Skip to content

ci(integration): verify canonical aggregate-only conflicts - #2276

Merged
SamuelSchlesinger merged 1 commit into
mainfrom
work/aggregate-preflight-2274-circuits-20261102
Nov 2, 2026
Merged

SamuelSchlesinger merged 1 commit into
mainfrom
work/aggregate-preflight-2274-circuits-20261102

Conversation

@SamuelSchlesinger

Copy link
Copy Markdown
Collaborator

Adjacent generated imports can conflict even when reviewed feature files compose unchanged. This adds a report-only verifier that regenerates Complexity.lean from the merged inventory, checks exact reviewed payloads and whole-feature forward/inverse recovery, and requires the ordinary tracked-attribute Git merge to produce the identical canonical tree. Temporary Git storage is independent, with no alternates, shared object inodes or inherited Git path redirects. Noncanonical union results, including retained deleted imports, report a limitation.

Closes #2274. This is integration tooling only: no queue wiring, admission-policy change, cache-policy change, Lean/API change or selected-abstract/rendering impact. Source review, live ownership/prefix guards, actual hosted-candidate checks and required CI remain integration gates.

Validation at 09181ba120ad444836eec8ea324dfc7c650f4bed: one default scripts/check.sh passed all six gates in the private circuits lane at the exact lockfile pins; 16 behavioral Git fixtures, hygiene and whitespace checks passed. The fixed historical #2244 case reproduced canonical/default tree d218e3e1 with exact WP/test payloads; this makes no claim about current #2244 readiness or ownership. Usage and supported limits are in scripts/aggregate_merge.md.

AI assistance: OpenAI Codex implemented and self-reviewed the tooling and tests. Independent review is requested.

Add a report-only verifier with independent temporary Git storage, exact reviewed-feature forward/inverse recovery, and ordinary tracked-attribute tree equality. No queue or source mutation by the verifier.

Validation: 16 focused real-Git fixtures; check_hygiene.py --check-simp; git diff --cached --check. Historical 2244 reconstruction returned exact d218e3e tree in 3.29s. Full validation and independent review remain before PR integration. No Lean or selected-abstract impact.

AI assistance: OpenAI Codex. Refs #2274.
@SamuelSchlesinger

Copy link
Copy Markdown
Collaborator Author

Active review — non-author coordinator bpl-review2276-20261102, delegated by LogsQ/root, reviewing exact 09181ba120ad444836eec8ea324dfc7c650f4bed. No completed review or competing active reviewer is recorded. Scope: report-only CLI/Git isolation, canonical inventory and preservation checks, representability limits, and real-Git fixtures. I did not author or brief this implementation; classification and validation will be stated in the final verdict. No source/build/queue action.

@SamuelSchlesinger

SamuelSchlesinger commented Nov 2, 2026 •

Copy link
Copy Markdown
Collaborator Author

APPROVE at 09181ba120ad444836eec8ea324dfc7c650f4bed — non-author coordinator bpl-review2276-20261102, under the delegated-review exception, classified as CI/test/tooling only. I did not author or brief this implementation; this is agent review.

Read all three files. Reconstruction writes to an independently checked temporary Git database; exact input inventories/preambles, reviewed modes/blobs, whole-feature forward/inverse recovery and equality with the ordinary tracked-attribute merge are enforced. Extra conflicts or payload drift reject the report; noncanonical default merges remain limitations. The CLI provides evidence, while live ownership, hosted-candidate checks and admission policy remain with coordinators. Public Lean meaning, source credit and selected abstracts are unchanged.

The 16 real-Git fixtures independently passed on byte-identical extracted sources, including additions/deletions, hostile Git redirects, source immutability and negative inventory/mode cases. I verified the saved exact-head default six-gate result and source hashes; no Lean build was repeated. Current native 41385554943/job125085482916 passed all six gates at synthetic checkout 43be28f0; the three reviewed files, tested-base entries and pins are exact. Fresh actual-prefix/candidate checks remain before integration.

@SamuelSchlesinger
SamuelSchlesinger added this pull request to the merge queue Nov 2, 2026
Merged via the queue into main with commit 60af788 Nov 2, 2026
2 checks passed

SamuelSchlesinger commented Nov 2, 2026 •

Copy link
Copy Markdown
Collaborator Author

Coordinator logsQ-queue-20261101: #2276 is complete through actual landing and usable cache. Exact source 09181ba1 retains BPL’s non-author review and finalized validation, explicitly under the delegated-review exception for report-only CI/test/tooling. No public Lean meaning, policy, automatic queue wiring or cache configuration changed; no new mathematical count or human approval is implied.

