 'edge_corner_ok_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition edge_corner_ok_b (ac : AssembledCube) : bool :=
  andb (all_edges_consistent ac) (all_corners_consistent ac).


DERIVED: Definition named 'Auth_v1_10_b' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Definition Auth_v1_10_b
  (ac : AssembledCube)
  (req : ActiveRequest)
  (M : LocalManifold)
  (env : OmegaAuthEnvelope) : bool :=
  andb (grand_fusion_ok_b req M)
  (andb (read_write_mode_ok_b ac (oae_action env))
  (andb (edge_corner_ok_b ac)
  (andb (macrograph_ok_or_percolation_ok_b (oae_macrograph env) (oae_graph env))
        (evidence_record_ok_b (oae_evidence env))))).


DERIVED: Theorem named 'Auth_v1_10_implies_grand_fusion_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem Auth_v1_10_implies_grand_fusion_ok : forall ac req M env,
  Auth_v1_10_b ac req M env = true -> grand_fusion_ok_b req M = true.


DERIVED: Theorem named 'Auth_v1_10_implies_mode_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem Auth_v1_10_implies_mode_ok : forall ac req M env,
  Auth_v1_10_b ac req M env = true ->
  read_write_mode_ok_b ac (oae_action env) = true.


DERIVED: Theorem named 'Auth_v1_10_implies_edge_corner_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem Auth_v1_10_implies_edge_corner_ok : forall ac req M env,
  Auth_v1_10_b ac req M env = true -> edge_corner_ok_b ac = true.


DERIVED: Theorem named 'Auth_v1_10_implies_evidence_ok' in the cubieq_omega_incremental_next_addendum family -- registry statement: CubieQ Omega Next Addendum

Theorem Auth_v1_10_implies_evidence_ok : forall ac req M env,
  Auth_v1_10_b ac req M env = true -> evidence_record_ok_b (oae_evidence env) = true.


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.

AUDIT-ONLY -- no theorem_name in master_theorem_table.csv; kernel status not tracked at row level

AUDIT-ONLY (wiring/invocation only, no theorem_name/statement in source)


DERIVED: Theorem named 'CUB_1221f_de_morgan' in the CubieBelnapV8_0 family -- registry statement: Belnap knowledge lattice + CUB-1221f knowledge-complement De Morgan (Wave 13B)

Theorem CUB_1221f_de_morgan :
  forall a b : nat, valid_cell a -> valid_cell b ->
    knowledge_complement (knowledge_meet a b) =
    knowledge_join (knowledge_complement a) (knowledge_complement b).

theorem CUB_1221f_de_morgan (a b : BelnapValue) :
    knowledge_complement (knowledge_meet a b) =
    knowledge_join (knowledge_complement a) (knowledge_complement b)

Coq+Lean+Verus verified-locally (Wave 13B correction)


DERIVED: Theorem named 'Theorem' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal


DERIVED: Theorem named 'surface_decomposition' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem surface_decomposition : 6 + 24 + 24 = 54. Proof. reflexivity. Qed.

theorem surface_decomposition : 6 + 24 + 24 = 54


DERIVED: Theorem named 'interface_count' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem interface_count : interfaceSites = 48. Proof. reflexivity. Qed.


DERIVED: Theorem named 'interface_dominates' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem interface_dominates :
  totalSites - interfaceSites = 6 /\ interfaceSites > totalSites - interfaceSites.


Coq: AXIOM-FREE (0 axioms, live coqc/coqchk-verified) | Lean: NOT AXIOM-FREE -- depends on: propext

0 axioms (Lean 4.30.0 #print axioms: propext only, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace) [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'cub_1636_signal_le_crowd' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1636_signal_le_crowd : forall N, goldenPath N <= crowd N.

theorem cub_1636_signal_le_crowd (N : Nat) : goldenPath N ≤ crowd N

Coq kernel-checked 8.18.0 (coqc+coqchk live, 2026-08-15); Verus PENDING-VERUS-KERNEL; Lean kernel-checked 4.30.0

proof fn cub_1636_signal_le_crowd(n: nat)
    ensures gap_golden_path(n) <= gap_crowd(n)

PENDING -- verus binary not on PATH in this workspace


DERIVED: Theorem named 'cub_1637_crowd_le_exposure' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1637_crowd_le_exposure : forall N, crowd N <= exposure N.

theorem cub_1637_crowd_le_exposure (N : Nat) : crowd N ≤ exposure N

proof fn cub_1637_crowd_le_exposure(n: nat)
    ensures gap_crowd(n) <= gap_exposure(n)


