Skip to content

feat(CSP): certify native ordered-gadget substitution - #5025

Draft
edemaine wants to merge 5 commits into
mainfrom
feat/planar-native-substitution-codex-20261113
Draft

edemaine wants to merge 5 commits into
mainfrom
feat/planar-native-substitution-codex-20261113

Conversation

@edemaine

@edemaine edemaine commented Nov 13, 2026 •

Copy link
Copy Markdown
Collaborator

Proves full ordered-checker acceptance for the deterministic table emitted by fixed-gadget substitution, on exactly the original replacement body. The proof constructs the actual occurrence partition, permutation, endpoint fibers and componentwise genus internally. Repeated names/rows, unused ports, closed/nullary components and empty cases are retained.

The total compileConstructions wrapper interprets actual trees and obtains their ordered witnesses and auxiliary bound internally. On all raw inputs it preserves certified satisfiability; malformed bodies/certificates produce the empty body with invalid certificate [0]. Ordinary native polynomial time and the complete framed output bound require only a finite fixed source alphabet, with an arbitrary encoded target alphabet. Static tree/witness preprocessing may use choice; no varying-language preprocessing bound or bare planarity search is claimed.

Draft: one runtime placement dependency remains held. #4515 owns the original distinct-variable certificate. Its exact extraction and native-caller migration are prepared, but the held file is untouched and the temporary proof-only Counting import remains. This must be resolved before approval. The landed #4934 named-constraint migration is now reconciled; #4909 is merged.

Current reconciliation validation: strict 88-root checkpoint (9,678 jobs), the 70-topic/670-declaration standard-axiom/public-Init/15-environment-linter audit, both complete guide clients, manual checks and 72 tooling tests, affected hygiene, source-only lints and encoding/projection ratchets pass. All 108 main guide fences are preserved. Agent roles/workflow are unchanged. Full hosted CI (all six Lean gates and required audits), full Guide and current affected-page rendered QA pass. Actual current notices have been inspected; the sole definition candidate retains its author disposition pending independent assessment. Eligible independent review and the held extraction remain before approval.

See the canonical validation and advisory record, which records current-head hosted validation, advisory dispositions and the scope of rendered QA. This is a supplied-certificate substitution milestone for #3091; expanded original-language OneHot3/CROSS and normalization/Figure-1 witnesses, source-model comparison, recognition/Hanani–Tutte and dichotomy assembly remain open. AI assistance: OpenAI Codex implementation/integration, preserving existing source credit. No author approval or queue action.

…cture

Expose literal cycle/fiber and corner-color APIs needed to prove planar gadget
substitution. General List/Perm/BitString facts live in small Foundations
topics. Clockwise colors read the face of the reverse dart; both directions
of face-color descent and the existing componentwise genus criterion are
available without connectedness, degree or genus-provider assumptions.

Add positional occurrence relabel/flat-map/index maps, exact raw cycle words,
complete scope/vertex parity, and actual probe occurrence/edge/parity/prefix
restriction APIs. Reuse the original enumeration calculation, scope-parity
calculation, accepted-certificate length and inverse lookup. The arbitrary-list
AppendScopeIndex result derives from the existing OfFn theorem. DisjointRotation
now reuses SumCycles; its public rotate computation/statements remain unchanged.

Also preserve the independently useful inverse numerical contraction and
contiguous-split corollaries through the landed PL forward/restoration/converse.
They are proof-only Realization topics, avoiding the one-way theorem's import
cycle. RotationSubstitutionSurgery checks actual directed equations and an
ordinary split client with a closed component and isolates. The final gadget
genus proof uses colors rather than this alternative route.

Validation in the prepared checkout at exact base3611ca71 (no donor outputs):
  lake build --wfail --iofail CslibFrontierTests.CSPGadgetGenus
    CslibFrontierTests.CSPConstructionCompiler
    CslibFrontierTests.PlanarConstructionBoundary
    CslibFrontierTests.CSPGadgetSubstitution
    CslibFrontierTests.RotationSubstitutionSurgery
    CslibFrontierTests.RotationDisjoint
    CslibFrontier.Computability.Complexity.Problems.Graph.RotationSystem.DisjointGenus
PASS9378 jobs, full-endpoint-clients-2.log. This checks the generic topics
through actual substitution/native clients in the continuing worker lane.
All-stored audit4: 670 declarations across70 affected library topics, standard
three axioms/public Init/15 environment linters, PASS. All affected-source
hygiene and the encoding/projection ratchets pass without baseline increases;
proof-copy notice reports no repeated block in288 proofs. These are focused
checks, not the full six/global Guide/PDF or independent review. Global indexed
duplicate/changed-file notices remain pending on stale whole-library outputs.