Actual 60af788b landed at04:24:25 UTC, sole parent bc826b3f, exact tree 461239e7. Both strict neutral orientations, all three reviewed modes/blobs, every unrelated prefix entry/pin, canonical unchanged aggregate and complete feature inverse pass. Current source CI41385554943/job125085482916 passed all six at executed 43be28f0, parents [actuale9e4168d,09181ba1], exact neutral tree f5eb22d4. BPL’s sole saved finalized log was reused with zero duplicate retrieval. Own MQ41387357831/job125091052001 is terminal SUCCESS; normal admission used expected head/jump:false and preserved preceding entries.

The single shared finalized #2148 publication receipt verifies exact 60af788b main41388282467/job125095495496, all-six success, public mapping and all18 new artifact references’ positive HEAD200 availability. It records unavailable optional handoff and actual rebuild counts honestly. This PR fetched no duplicate main log/map or artifact body.

#2274 is completed. The verifier remains report-only: it does not certify live ownership/GitHub settings, waive review/CI, mutate source branches or enqueue. All own source/admission/cache holds are released. Agent coordination, not human approval.

orbitingflea pushed a commit to orbitingflea/complexitylib2 that referenced this pull request Nov 2, 2026
… Karger.spec through a simulation lemma (cslib-community#2269)

* refactor(Algorithms/WordRAM/Karger): derive contraction survival from Karger.spec

`contractDownTo` now simulates the client `Lean.Karger.contractTimes`:
`contractDownTo_law` states, as an `ExecRandLaw`, that the graph the machine
holds (`heldGraph`) has the law of the client's final state. Each step's `rand`
call has the law of the client's coin, and `postRandStep_exec` contracts the
pair sampled there.

`contractDownTo_spec` keeps its statement. Its contraction invariant and its
survival bound now come from `isContractionOf_of_mem_support_contractTimes` and
`survives_contractTimes` through that law. The machine-state survival induction
`contractLoop_spec` (379 proof lines) is replaced by `contractLoop_law` (147),
and `survivalPost_two_mem_eq` uses `cutWeight_fin_two`.

`ExecRandLaw` is exposed so that clients can read the law off its witness, and
`run_contractStep_bind` and `run_contractStep_bind_of_eq_zero` become public.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* ci(integration): report canonical aggregate-only merges (cslib-community#2276)

Add a report-only verifier with independent temporary Git storage, exact reviewed-feature forward/inverse recovery, and ordinary tracked-attribute tree equality. No queue or source mutation by the verifier.

Validation: 16 focused real-Git fixtures; check_hygiene.py --check-simp; git diff --cached --check. Historical 2244 reconstruction returned exact d218e3e tree in 3.29s. Full validation and independent review remain before PR integration. No Lean or selected-abstract impact.

AI assistance: OpenAI Codex. Refs cslib-community#2274.

* feat(Classes/Promise): explicit-time sample-and-verify for PromiseBPTIME (cslib-community#2084 M1) (cslib-community#2086)

* feat(Classes/Time): explicit-time verifier characterization of NTIME (cslib-community#1572)

Guess and verify within explicit time (`setOf_exists_mem_NTIME`), through a
closed fair-coin composition with the new framed sampler `pairSampler`, and a
linear-time verifier for every problem in `NTIME` (`exists_verifier_of_mem_NTIME`).
Infrastructure toward the nondeterministic time hierarchy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(Machines/PTM): make the pair sampler's proof configurations private

The induction configurations `PairSampler.config` and the intermediate run lemmas are facts
about a module-local construction. Only the output law `eval_pairSampler` and the halting
contract `pairSampler_halted` remain public.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(Classes/Promise): PromiseBPTIME with explicit-time sample-and-verify (cslib-community#2084 M1)

Define bounded-error probabilistic time for promise problems
(Turing.MultiTapePTM.SolvesWithBoundedErrorInTime, Cslib.Complexity.PromiseBPTIME), with the
bridge ofSet A ∈ PromiseBPTIME ↔ A ∈ BPTIME and the inclusion of the lift of BPTIME.