DERIVED: Theorem named 'cub_1638_signal_to_exposure_gap' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1638_signal_to_exposure_gap : forall N, 10 ^ N * goldenPath N <= exposure N.

theorem cub_1638_signal_to_exposure_gap (N : Nat) : 10 ^ N * goldenPath N ≤ exposure N

proof fn cub_1638_signal_to_exposure_gap(n: nat)
    ensures gap_pow(10, n) * gap_golden_path(n) <= gap_exposure(n)


DERIVED: Theorem named 'cub_1639_signal_to_crowd_gap' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1639_signal_to_crowd_gap : forall N, 5 ^ N * goldenPath N <= crowd N.

theorem cub_1639_signal_to_crowd_gap (N : Nat) : 5 ^ N * goldenPath N ≤ crowd N

proof fn cub_1639_signal_to_crowd_gap(n: nat)
    ensures gap_pow(5, n) * gap_golden_path(n) <= gap_crowd(n)


DERIVED: Theorem named 'cub_1640_seam_exposed_ratio' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1640_seam_exposed_ratio : forall N, 9 * seamExposed N = 8 * 54 ^ (N + 1).

theorem cub_1640_seam_exposed_ratio (N : Nat) : 9 * seamExposed N = 8 * 54 ^ (N + 1)

proof fn cub_1640_seam_exposed_ratio(n: nat)
    ensures 9 * gap_seam_exposed(n) == 8 * gap_pow(54, n + 1)


DERIVED: Theorem named 'cub_1641_bounded_depth_bounds_exposure' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1641_bounded_depth_bounds_exposure : forall N Dmax, N <= Dmax -> exposure N <= exposure Dmax.

theorem cub_1641_bounded_depth_bounds_exposure (N Dmax : Nat) (h : N ≤ Dmax) :
    exposure N ≤ exposure Dmax

proof fn cub_1641_bounded_depth_bounds_exposure(n: nat, dmax: nat)
    requires n <= dmax
    ensures gap_exposure(n) <= gap_exposure(dmax)


DERIVED: Theorem named 'surface_spoofing_kill' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem surface_spoofing_kill : forall jid jpur jtime jver jsco,
  seam jid jpur jtime false jver jsco = false.


DERIVED: Theorem named 'seam_requires_lineage' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem seam_requires_lineage : forall jid jpur jtime jlin jver jsco,
  seam jid jpur jtime jlin jver jsco = true -> jlin = true.


DERIVED: Theorem named 'cub_1644_corner_consensus_weakest' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1644_corner_consensus_weakest : forall j1 j2 j3,
  cornerConsensus j1 j2 j3 = true -> j1 = true /\ j2 = true /\ j3 = true.

theorem cub_1644_corner_consensus_weakest (j1 j2 j3 : Bool)
    (h : cornerConsensus j1 j2 j3 = true) : j1 = true ∧ j2 = true ∧ j3 = true

proof fn cub_1644_corner_consensus_weakest(j1: bool, j2: bool, j3: bool)
    requires gap_corner_consensus(j1, j2, j3)
    ensures j1, j2, j3


DERIVED: Theorem named 'cub_1645_two_corner_decomposition' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1645_two_corner_decomposition : forall deploy gpu,
  writeOK deploy gpu = true <-> deploy = true /\ gpu = true.

theorem cub_1645_two_corner_decomposition (deploy gpu : Bool) :
    writeOK deploy gpu = true ↔ deploy = true ∧ gpu = true

proof fn cub_1645_two_corner_decomposition(deploy: bool, gpu: bool)
    ensures gap_write_ok(deploy, gpu) <==> (deploy && gpu)


AXIOM-FREE (0 axioms, live coqc/coqchk-verified)

0 axioms (Lean 4.30.0 #print axioms: no axioms, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace) [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'cub_1646_corners_independent' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1646_corners_independent : writeOK true false = false /\ writeOK false true = false.

theorem cub_1646_corners_independent :
    writeOK true false = false ∧ writeOK false true = false

proof fn cub_1646_corners_independent()
    ensures !gap_write_ok(true, false), !gap_write_ok(false, true)


DERIVED: Theorem named 'witness_64_byte_atomic' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem witness_64_byte_atomic : fold_right Nat.add 0 fieldSizes = 64.


DERIVED: Theorem named 'belnap_idem' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem belnap_idem : forall a, belnapMeet a a = a. Proof. destruct a; reflexivity. Qed.


DERIVED: Theorem named 'belnap_top_unit' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem belnap_top_unit : forall a, belnapMeet a true = a. Proof. destruct a; reflexivity. Qed.