MCP was used first for goals/search/diagnostics. Specific Windows setup-file
artifact replacement failures (error5) required focused native fallbacks;
pending/failed MCP setup is not counted as validation. Both LAKE_CACHE_DIR and
MATHLIB_CACHE_DIR are native absolute checkout-private roots; threads2.
Private Lake build/cache internal hardlinks are permitted, not independent
copies/linkcount1. Initial ensure's removal of a corrupt shared Mathlib archive
is retained as an incident; shared production/package sources were unchanged.
No shared cache repair, cross-checkout outputs, other process kills or external
actions. Source/dependency/toolchain/options context and unique logs/runners
are retained in tmp/planar-substitution-0ac7/evidence.

Parent owns both-manual/guide integration. Standalone API/model/encoding/native
and checked-client prose is implementation-manual-handoff.md in that evidence
directory. Agent roles/workflow are unchanged, so its manual needs no edit.
This commit supplies generic prerequisites, not completion of full#3091.
The actual exact-table genus/compiler endpoint follows in the next commit;
expanded recipes/normalization/source-model/HT/recognition/dichotomy remain.
Construct the actual replacement rotation and prove that the existing full
ordered numerical CSP checker accepts the literal computed replacement table.
The target is exactly original replaceGadgets B templates F. Inputs are actual
PPGadgets with checked GadgetWitnesses, a fixed auxiliary bound, source
WellFormedness and actual full raw source-certificate acceptance. Neither
alphabet is finite in these mathematical theorems. No target invariant,
rotation, genus, fiber/order provider, solver, degree, connectedness, loop or
cofacial shortcut is assumed.

The executed positional words partition all target occurrences, with exact
free/even and private auxiliary/odd fibers. They retain repeated source names,
duplicate constraints and indexed scope positions. Internally construct the
permutation, positive argument order and variable cycle correspondence, then
identify the literal emitted table with ofRotation through the original
CertificateLookup characterization.

For every target vertex-even edge labeling, complete body/free/aux partitions
derive vertex-even source and actual probe labelings. Existing cycle exactness
supplies proof-only corner colors. The actual reversed probe and original
source black cycle have one uniform XOR seam per copy (false at arity zero).
Exact free-block paths splice in supplied source white order, including every
empty stretch. Actual auxiliary body successors agree with probe successors
outside canonical free ports. The resulting target colors descend along the
literal emitted cycles; the existing componentwise converse proves numerical
genus zero. Closed/nullary components, unused ports, zero arities, empty bodies
and alphabets all remain in the quantifiers. No color choice executes at runtime.

Main public APIs in Planar/Substitution/Genus:
  numericalGenusZero_replacementRotation
  verifyRotationCertificate_replacementCertificate
The low ordinary-import CSPGadgetGenus client APPLYs the complete checker
theorem at arbitrary arity without finite alphabet hypotheses or native Gadget
imports. Raw algorithms live in low Table; original draft OpenAI headers remain.
New named-pattern binders preserve table behavior and eliminate public tuple
chains, without a ratchet baseline change.

Validation: full-endpoint-clients-2.log strict PASS9378 jobs after the public
binder cleanup; genus-precommit-1.log strict low-client PASS5416. The seven
representative roots and full command are recorded in preceding37b9f5eaa's
description. All-stored audit4 PASS670 declarations/70 affected topics,
standard three axioms, public Init and15 environment linters. Source hygiene,
encoding/projection ratchets and proof-copy notice pass. Corrected focused
duplicate scan:321 examined theorems against11591 library theorems plus6081
imported modules over1005 built first-party modules, missing[], no groups.
Four definition-notice candidates were inspected: occurrence transport uses
the actual original renaming map on a different carrier; other pairs share
typed witness/canonical-port data while computing different cut/full/attachment
operations. Detailed actual-source assessment and raw requests/results retained.
Whole-library duplicate/changed-file indexed checks remain explicitly skipped
on stale global outputs; focused coverage is not a global pass.