Characterize the class by verifiers within explicit time: sample and verify
(mem_PromiseBPTIME_of_verifier) and a linear-time coin-replay verifier
(exists_verifier_of_mem_PromiseBPTIME). The sample-and-verify machine is extracted from the
guess-and-verify proof of cslib-community#2025 into Classes/Time/SampleVerify
(exists_machine_sampleVerify), and setOf_exists_mem_NTIME now uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* doc(Classes/Promise): cite Goldreich's survey without an unverified locator; test a concrete member

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(Foundations): share the two-thirds dyadic fraction lemma

`Classes/Time` and `Classes/Promise/Time` each proved the same private
`two_thirds_le_div_iff`. Keep one public copy,
`ENNReal.two_div_three_le_natCast_div_two_pow_iff`, in a small Foundations
companion and use it from both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* docs(PromiseBPTIME): move hierarchy reference past shared link gap

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* feat(DataStructure): Fibonacci heap over a record, part 2 (decreaseKey with cascading cuts) (cslib-community#2233)

* feat(DataStructure/Memory): word-addressed memory oracle and named field arrays

Memory.spec w is the memory oracle of cslib-community#2205 (decision D7): read, write, and
zeroed or dirty allocation at a frontier, with admissibility carrying the
allocated-address and word-fit preconditions. Field arrays are WordRAM
Blocks accessed by Block.get/Block.set programs over the oracle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* doc(bib): add Guéneau, Charguéraud and Pottier (ESOP 2018)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): refinements by abstraction functions with stacked potentials

Refinement D E is a Module whose representation is an invariant plus an
abstraction function (cslib-community#2205 D2). Refinement.Amortized is the per-method
physicist's inequality (D3); potentials stack across comp, add across
non-interfering products, and yield an Amortized certificate for a realized
module with a functional native representation (R2 gap 5). CostIsBigO is the
exported asymptotic form (D6).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): weaken and rescale amortized refinements

Amortized.mono and Amortized.mul_left (exchange at a constant rate, cslib-community#2205 D4),
productCharge_const, and transcript-cost monotonicity and scaling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure/StateTransition): place productCharge beside product, outside Refinement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): make Refinement.Amortized a structure

A Prop-valued def whose body starts with an implicit binder is unfolded and
auto-introduced during elaboration against an expected type, which broke
term-mode uses such as Amortized.prod. A one-field structure, like the
existing DataStructure.Amortized, avoids this.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: array stack over memory and queue method lemmas

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(Foundations): affine cost bounds are O(size)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: queue over memory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): product answer types via Sum.elim

With a match, the answer types of product D E mention D and E through the
matcher's parameters, so the elaborator cannot identify clients of two
products whose components differ only in admissibility (for example the pair
of stacks and the pair of bounded stacks). Sum.elim D.Result E.Result
depends only on the component answer types.

Queue.Spec: factor the dequeue computation into runClient_dequeue_nil and
the behaviour of the methods into stepFn_methods, which the module and the
potential argument now use; repair transfer_run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): queue over two array stacks over the memory oracle

The M1 slice of cslib-community#2205. Stack.Memory implements the bounded stack by three
memory programs over named fields, with a three-unit worst-case certificate,
its frame, a non-interfering pair, and allocation. Queue.Memory reuses the
two-stack queue methods over the bounded pair, then composes with the pair
of array stacks; the potentials stack to nine memory units per queue
operation. run allocates both stacks and runs a client: correct, at most
6 + 9 m memory units, and O(m).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): Fibonacci heap insert over a record of named cells

Add Record.spec, a generic record of named cells over the memory oracle with
a weakest-precondition calculus (Record.wp) and a one-unit-per-operation
refinement into Memory.spec. Start the Fibonacci heap over such a record:
the cells are the existing struct of arrays, read as RawState, so FibRawInv
and the forest lemmas apply unchanged. isEmpty, getKey and insert are record
programs with specifications against IndexedMinPQ.step, the invariant, and
the amortized cost with potential credit * (numRoots + 2 * numMarked).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): Fibonacci heap decreaseKey with cascading cuts over a record

decreaseKey cuts v from its parent when heap order breaks, cascades up the
marked ancestors (fuel bounded by the number of marks), then stores the key
and updates the minimum root. Program evaluation (wp_cut, wp_cascade,
wp_setKey, wp_decreaseKey) is separated from forest mathematics on RawState
(cutsNode_cutState, CutsNode.cascading, Cascading.mark, ...), which reuses
ValidSubtree.exists_cut, mark_pending, lower_key_no_cut and
CutInv.to_fibRawInv unchanged. Amortized cost: 104 record operations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure): credit Renfei Zhou in the record Fibonacci heap; test records and insert