DERIVED: Theorem named 'belnap_assoc' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem belnap_assoc : forall a b c,
  belnapMeet (belnapMeet a b) c = belnapMeet a (belnapMeet b c).


DERIVED: Theorem named 'vn_symmetry' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem vn_symmetry : forall a b x, vnExtract a b = Some x -> vnExtract b a = Some (negb x).


DERIVED: Theorem named 'goodput_no_overcommit' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem goodput_no_overcommit : forall pool cost, cost <= pool ->
  cost + (pool - cost) = pool /\ pool - cost <= pool.


DERIVED: Theorem named 'ha_fail_closed' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Theorem ha_fail_closed : forall base, appliedCost base false <= appliedCost base true.


DERIVED: Theorem named 'cub_1654_geometric_futility_base2' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem cub_1654_geometric_futility_base2 : forall base, 2 <= base -> 2 < base ^ 2.

theorem cub_1654_geometric_futility_base2 (base : Nat) (h : 2 ≤ base) : 2 < base ^ 2


DERIVED: Lemma named 'pow_le_pow_base' in the CubieBexarMetalV1_4 family -- registry statement: Bexar Metal

Lemma pow_le_pow_base : forall a b n, a <= b -> a ^ n <= b ^ n.


DERIVED: Theorem named 'cub_1656_mul_pow_eq' in the CubieBexarMetalV1_4Gap family -- registry statement: Bexar Metal

Theorem cub_1656_mul_pow_eq : forall a b n, (a * b) ^ n = a ^ n * b ^ n.

theorem cub_1656_mul_pow_eq (a b n : Nat) : (a * b) ^ n = a ^ n * b ^ n

proof fn cub_1656_mul_pow_eq(a: nat, b: nat, n: nat)
    ensures gap_pow(a * b, n) == gap_pow(a, n) * gap_pow(b, n)
    decreases n


0 axioms (Lean 4.30.0 #print axioms: no axioms at all, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Gap.v; coqc/coqchk not run in this workspace) [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'cub_1657_nesting_monotone' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1657_nesting_monotone : forall base K K',
  1 <= base -> K <= K' -> coordChain base K <= coordChain base K'.

theorem cub_1657_nesting_monotone (base K K' : Nat) (hb : 1 ≤ base) (h : K ≤ K') :
    coordChain base K ≤ coordChain base K'

pub proof fn cub_1657_nesting_monotone(base: nat, k: nat, k2: nat)
    requires
        1 <= base,
        k <= k2,
    ensures
        dm_coord_chain(base, k) <= dm_coord_chain(base, k2),


DERIVED: Theorem named 'geometric_complexity_futility' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem geometric_complexity_futility : forall B base,
  2 <= base -> B < coordChain base B.

theorem geometric_complexity_futility (B base : Nat) (h : 2 ≤ base) :
    B < coordChain base B


DERIVED: Theorem named 'cub_1659_knill_laflamme_correctable' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1659_knill_laflamme_correctable : forall (L St : Type) (enc : L -> St) (err : St -> St),
  Recoverable enc err <-> InjectiveC (fun l => err (enc l)).

theorem cub_1659_knill_laflamme_correctable (L St : Type) (enc : L → St) (err : St → St) :
    Recoverable enc err ↔ InjectiveC (fun l => err (enc l))

pub proof fn cub_1659_knill_laflamme_correctable<L, St>(
    enc: spec_fn(L) -> St,
    err: spec_fn(St) -> St,
)
    ensures
        dm_recoverable(enc, err) <==> dm_injective_c(|l: L| err(enc(l))),


DERIVED: Theorem named 'hypercontraction_decay' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem hypercontraction_decay : forall f w n, f <= w -> f ^ n <= w ^ n.


DERIVED: Theorem named 'fano_error_lower_bound' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem fano_error_lower_bound : forall R I errs, R <= I + errs -> R - I <= errs.


DERIVED: Theorem named 'kl_zero_leak_no_advantage' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem kl_zero_leak_no_advantage : forall adv leak, adv <= leak -> leak = 0 -> adv = 0.


DERIVED: Theorem named 'topological_entropy_exponential' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem topological_entropy_exponential : forall n, n < separatedOrbits n.