Preserved failure evidence: actual-substitution-genus-1 built Genus successfully
but FAILED its aggregate for mistyped nonexistent test DisjointGenus;
actual-substitution-genus-2 corrected to the library topic and PASS9156.
MCP default-budget ordinary-import diagnostics preceded focused native checks;
specific setup-file error5 artifact replacement failures are retained separately.
No sorry/axiom/native_decide, heartbeat override, provider endpoint or baseline
increase. Both caches remain private native absolute roots, threads2, with
authorized private internal Lake links. Initial shared Mathlib archive incident
is not erased; no shared production/package source edits or donor outputs.

Parent owns shared Operator/Guide integration, with complete standalone prose
and checked clients in implementation-manual-handoff.md. Agent Manual needs no
workflow edit. This completes the central mathematical checker theorem, not
full#3091: the native Construction wrapper follows; broader recipes,
normalization/source-model/HT/recognition/dichotomy objectives remain open.
Add the total original-body/deterministic-table compiler and complete all-raw
guarded semantic/checker equivalence. Source exact arities and the existing
full source checker select the valid branch. Invalid sources emit the empty
body with INVALID certificate[0], so target certified-SAT rejects even for
an empty target alphabet without an unsatisfiable target relation.

compileGadgets derives free/aux blocks from actual checked gadgets. The final
compileConstructions endpoint interprets each actual Construction.gadget,
invokes its landed orderedWitness internally (including all pin/disequality
enabling subtrees), and computes its own auxiliary bound for the fixed finite
source family. No target invariant, separate witness or unproved enabling
theorem is supplied. Valid output is exactly existing replaceGadgets plus the
native replacementCertificate accepted by90f382bd7's full theorem.

Main APIs in PolyTime/CSP/Gadget/ConstructionCompiler:
  compileConstructions
  compileConstructions_of_sourceGuard_true / _false
  wellFormed_compileConstructions
  verifyRotationCertificate_compileConstructions_iff
  wellFormed_certifiedSatisfiable_compileConstructions_iff
  computableInPolyTime_compileConstructions
  exists_framed_bound_compileConstructions
The semantic iff includes actual target checker acceptance, WF and SAT on
every raw input. Ordinary native polynomial time and the complete framed
output bound require only Finite SOURCE; the target may be infinite with an
arbitrary symbol encoding. Binary names/certificate entries are data, not
clocks. Original runtime handlers/generated encoding certificates are reused.
Static family/witness preprocessing may be noncomputable, nonuniform in the
fixed language/trees; no varying-tree preprocessing bound is claimed.

Actual clients preserve existing construction bodies/count tests. The ordinary
PlanarConstructionBoundary client applies the full wrapper to its existing
non-atom binary tree and genuine enabling subtrees, proving target checker
acceptance and SAT/UNSAT on sparse/repeated source names. CSPConstructionCompiler
checks generic arbitrary-target native/spec statements and Empty-to-Empty
empty/[0] rejection plus valid-empty acceptance. CSPGadgetSubstitution executes
the full target checker on duplicates, repeated positions, nontrivial source
white cycles, parallel incidence, degree>=5, sparse2^250, malformed huge indices,
empty alphabets, reflected negative, nullary true/false and unused ports.
Its stronger non-atom explicit-table regression includes two free unary rows,
a closed auxiliary and a nullary component, unused free/aux ports, duplicate
degree-six source rows, literal output equality and executed SAT/UNSAT checks.

Validation: full-endpoint-clients-2.log strict PASS9378 after named public
pattern cleanup; nonatom-executable-regressions-1.log strict PASS8954 after
the additional explicit-table regression. construction-compiler-1/2/3 each
strict PASS9228; cached MCP setup failure was not counted as client validation.
All-stored audit4 PASS670 declarations/70 topics, standard three axioms/public
Init/15 environment linters. Hygiene, encoding/projection ratchets, proof-copy
notice, mk_all generation/check and manual tooling PASS (75 docs,5539 links,
12 excerpts;72 tests). Focused theorem/definition comparisons and inspected
candidate rationale are in duplication-assessment.md. Global indexed notices
remain SKIPPED on missing/stale whole-library outputs, not passes. Parent host
must run full six/global Guide/PDF and independent review of integrated source.

