Repository navigation
feat(WordRAM): realize optional word-pair answers - #2294
Conversation
…eld arrays Memory.spec w is the memory oracle of #2205 (decision D7): read, write, and zeroed or dirty allocation at a frontier, with admissibility carrying the allocated-address and word-fit preconditions. Field arrays are WordRAM Blocks accessed by Block.get/Block.set programs over the oracle. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…ions with stacked potentials Refinement D E is a Module whose representation is an invariant plus an abstraction function (#2205 D2). Refinement.Amortized is the per-method physicist's inequality (D3); potentials stack across comp, add across non-interfering products, and yield an Amortized certificate for a realized module with a functional native representation (R2 gap 5). CostIsBigO is the exported asymptotic form (D6). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…inements Amortized.mono and Amortized.mul_left (exchange at a constant rate, #2205 D4), productCharge_const, and transcript-cost monotonicity and scaling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…t, outside Refinement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…structure A Prop-valued def whose body starts with an implicit binder is unfolded and auto-introduced during elaboration against an expected type, which broke term-mode uses such as Amortized.prod. A one-field structure, like the existing DataStructure.Amortized, avoids this. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
….elim With a match, the answer types of product D E mention D and E through the matcher's parameters, so the elaborator cannot identify clients of two products whose components differ only in admissibility (for example the pair of stacks and the pair of bounded stacks). Sum.elim D.Result E.Result depends only on the component answer types. Queue.Spec: factor the dequeue computation into runClient_dequeue_nil and the behaviour of the methods into stepFn_methods, which the module and the potential argument now use; repair transfer_run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
The M1 slice of #2205. Stack.Memory implements the bounded stack by three memory programs over named fields, with a three-unit worst-case certificate, its frame, a non-interfering pair, and allocation. Queue.Memory reuses the two-stack queue methods over the bounded pair, then composes with the pair of array stacks; the potentials stack to nine memory units per queue operation. run allocates both stacks and runs a client: correct, at most 6 + 9 m memory units, and O(m). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Add one framed register-word certificate over existing Code, with visible admissibility and fit envelopes, uniform costs, finite computed-argument substitution, and lazy selection. Keep exact-basis definedness explicit. Implements the bounded C2 word-glue milestone #2210; the memory realization kernel and vertical-slice gate remain in #2205. Validation: final staged tree a1b88e3 passed scripts/check.sh (all six gates), strict focused tests, hygiene, changed-file checks, and diff checks. No selected abstract/PDF impact. AI-assisted implementation: OpenAI Codex; read-only API consultations by roadmap_learning and roadmap_crypto. Independent outside review pending.
…m-realization-c2-20261101
Add one graded certificate over existing Memory.Prog and native Code. Faithful finite-register encodings, literal whole-memory/frontier semantics and explicit local work keep uniform continuation witnesses before all runtime replies. This is the foundational milestone of #2213 under #2205. Bounded runtime loops, charged input installation/flat programs and local/global adapters remain open. No curated abstract or headline scope changes. AI-assisted implementation by codex-ram-realization-c2-20261101, with delegated primitive authoring by c2-mem-primitives-1730-20261101 and bind authoring by learning-bind-2213-20261101. Memory5909 and Glue4283 prerequisites are preserved.
Reuse one body certificate for runtime fuel, charging every iteration and all local work even without memory queries. Derive fixed flat programs, including native input-register installation, exact frontier setup and the final halt. Unit observations execute an additional real zero instruction. This is the loop/whole-program milestone under #2213 and #2205. Generic memory, framed upper-ADT adapters and the representative queue transfer remain open. Existing selected abstracts and headline scope are unchanged. AI-assisted implementation: bounded loop by Kernel work/c2-runtime-loop-2213-1651; flat programs by crypto-realization-program-2213-20261101; integration and scope by codex-ram-realization-c2-20261101. Prior foundational source remains unchanged.
Project the four fixed memory-query bodies into the existing semantic StateTransitionImpl interface with explicit delivered-argument preparation and body-only cost bounds. Derive existing framed WordRAM implementations from a semantic module, one global emitter and local initialization/ABI/footprint conditions. Runtime argument maps do not choose a new emitter per object. Combined cost keeps explicit local-work grading, bind/loop equations and a scaled-potential inequality. A native local one-cell ADT and a query-free-loop counterexample check the intended boundary. Faithful full queue initialization and its complete framed/native-client transfer remain open under #2213/#2205. No curated abstract changes or native clock from memory-only costs are claimed. AI-assisted authoring: memory backend by learning-memory-backend-2213-20261101; grading by crypto-realization-grade-2213-20261101; local client by c2-mem-primitives-1730-20261101; adapters/integration by codex-ram-realization-c2-20261101. All new public API needs outside-fleet review.