Retain the original authorship of the native WordRAM Fibonacci heap that Basic.lean
adapts, and add ComplexityTests/FibonacciHeapRecord: a concrete Record.Layout with a
program run through Record.wp and Record.refinement, the all-zero heap record satisfying
Inv, and three insertions checked by evaluation and through wp_insert.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure): credit Renfei Zhou in the record decreaseKey; test a cut and cascading cut

Retain the original authorship of the native Cut.lean development that DecreaseKey.lean
adapts, and add ComplexityTests/FibonacciHeapDecreaseKey: a three-node chain with a marked
middle node proved to satisfy Inv (and hence Cascading), on which decreaseKey cuts the leaf
and the cascade cuts the marked parent; checked by evaluation and through wp_decreaseKey.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure): name the adapted module without a slash path

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* feat(DataStructure/Memory): allocators, and a shared room budget for growing structures (cslib-community#2239)

* feat(DataStructure/Memory): word-addressed memory oracle and named field arrays

Memory.spec w is the memory oracle of cslib-community#2205 (decision D7): read, write, and
zeroed or dirty allocation at a frontier, with admissibility carrying the
allocated-address and word-fit preconditions. Field arrays are WordRAM
Blocks accessed by Block.get/Block.set programs over the oracle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* doc(bib): add Guéneau, Charguéraud and Pottier (ESOP 2018)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): refinements by abstraction functions with stacked potentials

Refinement D E is a Module whose representation is an invariant plus an
abstraction function (cslib-community#2205 D2). Refinement.Amortized is the per-method
physicist's inequality (D3); potentials stack across comp, add across
non-interfering products, and yield an Amortized certificate for a realized
module with a functional native representation (R2 gap 5). CostIsBigO is the
exported asymptotic form (D6).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): weaken and rescale amortized refinements

Amortized.mono and Amortized.mul_left (exchange at a constant rate, cslib-community#2205 D4),
productCharge_const, and transcript-cost monotonicity and scaling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure/StateTransition): place productCharge beside product, outside Refinement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): make Refinement.Amortized a structure

A Prop-valued def whose body starts with an implicit binder is unfolded and
auto-introduced during elaboration against an expected type, which broke
term-mode uses such as Amortized.prod. A one-field structure, like the
existing DataStructure.Amortized, avoids this.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: array stack over memory and queue method lemmas

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(Foundations): affine cost bounds are O(size)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: queue over memory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): product answer types via Sum.elim

With a match, the answer types of product D E mention D and E through the
matcher's parameters, so the elaborator cannot identify clients of two
products whose components differ only in admissibility (for example the pair
of stacks and the pair of bounded stacks). Sum.elim D.Result E.Result
depends only on the component answer types.

Queue.Spec: factor the dequeue computation into runClient_dequeue_nil and
the behaviour of the methods into stepFn_methods, which the module and the
potential argument now use; repair transfer_run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): queue over two array stacks over the memory oracle

The M1 slice of cslib-community#2205. Stack.Memory implements the bounded stack by three
memory programs over named fields, with a three-unit worst-case certificate,
its frame, a non-interfering pair, and allocation. Queue.Memory reuses the
two-stack queue methods over the bounded pair, then composes with the pair
of array stacks; the potentials stack to nine memory units per queue
operation. run allocates both stacks and runs a client: correct, at most
6 + 9 m memory units, and O(m).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): products over one memory, and glue charges for hop 3

Products over a shared memory (cslib-community#2205 hop 3):
- `Memory.Framed`: a refinement over `Memory.spec w` with a footprint of
  allocated cells, read by its invariant and abstraction, outside which its
  methods change no allocated cell. `Framed.ofStatic` for fixed layouts.
- `Framed.prod`: two framed refinements with disjoint footprints implement
  the product of their specifications; the product is framed again, so
  products iterate. `Framed.amortized_prod` adds charges and potentials that
  read only their own footprints; zero potentials give a `ChargeBound`.
- `Framed.of_fresh`, `Framed.prod_of_fresh`: allocation preserves structures
  and sets up products.
- `Refinement.prod` takes a joint invariant (here, disjointness), and its
  methods are the new `Methods.prod`.

The array stack is now `Stack.Memory.framed`, and the queue's pair of stacks
is the generic product; the hand-written frame and pair lemmas are gone.

Glue charges: `Refinement.Amortized.add`, `Amortized.glue` (glue at most
`K` times a call's charge plus `K`), `Amortized.glue_of_one_le`,
`StateTransitionSpec.totalCost_glue_le` and `Memory.one_le_charge`.
`Queue.Memory.run_cost_glue` bounds memory charges and glue together by
`(2K + 1)(6 + 9m)`.

`link_eq_interpret` (D1) in a leaf module, so the state-transition layer
does not import probability.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): instance search for nested products

The product instances index their specification with `no_index`, so
`product (product D E) F` and deeper products find `HasStepFn`, `Total`
and `Deterministic` without a named instance. The test of three stacks in
one memory drops its named instance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/Memory): allocators, and a shared room budget for growing structures

`Memory.Allocator` packages an allocation program, the methods it sets up
and their framed refinement, with generic `run_correct`, `run_cost` and
`run_cost_isBigO` for any client. `Allocator.prod` allocates structures
one after the other and `Allocator.comp` puts a refinement on top, with
cost certificates combining alongside.

`Memory.Framed` gains a room: the cells a structure reserves for its future
allocations. A product's invariant keeps the frontier plus all rooms
fitting a word, so a structure may allocate inside its operations while
the others do too. `Framed.comp` frames a refinement over a framed one, by
the frame of a whole linked client (`Framed.modifies_demonic`).

The queue over two stacks is restated through the allocator, with no
setup proof of its own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/Memory): structures already in memory, and a growth test

An allocator may now take over allocated cells instead of allocating them:
`Allocator.owned` names them, `Allocates.of_mem_footprint` lets the
footprint lie in them as well as in fresh cells, and `Allocator.ProdPre`
asks a product's two structures to take over disjoint cells. Fresh
allocators default to taking over none. `Allocator.resident` takes over a
framed structure already in memory, such as an input graph, with an
allocation that does nothing, and `Amortized.resident` carries its
certificate over. `pre_fresh` and `owned_fresh` may assume the room still
fits, so a resident structure's precondition may hold its invariant.

`Framed.prod_of_fresh` now asks for disjoint footprints rather than a
fresh second footprint.

The new test `DataStructureMemoryAlloc` checks two write-once cells that
each reserve one cell and allocate it inside their first `set`, with the
footprints, abstractions and frontier plus room after each step and the
tight word-size boundary; and stacks held by the input, taken over beside
stacks allocated from scratch in the Dijkstra shape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/Memory): allocations keep the memory beyond the frontier

An admissible run changes no cell at or above its final frontier
(`Memory.mem_run_of_frontier_le`, `mem_clientState_of_frontier_le`).
`Allocator.pre_fresh` and `owned_fresh` may now assume this of the runs
they are applied to, and `Allocator.prod` supplies it from the first
allocation's admissibility. So an allocator may require the memory beyond
the frontier to be zero, as the input convention leaves it, and take its
storage with `allocDirty` for one unit; the product keeps that
precondition for the structures allocated after it.

The test's write-once cells now take their headers this way, and a test
over a nonzero cell shows that the precondition is needed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure/PriorityQueue): the binary heap's frame keeps the frontier (Framed.ofStatic)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure): migrate the landed memory clients to Framed.ofStatic's frontier_eq and Apart

The binary heap (cslib-community#2237), the adjacency arrays and the direct-address table (cslib-community#2238) keep the
frontier, so each supplies Framed.ofStatic's frontier_eq from its existing run lemma.
Dijkstra.Memory.inv_input now assumes that the frontier after allocation fits a word, which the
product invariant Memory.Framed.Apart requires; run_triple supplies it from its fitting bound.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* feat(Algorithms/Lean/Karger): Karger's contraction algorithm as a randomized client, survival proved on the specification (cslib-community#2241)

* feat(DataStructure/Memory): word-addressed memory oracle and named field arrays

Memory.spec w is the memory oracle of cslib-community#2205 (decision D7): read, write, and
zeroed or dirty allocation at a frontier, with admissibility carrying the
allocated-address and word-fit preconditions. Field arrays are WordRAM
Blocks accessed by Block.get/Block.set programs over the oracle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* doc(bib): add Guéneau, Charguéraud and Pottier (ESOP 2018)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): refinements by abstraction functions with stacked potentials

Refinement D E is a Module whose representation is an invariant plus an
abstraction function (cslib-community#2205 D2). Refinement.Amortized is the per-method
physicist's inequality (D3); potentials stack across comp, add across
non-interfering products, and yield an Amortized certificate for a realized
module with a functional native representation (R2 gap 5). CostIsBigO is the
exported asymptotic form (D6).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure/StateTransition): weaken and rescale amortized refinements

Amortized.mono and Amortized.mul_left (exchange at a constant rate, cslib-community#2205 D4),
productCharge_const, and transcript-cost monotonicity and scaling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(DataStructure/StateTransition): place productCharge beside product, outside Refinement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): make Refinement.Amortized a structure

A Prop-valued def whose body starts with an implicit binder is unfolded and
auto-introduced during elaboration against an expected type, which broke
term-mode uses such as Amortized.prod. A one-field structure, like the
existing DataStructure.Amortized, avoids this.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: array stack over memory and queue method lemmas

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(Foundations): affine cost bounds are O(size)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* wip: queue over memory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* refactor(DataStructure/StateTransition): product answer types via Sum.elim

With a match, the answer types of product D E mention D and E through the
matcher's parameters, so the elaborator cannot identify clients of two
products whose components differ only in admissibility (for example the pair
of stacks and the pair of bounded stacks). Sum.elim D.Result E.Result
depends only on the component answer types.

Queue.Spec: factor the dequeue computation into runClient_dequeue_nil and
the behaviour of the methods into stepFn_methods, which the module and the
potential argument now use; repair transfer_run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): queue over two array stacks over the memory oracle

The M1 slice of cslib-community#2205. Stack.Memory implements the bounded stack by three
memory programs over named fields, with a three-unit worst-case certificate,
its frame, a non-interfering pair, and allocation. Queue.Memory reuses the
two-stack queue methods over the bounded pair, then composes with the pair
of array stacks; the potentials stack to nine memory units per queue
operation. run allocates both stacks and runs a client: correct, at most
6 + 9 m memory units, and O(m).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): distributional refinements and a random table over memory

`RandomizedSpec` gives each operation a law, a stateful `PMF` handler. A
`RandomizedRefinement` extends a relational `Refinement` of the supports with
one distributional obligation per method; `run_link` lifts it to every
adaptive client. The identical-until-bad step reuses
`OracleComp.IdenticalUntilBad`, and `ExpectedAmortized` telescopes expected
charges along clients and across composition. `withCoins` adds private coins
(`ProbOracleComp`) to a lower interface.

Pilot: a random table stored in a field array over `Memory.spec w` with coins
refines the seed-level hash-family spec `HashFamily.seedSpec`; its run from
allocation has transcript law `HashFamily.evalOps` (decision D10 of cslib-community#2205).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(DataStructure): stack coin-using distributional hops; deterministic hops as distributional

Follow-ups to cslib-community#2232 for cslib-community#2205.

- `RandomizedRefinement.withCoins`: coins pass through a refinement unchanged.
- `RandomizedRefinement.mergeCoins`: two layers of private coins are one.
- `RandomizedRefinement.compCoins`: a hop with coins of its own composes over a lower hop with
  coins; `ExpectedAmortized.withCoins`/`.compCoins` stack expected potentials across it.
- `Refinement.toRandomized`, `Refinement.Amortized.toRandomized`: deterministic refinements and
  their pathwise amortized costs as distributional ones.
- `Probability.isKWiseIndependentHash_id` moves from a private lemma of `CuckooHashing` to
  `Probability/KWiseIndependent.lean`; the memory random table gets its `kWiseSpec` contract
  (`RandomTable.kWiseSpec_contract_run`).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* feat(Algorithms/Lean/Karger): Karger's contraction algorithm as a randomized client, with its survival bound on the specification

For cslib-community#2205 (decision D10). Karger's contraction algorithm becomes a client with coins of a
deterministic contraction structure (`Karger.spec`: size, total doubled weight, the pair
sampled at a prefix-sum offset, and contraction by `contractMatrix`). Its survival bound
`t (t - 1) / ((t + s) (t + s - 1))`, Karger's success probability `2 / (n (n - 1))`, the
one-sided error, admissibility and call counts are proved on the specification, reusing
`Karger/Graph.lean` and the `Probability.PMF` event-composition bounds unchanged.

Supporting lemmas: `RandomizedSpec.withCoins_run_sample_bind`,
`StateTransitionSpec.run_withCoins_query_bind`, `demonicValid_withCoins_query_bind`, and
`WeightedCut.cutWeight_fin_two`, `totalDoubledWeight_fin_two`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

* fix(StateTransition): use OracleComp.sumHandler after cslib-community#2201

cslib-community#2201 retired `ProbOracleComp.handler` and `handler_eq_sumHandler`. The coin
interface `withCoins` now uses the canonical `OracleComp.sumHandler`, which
`ProbOracleComp.handler` was equal to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci(integration): verify canonical aggregate-only merge resolutions

1 participant