Retain failures and fixes separately: seam-parity-1/2 failed after Size stopped
incidental runtime exports; each new runtime proof module now explicitly imports
original Gadget, and seam-parity-3 passed. actual-genus aggregate1 mistyped one
test target; corrected aggregate2 passed. Audit command attempts1/2 failed for
runner generation/unsupported Lean flags; audit3/4 passed. No skipped check is
called a pass. No sorry/custom axiom/native_decide, provider, heartbeat override,
baseline increase, delegate or external action. Both native absolute caches are
checkout-private, threads2; authorized private internal Lake hardlinks remain.
Initial shared corrupt Mathlib archive removal is retained as an incident.

ACTIVE PLACEMENT DEPENDENCY: native Rotation temporarily proof-imports the
original CountingCSP distinctVars theorem. Parent is coordinating the exact
one-block DistinctVars move with#4515; its owner has not released it. This commit
does not move/copy/reprove that theorem or claim placement/approval complete.
It preserves the exact59f extraction and awaits parent coalescing the published
runtime Gadget doc-only fix. No live rebase for the named-Constraint flip.

Parent owns shared Operator/Guide integration. Complete standalone prose/API/
encoding/resource/model/client handoff is implementation-manual-handoff.md;
Agent Manual roles/workflow unchanged. Full#3091 remains open for expanded
OneHot3/CROSS recipes, normalization cap/Fig1, source-model/HT/recognition and
dichotomy assembly. Current source evidence/commands/unique scratch are retained
under tmp/planar-substitution-0ac7/evidence for parent harvest and final review.
Document the exact replacement-table genus/checker theorem, total guarded
compiler and actual Construction-family wrapper. Keep finite source versus
arbitrary encoded target, complete framed cost, nonuniform fixed preprocessing,
and the empty-body/invalid-certificate rejection explicit. Remove only the
solved generic substitution gap; expanded OneHot3/CROSS and normalization
witnesses, source-model comparison, recognition/HT and full #3091 remain open.
No Agent Manual, ROADMAP, result catalogue, pin or UPSTREAM change is needed.

Keep all 108 old guide fences and add two complete scoped ordinary clients.
Fresh MCP checks on both extracted final clients finish without diagnostics;
their tokens match the guide. Add an import-separation guard to the low-only
genus client and concrete join/split/orientation clients for retained ListSplice.
All original executable definitions and proofs in the two tests are retained.
Production source from the three worker commits is unchanged; their authors
and credit are preserved. Aggregate has exactly the canonical new imports.

Validation on main base72a0132ad with the three cherry-picked implementation
commits: strict19-root build PASS9666 jobs; mk_all --check pass. The first
following audit stopped on an unbuilt ListSplice output, not a theorem failure.
Explicitly building all70 audit imports then rerunning passes all670 stored
declarations, standard3 axioms, public Init and15 environment linters.
Final parent test build PASS5948; manual checker75docs/5659links/13excerpts,
72 manual tests, hygiene, source-only changed lints, encoding/projection
ratchets and288-proof copy notice pass. Caught and removed a line-ending-only
guide rewrite before commit. Whole-library indexed audits, restored-warning
coverage, full six gates/Guide/PDF and independent review remain pending.

Evidence is retained in tmp/planar-resume-20261112/native-integration with
source/dependency preservation, actual fresh versus reused coverage, failed
launch/audit records and complete archived worker evidence. Verified138 unique
records plus9 inspection files before retiring the clean worker/cache; Git
retains its commits. Only an empty busy unregistered directory remains; shared
language-server processes were not killed.

Draft integration dependency: #4515 still owns CountingCSP. Native Rotation
temporarily proof-imports its original distinctVars theorem. The exact move
to a small PolyTime/CSP/DistinctVars topic is prepared and independently
elaborates as a scratch candidate, but no held source has been edited. That
placement and the caller migration must finish before approval. #4934's
Constraint-record sequencing remains active; #4909 is already merged.

edemaine commented Nov 13, 2026 •

Copy link
Copy Markdown
Collaborator Author

Current head 04b51ede6788a289ec7c11ef230db7968d0d18b0: full CI, including all six Lean gates and required indexed/tooling checks, the full Guide, and manual builds pass. CI checked the merge of this head into main e4f39124. The #4934 reconciliation preserves the shared enumeration calculation/caller and uses named constraint fields plus the existing native field certificates; compiler targets, guards, literal tables and resource claims remain intact.