DERIVED: Theorem named 'cub_1664_koopman_tracks_orbit' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1664_koopman_tracks_orbit : forall (St : Type) (phi : St -> St) (f : St -> nat) (n : nat) (x : St),
  koopman phi f n x = f (iterate phi n x).

theorem cub_1664_koopman_tracks_orbit (St : Type) (phi : St → St) (f : St → Nat)
    (n : Nat) (x : St) : koopman phi f n x = f (iterate phi n x)

pub proof fn cub_1664_koopman_tracks_orbit<St>(
    phi: spec_fn(St) -> St,
    f: spec_fn(St) -> nat,
    n: nat,
    x: St,
)
    ensures
        dm_koopman(phi, f, n, x) == f(dm_iterate(phi, n, x)),


DERIVED: Theorem named 'power_law_monotone' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem power_law_monotone : forall tau tau' alpha,
  tau <= tau' -> tau ^ alpha <= tau' ^ alpha.


DERIVED: Theorem named 'cub_1666_bigraph_place_assoc' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1666_bigraph_place_assoc : forall h g f,
  composePlace (composePlace h g) f = composePlace h (composePlace g f).

theorem cub_1666_bigraph_place_assoc (h g f : Nat → Nat) :
    composePlace (composePlace h g) f = composePlace h (composePlace g f)

pub proof fn cub_1666_bigraph_place_assoc(
    h: spec_fn(nat) -> nat,
    g: spec_fn(nat) -> nat,
    f: spec_fn(nat) -> nat,
    x: nat,
)
    ensures
        dm_compose_place(|y: nat| dm_compose_place(h, g, y), f, x)
            == dm_compose_place(h, |y: nat| dm_compose_place(g, f, y), x),


DERIVED: Theorem named 'cub_1667_judgmental_congruence' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1667_judgmental_congruence : forall (A B : Type) (f : A -> B) (a a' : A),
  a = a' -> f a = f a'.

theorem cub_1667_judgmental_congruence (A B : Type) (f : A → B) (a a' : A) (h : a = a') :
    f a = f a'

pub proof fn cub_1667_judgmental_congruence<A, B>(f: spec_fn(A) -> B, a: A, a2: A)
    requires
        a == a2,
    ensures
        f(a) == f(a2),


DERIVED: Theorem named 'cub_1668_judgmental_substitution' in the CubieDriveMathV1_3Gap family -- registry statement: Drive Math

Theorem cub_1668_judgmental_substitution : forall (A : Type) (P : A -> Prop) (a a' : A),
  a = a' -> P a -> P a'.

theorem cub_1668_judgmental_substitution (A : Type) (P : A → Prop) (a a' : A) (h : a = a')
    (hp : P a) : P a'

pub proof fn cub_1668_judgmental_substitution<A>(p: spec_fn(A) -> bool, a: A, a2: A)
    requires
        a == a2,
        p(a),
    ensures
        p(a2),


DERIVED: Theorem named 'grg_exact' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem grg_exact : forall (St : Type) (seed : St) (step : St -> St) (n : nat),
  grg seed step (S n) = step (grg seed step n).

theorem grg_exact {α : Type} (seed : α) (step : α → α) (n : Nat) :
    Nat.iterate step (n + 1) seed = step (Nat.iterate step n seed)


DERIVED: Theorem named 'holevo_accessible_bounded' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Theorem holevo_accessible_bounded : forall acc ent cap,
  acc <= ent -> ent <= cap -> acc <= cap.


DERIVED: Lemma named 'two_pow_pos' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Lemma two_pow_pos : forall n, 0 < 2 ^ n.


DERIVED: Lemma named 'n_lt_two_pow' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Lemma n_lt_two_pow : forall n, n < 2 ^ n.

theorem n_lt_two_pow (n : Nat) : n < 2 ^ n


DERIVED: Lemma named 'pow_le_pow_base' in the CubieDriveMathV1_3 family -- registry statement: Drive Math

Lemma pow_le_pow_base : forall a b n, a <= b -> a ^ n <= b ^ n.


AUDIT-ONLY row -- no theorem_name/statement in source; see wiring/invocation fields only.


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1679_interface_count: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'interface_count' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal

Theorem cub_1679_interface_count : 24 + 24 = 48. Proof. reflexivity. Qed.

theorem cub_1679_interface_count : 24 + 24 = 48

proof fn cub_1679_interface_count() ensures 24 + 24 == 48


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1680_interface_dominates: does not depend on any axioms; no sorryAx [SUPERSEDED by live coqc/coqchk 2026-08-15: Print Assumptions confirms 'Closed under the global context' (0 axioms) via live coqc+coqchk in coqorg/coq:8.18, not a text scan -- see docs/evidence/2026-08-15_cub_coq_kernel_verification.md]

DERIVED: Theorem named 'interface_dominates' in the CubieBexarMetalV1_4Omega family -- registry statement: Bexar Metal