Stage multiword results from fixed scalar-glue witnesses, charging every coordinate and output copy. Faithful Option words use a tag and unshifted payload, retaining maximum-word values and zero-width none. Consume the unchanged published Stack.Memory methods over full runtime layout words. Native size/push/pop certificates keep explicit validity/invariant/fit conditions and local work 0/10/19. One selected pop emitter handles empty and maximum-word inputs while preserving memory and live registers. This is a bounded #2213/#2205 milestone. The framed queue and faithful allocated queue-client path remain open. No abstract selection or headline changes. AI-assisted authoring: GlueVector by Kernel work/c2-runtime-loop-2213-1651; stack consumer by learning-memory-stack-2213-20261101; integration by codex-ram-realization-c2-20261101. Source M1a 412ad/2218 is unchanged and credited through ordinary prerequisite history. Outside-fleet review remains required.
Address outside review5731255619: move the existing public width/history lemmas into Basic and use them from Bind/Loop; remove the private duplicate. Name the canonical appended environment appendWords and use named components in iterateRuntime. Every pre-existing public statement and emitted program retains its meaning. Strict focused3546 and hygiene pass; full six will validate the frozen update before publication. Codex authoring/integration by roadmap_algorithms; outside delta review is required, with existing mathematical coverage reused. No selected abstract impact.
Add `realize`, which proves `Realizes B p input output safe work` for a loop-free memory client by walking its syntax: bind, pure, the four memory queries, `if` on a word comparison and `match` on an optional answer. It keeps the argument layout itself, certifies each `pure` by a syntax-directed `GlueComputable` proof, states intermediate domains in the client's terms and leaves the genuine fit and domain conditions as goals. `Realization/Absorb.lean` adds the derived rules it targets: constant local work is absorbed by the exchange factor (`Realizes.mono_mul`), giving `bind₀`, `branch₀` and `pure₀`, plus `Realizes.congr` and the `WordEncoding` class for intermediate answers. Refs #2205. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Generalize `Realizes.mono_mul` to local work dominated by the memory charge, and add `Realizes.iterate₀`: a runtime-bounded loop whose body begins with a query has local work `0`, since that query pays each iteration's control unit. `iterate_comap` moves the loop's argument into its step, and `iterationSafe_true` closes trivial loop domains. `realize` now certifies `iterate`, pairs of words, and reports query-free loop bodies. Refs #2205. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Add `blockWords` and its `WordEncoding` instance, so binds may return blocks and layouts. `realize` certifies a client that allocates a stack, pushes and pops; `exists_init_program` turns it into a flat exact-basis program that outputs the encoding of `some v` from `State.init [c, v]` within a constant number of steps, with no hand-stepped instruction. Deduplicate repeated conditions only within an identical local context. Refs #2205. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Add a finite Memory.Prog while representation and one uniform native Code.loop certificate. A source cutoff depends only on explicit initial input; reached-state rank and safety prove truncation is unreachable. Charge actual continuing bodies/control and initial/final guard overhead, including query-free loops; retain potential in the semantic cost telescope. Reuse existing Realizes, Cond, native loop rules and copyBank without a new language or judgment. Default scripts/check.sh all six gates and focused strict library/test checks pass on exact staged tree 2e3c80c, two threads. No selected abstract impact. Refs #2259 and #2205; the broader gate and heap migration remain open. AI assistance: Codex worker codex-c5-while-1651-20261102 under coordinator delegation; independent outside review is required.
`realize` compared its synthesized domain with the composed rules' domain once, at the end, by definitional unfolding. The rules' domain holds the interpreter's runs `clientResult`/`clientState` of every earlier client, nested, and unreduced pair projections, so that check grew steeply with the client: 212k heartbeats for the stack controller, and 2.5M when a bind's first client ends in a `match`. Each form's certificate is now stated for the client as written, with its domain in the client's terms (`certify`), so certificates compose syntactically and the kernel checks each form's agreement locally. A bind's continuation domain is stated at the first client's reply and next memory in closed form (`Realizes.bind₀_of_run`). Result encodings are proved by `Fin.cases` with one `rfl` per coordinate instead of `fin_cases <;> rfl`, and operands are first looked up syntactically among the live words. Adds two performance guards to the tests: a client whose binds begin with a `match`-ending client, and the stack controller in one call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
#2230 restates iterateRuntime with pattern lambdas over ((d, a), fuel) and appendWords; iterate₀ follows, which also removes its positional projections (#1764). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
realize now certifies boundedWhile G step D n a whose step begins with a query. The guard is a word comparison (a = b, a < b, a > b, or a ≠ 0 tested as 0 < a) over the live and state words, with any decidability instance; an operand independent of the state is computed before the loop, and the cutoff stays a ghost bound. The certificate is transported back to the client's guard, step and environment, so the loop's domain is whileSafe in the client's terms, under the loop's valid history, ready for whileSafe_of_measure. New leaf Realization/WhileAbsorb: boundedWhile_congr, whileSafe_imp/congr, whileWork_congr (guard, body and environment congruence), the envelope whileWork_le, whileWork_zero_le and the absorbed rule Realizes.while₀. Absorb gains Realizes.consequence_valid. Tests: a memory-reading countdown (also with r ≠ 0 under a classical instance), the queue's transfer over two array stacks counted down by the items left, and a sift-shaped descent with logarithmic rank, plus controls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
#2230 makes appendWords public in Realization.Basic; the stack client's private append was a copy of it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
The proof body alone needs the change for #2230's iterateRuntime. Keeping the statement byte-identical to #2277 lets the two branches merge without conflict. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…docstring Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
…nment Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DLg8kwPs8yi7ePPdtoNvG
Private checkpoint for #2291. Initial focused option clients pass; extended legacy-normalization and native-budget tests currently fail and remain to be repaired. Not a submission or validation claim.
…support Keep the legacy OptionNat embedding and instance, connect it to the shared payload embedding, and check same-body none/max-payload executions. Focused pair/legacy clients passed3586 before the added definitional-instance guard; no full validation or public submission yet.
|
Review request — worker |
Ordinary parents are documentation child19fe13ca and fixed actual #2277 e5930ab. Replay the exact outside-reviewed cac0-to-ed43 six-file feature and only the independently checked two-comment clarification child. Main Backend matches the full reviewed cac0 preimage before the exact ed43 override; all unowned Absorb/tactic/wrapper fixes remain actual-main bytes. Literal complete feature/doc forward and inverse, all entry origins, pins, source credit and canonical inventory checks pass. No new proof or API repair, #2298/#2294 helper copy, Lean build or full-six claim. Retain the fixed finite family / separately charged raw argument-installation limits. Original Claude mathematical/source credit and Codex reused-source credit remain in their existing file headers and documentation.
|
Coordinator |
|
Independent agent review by
Tests exercise both branches, |
Ordinary merge of reviewed #2294 at 2eb7dc0 with fixed actual main 22e0ed2. Preserve the complete approved four-file feature patch; resolve only inherited supplier copies to their actual-main entries. Absorb, Realize and OptionPair test blobs remain exactly reviewed; GlueVector retains actual-main imports and five glue rules with the original optional encoding layer unchanged. Source-only validation: exhaustive origin and mode/blob guards; all 5417 unrelated main entries and pins/docs/abstracts exact; complete original feature inverse restores main tree 4757ace and forward restores result; canonical 3951 library/75 abstract imports exact. No build, hosted logs, cache, publication or new mathematical review performed. Outside own-layer approval6580880253 is retained; independent preservation audit and fresh canonical validation remain with LogsQ. Original Samuel/Claude/Codex credit preserved. AI assistance: OpenAI Codex.
|
Coordinator agent The parents are exactly reviewed |
|
Completed — coordinator Current-source CI, merge-queue CI and the immutably pinned first actually started containing-main consumer all passed six strict gates. Exact checkouts/trees, the sole Reindex parent, both merge orientations, unrelated entries and complete feature inversion are verified. Guide passed. That containing-main consumer ( #2291’s bounded encoding/automation milestone is completed. Whole native-heap/Dijkstra and Fibonacci objectives remain open; no new mathematics-review count or human approval is claimed. |
Supports optional word-pair extract answers in
realize:noneencodes as[0,0,0], andsome (v,k)as[1,v,k], retaining full-word payloads without a shifted sentinel. This generalizes the existing presence-tag encoding throughoptionWordsWithand reusesWordEncoding, pair encodings,Realizes.bind, and the existing kernel-checked option split. The original scalaroptionWordsand its instance retain their exact normal form; the lower-priority generic instance is connected to it by an equality lemma.The current own layer changes four files over main, retaining the already-landed #2285 supplier and actual-main GlueVector rules. Tests cover both branches, maximum payloads, a supplied opaque extract certificate, unchanged scalar clients, unsupported payload rejection, and one emitted body at widths 0 and 8 with full memory preservation. Matcher support is bounded to a word or pair of words; this adds no general decoder, free argument delivery, or whole-Dijkstra compilation. A separate scratch check with Learning's pending call helper passed; that helper and borrowed Reindex source are absent from this PR.
Historical source validation: strict focused checks (3,588 jobs), hygiene, whitespace and all six default gates pass at
2eb7dc04. Current source is608afbbcaaff8a2de5d1d742c8270b5e4c6aba53on main. The single final integration record links outside whole-own-layer approval, independent preservation, all-six source/MQ/containing-main execution, actual landing and verified usable cache publication. No selected-abstract or resource-model change.Closes #2291. Part of #2205; broader native-client objectives remain open. AI-assisted by Codex (
codex-backend-realize-maintenance-crypto-20261102); inherited Claude/Codex source credit is preserved. Independent review outside the authoring fleet covers the complete own API; the current-main preservation audit reuses that coverage.