Author-side current-head QA verified both PDF hashes and all 79 recorded chapter/converter inputs against the clean head, plus the manual bibliography, then visually inspected affected Operator PDF pages 361–366 (printed 353–358): readable, no clipping, overlap or missing glyphs. This is affected-page QA, not whole-book or independent semantic review. Agent roles/authority/workflow are unchanged. The retained focused checks cover 88 roots, all 670 stored declarations across 70 topics, both new guide clients, 108 preserved main fences, manual checks/72 tests, hygiene and unchanged encoding/projection baselines.

I inspected the actual current CI notices: no repeated block among 288 proofs and no duplicate statement among 281 theorems. The sole definition candidate among 44 declarations is still instantiatedOccurrence versus CSP.instantiate; the distinct typed-occurrence/full-body author disposition below applies to the current source and remains for independent assessment. These are scoped notices, not whole-library uniqueness claims.

The #4515 extraction reservation is still unanswered. CountingCSP/Vars are unchanged from main, so the temporary proof-only Counting import remains and #5025 stays draft. The held extraction and eligible independent correctness/API/both-manual review remain before approval. No author approval or queue action; full #3091 remains open.

Historical hosted evidence below applies only to e73dc529.

Historical validation at e73dc529865630db9709f5caf25f5d3456db688f: full CI passes all six Lean gates and required indexed/tooling checks; the full Guide and manual builds pass. Author-side QA verified both PDF hashes and all 79 recorded source inputs against the clean head, then inspected affected Operator PDF pages 356–360 (printed 348–352): readable, no clipping/overlap/missing glyphs. This is affected-page QA, not whole-book or independent review. Agent roles/workflow are unchanged.

I inspected the actual CI notices. No duplicate statement among 281 theorems and no repeated block among 288 proofs examined. The sole definition candidate is instantiatedOccurrence versus CSP.instantiate. The former transports one typed occurrence through the original two renamings using shared relabelOccurrence; the latter instantiates the entire CSP. The freshening expression agrees because the transport targets that literal body. Its index/order callers reuse the existing relabel laws, while runtime replacement still calls the original handler. Author disposition: distinct carriers/operations, not a second replacement algorithm; independent review should assess this rationale. These notices are scoped, not a whole-library uniqueness claim.

The PR remains draft for the held runtime extraction, followed by eligible independent correctness/API/both-manual review. #4934 was subsequently reconciled at the current head above. No author approval or queue action; full #3091 stays open.

Merge main 60058cd, including the
landed #4934 Constraint record, into the native ordered-substitution head.
Keep the shared raw-enumeration calculation and have the typed scan reuse
it. Carry named rel/scope fields through the actual occurrence, parity,
genus and runtime callers. Native relation reads use the existing named
field certificates through fun_prop rather than unfolding the encoding.
Main's constructor migration, public reexports and unrelated changes are
preserved. Existing source credits, checker targets, guards, indexed order,
even/odd freshening and independent native resource claims remain intact.

The representative runtime callers are occurrencePrefix and auxiliaryCycles:
they now consume encConstraint_rel_polyTime via automation. The mathematical
caller occurrences_eq_map_incidenceList consumes the one shared raw scan.
Actual body/table/checker regressions cover non-atom gadgets, duplicate and
sparse names, unused ports, closed/nullary components and empty alphabets.

Validation is recorded in record-restack/final-check.log and the accompanying
source, guide-preservation and scope records under
 tmp/planar-resume-20261112/native-integration/.
The final serial checkpoint covers 88 selected roots, mk_all, the 70-topic
670-stored-declaration standard-axiom/public-Init/15-environment-linter audit,
and both complete added guide clients. All 108 main guide fences are retained
in order. Manual source/link checks and 72 tooling tests, affected hygiene,
source-only changed-file checks, encoding/projection ratchets and whitespace
checks are required before publication. Hosted six gates, full Guide,
new rendered QA and independent review remain pending for this revision;
old e73 hosted passes are historical evidence only.

Both manuals assessed: the existing Operator contracts/examples remain
accurate for the record representation; main's documentation is preserved.
Agent roles, authority and workflow are unchanged. No new manual delta,
abstract, results, pin, bibliography or upstream-marker edit is needed.
CountingCSP and Vars match main: #4515 still owns the distinct-variable
certificate extraction, so the temporary proof-only Counting import remains
and #5025 stays draft. No author approval or queue action. This preserves the
supplied-certificate compiler milestone; full #3091 remains open.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant