From 448613f5743696d60b001c1607279490c91ff1f8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 12:56:58 +0000 Subject: [PATCH 1/7] Verify Echo foundations and reconcile repository contracts and security gates Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .containerignore | 6 + .gitbot-fleet/enrolment.json | 1 + .gitbot-fleet/enrolment.json.license | 2 + .gitbot-fleet/report-backs/README.md | 9 + .github/CONTRIBUTING.md | 111 +--- .github/copilot/coding-agent.yml | 4 +- .github/workflows/actions.lock | 104 ++-- .github/workflows/agda.yml | 275 +++------- .github/workflows/codeql.yml | 17 +- .github/workflows/hypatia-scan.yml | 79 +++ .github/workflows/metadata.yml | 70 +++ .github/workflows/pages.yml | 17 +- .github/workflows/push-email-notify.yml | 6 +- .github/workflows/secret-scanner.yml | 3 - .gitignore | 2 + .machine_readable/README.adoc | 42 ++ .../agent_instructions/README.adoc | 17 +- .machine_readable/bot_directives/README.adoc | 16 +- .machine_readable/contractiles/Justfile | 116 +--- .machine_readable/contractiles/README.adoc | 23 + .machine_readable/contractiles/_base.ncl | 140 +++++ .../contractiles/adjust/adjust.k9.ncl | 52 ++ .../contractiles/adjust/adjust.ncl | 54 ++ .../contractiles/bust/bust.k9.ncl | 47 ++ .machine_readable/contractiles/bust/bust.ncl | 56 ++ .../contractiles/dust/dust.k9.ncl | 56 ++ .machine_readable/contractiles/dust/dust.ncl | 56 ++ .../contractiles/intend/intend.k9.ncl | 52 ++ .../contractiles/intend/intend.ncl | 65 +++ .../contractiles/must/must.k9.ncl | 66 +++ .machine_readable/contractiles/must/must.ncl | 54 ++ .../contractiles/trust/trust.k9.ncl | 56 ++ .../contractiles/trust/trust.ncl | 81 +++ .machine_readable/integrations/README.adoc | 17 +- .machine_readable/root-allow.txt | 7 + .machine_readable/self-validating/README.adoc | 196 +------ .../{ci-config.k9.ncl => ci-config.k9.ncl.in} | 0 .../examples/project-metadata.k9.ncl | 61 +-- ...setup-repo.k9.ncl => setup-repo.k9.ncl.in} | 0 ...te-hunt.k9.ncl => template-hunt.k9.ncl.in} | 0 ...ennel.k9.ncl => template-kennel.k9.ncl.in} | 0 ...te-yard.k9.ncl => template-yard.k9.ncl.in} | 0 .machine_readable/svc/k9/README.adoc | 72 --- .../svc/k9/examples/ci-config.k9.ncl | 99 ---- .../svc/k9/examples/project-metadata.k9.ncl | 83 --- .../svc/k9/examples/setup-repo.k9.ncl | 103 ---- .../svc/k9/methodology-guard.k9.ncl | 75 --- .machine_readable/svc/k9/template-hunt.k9.ncl | 79 --- .../svc/k9/template-kennel.k9.ncl | 52 -- .machine_readable/svc/k9/template-yard.k9.ncl | 66 --- .tool-versions | 6 +- AFFIRMATION.adoc | 12 +- CITATION.cff | 26 +- CONTRIBUTING.md | 33 ++ Containerfile | 34 +- EXPLAINME.adoc | 18 +- FOUNDATIONS_BRIDGE.adoc | 16 +- FOUNDATION_CONTRACT.adoc | 23 +- GLOSSARY.adoc | 20 +- Justfile | 136 ++--- PROOF-STATUS.adoc | 6 + README.adoc | 25 +- TOPOLOGY.adoc | 10 +- coordination.k9.ncl | 55 ++ .../skepticisms/is-this-just-sigma-types.adoc | 24 +- docs/CLAIMS_AUDIT.adoc | 10 + .../provenance/CLAUDE-audit-provenance.adoc | 12 + .../archive/provenance/CLAUDE.md.audit | 0 docs/audit/2026-11-06-evidence.adoc | 113 ++++ .../2026-11-06-foundation-decisions.adoc | 174 ++++++ docs/audit/2026-11-06-license-inventory.adoc | 109 ++++ .../2026-11-06-repository-readiness.adoc | 173 ++++++ docs/bridges/ECHO-CNO-BRIDGE.adoc | 501 +----------------- docs/build.adoc | 6 + docs/characteristic.adoc | 15 +- docs/echo-types/MAP.adoc | 46 +- .../applications-compiler-analysis.adoc | 6 + .../applications/haplotype-collapsing.adoc | 20 +- ....k9.ncl => haplotype-collapsing.k9.ncl.in} | 12 +- docs/echo-types/comparators.adoc | 29 +- docs/echo-types/earn-back-plan.adoc | 13 +- docs/echo-types/echo-kernel-note.adoc | 20 +- docs/echo-types/establishment-plan.adoc | 20 +- docs/echo-types/overview.adoc | 6 + docs/echo-types/paper.adoc | 348 ++---------- docs/echo-types/sigma-distinctness-map.adoc | 36 +- docs/echo-types/types-abstract.adoc | 282 ++-------- docs/echo-types/variance-resolution.adoc | 233 +------- docs/echo-types/what-echo-is.adoc | 183 +------ docs/foundation.adoc | 207 ++------ docs/gate-1-distinct-phenomenon.adoc | 49 +- docs/proof-debt.adoc | 5 + docs/proof-log/2026-04-28.adoc | 5 + docs/retractions.adoc | 5 + docs/roadmap-gates.adoc | 24 +- echo-types_chora.deed | 42 ++ experimental/echo-additive/STATE.adoc | 34 ++ mise.toml | 61 +-- proofs/agda/All.agda | 10 +- proofs/agda/AuditSmoke.agda | 20 + proofs/agda/Echo/Index/ThinPoset.agda | 53 +- proofs/agda/EchoCNOBridge.agda | 53 +- proofs/agda/EchoCNOSemantics.agda | 120 +++++ proofs/agda/EchoCharacteristic.agda | 16 + proofs/agda/EchoDependentPushforward.agda | 182 +++++++ proofs/agda/EchoErasingGradedComonad.agda | 185 +++++++ proofs/agda/EchoGradedComonadF1.agda | 25 + proofs/agda/EchoGradedComonadInstance1.agda | 29 + proofs/agda/EchoGradedComonadInstance2.agda | 75 +++ proofs/agda/EchoGradedComonadInterface.agda | 30 +- proofs/agda/EchoGradedComonadNaturality.agda | 21 + proofs/agda/EchoHaplotypeCollapsing.agda | 2 +- proofs/agda/EchoNaturalityIndependence.agda | 117 ++++ proofs/agda/EchoNoSectionGeneric.agda | 3 + proofs/agda/EchoResidue.agda | 9 + proofs/agda/EchoResidueCell.agda | 18 +- proofs/agda/EchoReversibilityBridge.agda | 21 +- proofs/agda/EchoSeparating.agda | 97 ++-- proofs/agda/EchoSourcePreserving.agda | 73 +++ proofs/agda/EchoThinPreorderExample.agda | 26 + proofs/agda/EchoTotalCompletion.agda | 2 + proofs/agda/EchoVariance.agda | 135 ++--- proofs/agda/Smoke.agda | 23 + roadmap-gates.adoc | 18 +- roadmap.adoc | 46 +- scripts/check-agda-invocations.py | 42 -- scripts/check-agda-invocations.sh | 51 ++ scripts/check-experimental-aggregate.sh | 40 +- scripts/check-grade3.sh | 2 +- scripts/setup-agda.sh | 79 +++ scripts/test-experimental-aggregate.sh | 36 ++ stapeln.toml | 80 +-- tools/audit-inventory.mjs | 70 +++ tools/check-audit.sh | 42 ++ tools/check-metadata.sh | 90 ++++ wiki/Deniability.adoc | 6 + wiki/Home.adoc | 11 +- wiki/Overview.adoc | 8 +- wiki/Roadmap.adoc | 8 +- 139 files changed, 4138 insertions(+), 3744 deletions(-) create mode 100644 .containerignore create mode 100644 .gitbot-fleet/enrolment.json create mode 100644 .gitbot-fleet/enrolment.json.license create mode 100644 .gitbot-fleet/report-backs/README.md create mode 100644 .github/workflows/metadata.yml create mode 100644 .machine_readable/README.adoc create mode 100644 .machine_readable/contractiles/README.adoc create mode 100644 .machine_readable/contractiles/_base.ncl create mode 100644 .machine_readable/contractiles/adjust/adjust.k9.ncl create mode 100644 .machine_readable/contractiles/adjust/adjust.ncl create mode 100644 .machine_readable/contractiles/bust/bust.k9.ncl create mode 100644 .machine_readable/contractiles/bust/bust.ncl create mode 100644 .machine_readable/contractiles/dust/dust.k9.ncl create mode 100644 .machine_readable/contractiles/dust/dust.ncl create mode 100644 .machine_readable/contractiles/intend/intend.k9.ncl create mode 100644 .machine_readable/contractiles/intend/intend.ncl create mode 100644 .machine_readable/contractiles/must/must.k9.ncl create mode 100644 .machine_readable/contractiles/must/must.ncl create mode 100644 .machine_readable/contractiles/trust/trust.k9.ncl create mode 100644 .machine_readable/contractiles/trust/trust.ncl rename .machine_readable/self-validating/examples/{ci-config.k9.ncl => ci-config.k9.ncl.in} (100%) rename .machine_readable/self-validating/examples/{setup-repo.k9.ncl => setup-repo.k9.ncl.in} (100%) rename .machine_readable/self-validating/{template-hunt.k9.ncl => template-hunt.k9.ncl.in} (100%) rename .machine_readable/self-validating/{template-kennel.k9.ncl => template-kennel.k9.ncl.in} (100%) rename .machine_readable/self-validating/{template-yard.k9.ncl => template-yard.k9.ncl.in} (100%) delete mode 100644 .machine_readable/svc/k9/README.adoc delete mode 100644 .machine_readable/svc/k9/examples/ci-config.k9.ncl delete mode 100644 .machine_readable/svc/k9/examples/project-metadata.k9.ncl delete mode 100644 .machine_readable/svc/k9/examples/setup-repo.k9.ncl delete mode 100644 .machine_readable/svc/k9/methodology-guard.k9.ncl delete mode 100644 .machine_readable/svc/k9/template-hunt.k9.ncl delete mode 100644 .machine_readable/svc/k9/template-kennel.k9.ncl delete mode 100644 .machine_readable/svc/k9/template-yard.k9.ncl create mode 100644 CONTRIBUTING.md create mode 100644 coordination.k9.ncl create mode 100644 docs/archive/provenance/CLAUDE-audit-provenance.adoc rename CLAUDE.md.audit => docs/archive/provenance/CLAUDE.md.audit (100%) create mode 100644 docs/audit/2026-11-06-evidence.adoc create mode 100644 docs/audit/2026-11-06-foundation-decisions.adoc create mode 100644 docs/audit/2026-11-06-license-inventory.adoc create mode 100644 docs/audit/2026-11-06-repository-readiness.adoc rename docs/echo-types/applications/{haplotype-collapsing.k9.ncl => haplotype-collapsing.k9.ncl.in} (88%) create mode 100644 echo-types_chora.deed create mode 100644 proofs/agda/AuditSmoke.agda create mode 100644 proofs/agda/EchoCNOSemantics.agda create mode 100644 proofs/agda/EchoDependentPushforward.agda create mode 100644 proofs/agda/EchoErasingGradedComonad.agda create mode 100644 proofs/agda/EchoGradedComonadNaturality.agda create mode 100644 proofs/agda/EchoNaturalityIndependence.agda create mode 100644 proofs/agda/EchoSourcePreserving.agda create mode 100644 proofs/agda/EchoThinPreorderExample.agda delete mode 100644 scripts/check-agda-invocations.py create mode 100644 scripts/check-agda-invocations.sh create mode 100644 scripts/setup-agda.sh create mode 100644 scripts/test-experimental-aggregate.sh create mode 100644 tools/audit-inventory.mjs create mode 100644 tools/check-audit.sh create mode 100644 tools/check-metadata.sh diff --git a/.containerignore b/.containerignore new file mode 100644 index 00000000..be85558c --- /dev/null +++ b/.containerignore @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: MPL-2.0 +# Exclude local receipts, VCS internals and generated interfaces from build context. +.git +build/audit-* +**/*.agdai +**/_build diff --git a/.gitbot-fleet/enrolment.json b/.gitbot-fleet/enrolment.json new file mode 100644 index 00000000..822fbbb7 --- /dev/null +++ b/.gitbot-fleet/enrolment.json @@ -0,0 +1 @@ +{"reporters":{"accessibilitybot":{"enrolled":false,"reason":"no HTML files or served HTML surface is present"},"cipherbot":{"enrolled":false,"reason":"no cryptographic implementation is present; dependency checksum pins are not crypto implementation evidence"},"echidnabot":{"enrolled":false,"reason":"Agda proofs are present, but no ECHIDNA engine is configured for this producer and the pinned report-back adapter has no engine dispatch"},"finishingbot":{"enrolled":true,"title":"finishingbot (release readiness)"},"glambot":{"enrolled":true,"title":"glambot (presentation quality)"},"panicbot":{"enrolled":false,"reason":"no Cargo.toml or Rust source is present; panic-attack has a separate explicit local recipe"},"rhodibot":{"enrolled":true,"title":"rhodibot (RSR compliance)"},"seambot":{"enrolled":false,"reason":"no seam register is declared (spec/seams/seam-register.json)"},"sustainabot":{"enrolled":false,"reason":"reserved fleet slot; no reporter adapter exists at the pinned fleet revision"}},"schema":1} diff --git a/.gitbot-fleet/enrolment.json.license b/.gitbot-fleet/enrolment.json.license new file mode 100644 index 00000000..130cf460 --- /dev/null +++ b/.gitbot-fleet/enrolment.json.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: MPL-2.0 +SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell diff --git a/.gitbot-fleet/report-backs/README.md b/.gitbot-fleet/report-backs/README.md new file mode 100644 index 00000000..2accd299 --- /dev/null +++ b/.gitbot-fleet/report-backs/README.md @@ -0,0 +1,9 @@ + + +# Fleet report-backs + +This directory intentionally contains no committed report-back JSON. The read-only producer pinned at gitbot-fleet `34908580b98cd354caa3bfc5a000bc7935957fce` writes per-run `.json` envelopes to the `fleet-report-backs` artifact; the consumer renders those envelopes with the checked source revision. + +[../enrolment.json](../enrolment.json) declares applicability, not permission to remediate, commit, push, or certify proofs. Rhodibot, finishingbot, and glambot are enrolled for this Agda/documentation repository. Other members carry explicit reasons for non-enrolment; Agda proofs remain present even though no ECHIDNA engine integration is configured. + +A successful producer job means the report-back driver completed, not that every adapter succeeded or that the repository passed. Missing, failed, or unreadable evidence must retain its reported status. Do not commit generated envelopes or substitute an empty successful report for a missing scan. diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index ac0ed31e..b2bd1a33 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,109 +1,4 @@ -# Contributing to echo-types + + -Thank you for your interest. Echo-types is a constructive Agda -formalisation; contribution discipline reflects the proof-bearing nature -of the codebase. - -## Sign-off - -All commits require Developer Certificate of Origin sign-off: - - git commit -s -m "feat: ..." - -## Branches - -- `main` — protected; only fast-forward from approved PRs. - -- `feat/` — feature branches, squash-merge. - -- `fix/` — bug-fix branches. - -## Pre-merge checklist - -1. `just` `verify` passes (full Agda type-check pass against - `proofs/agda/All.agda` and the test suites). - -2. CHANGELOG.md updated under `[Unreleased]`. - -3. Significant changes are recorded in CHANGELOG.md (item 2). The - former `STATE.a2ml` record was retired on 2026-09-30. - -4. **Banned constructs.** No new `believe_me`, `assert_total`, - `postulate`, `sorry`, `Admitted`, `unsafeCoerce`, or `Obj.magic` - introduced. Estate-wide policy. - -5. **Guardrails are CI-enforced.** All `.agda` files under - `proofs/agda/**` must declare `{-#` `OPTIONS` `--safe` `--without-K` - `#-}` at the top. `tools/check-guardrails.sh` runs at CI time across - every file (regardless of `All.agda` membership) and fails on: - missing `--safe` / `--without-K`, escape pragmas (`TERMINATING`, - `REWRITE`, `NO_POSITIVITY_CHECK`, etc.), `postulate` in code, or - unsafe primitives (`primTrustMe`, `primEraseEquality`, `trustMe`). - The `Exploratory` classification in - `docs/echo-types/echo-kernel-note.adoc` only excuses `All.agda` - membership — it does NOT excuse the guardrail. If you need - postulates for a demo or earn-back-gate consumer, the file must live - outside `proofs/agda/` (no current non-guarded path exists; widening - the guardrail’s allowlist requires a separate design discussion). - -6. **EI-2 discipline.** Per the retired state record, frozen at - - (section `ei-2`), the integration-recipe distinctness investigation is - *terminated negatively* and is not to be reopened. If a change - touches that territory, read that record's `ei-2` section first; the - `forbidden-rebrandings` list is a hard fence. - -7. **Naming traps.** `ModeGraded` (with trailing `d`) is canonical; - never `ModeGrade`. See the frozen record's `naming-traps` section. - -## Reviews - -At least one maintainer review (see MAINTAINERS.adoc). Bridge-module -changes (the cross-system bridges in `proofs/agda/Echo*Bridge*.agda`) -need attention because they fix the load-bearing distinctness story; -flag them for explicit review. - -## Contribution model — Tri-Perimeter Contribution Framework (TPCF) - -echo-types follows the estate-wide **Tri-Perimeter Contribution -Framework (TPCF)** — graduated trust without gatekeeping: - -- **Perimeter 1 — Core Systems (maintainers only).** The proof kernel: - `proofs/agda/Echo.agda`, the identity-claim spine, the bridge modules, - the `All.agda` / `Smoke.agda` wiring, and the guardrail tooling. - Direct commits by maintainers only. - -- **Perimeter 2 — Expert Extensions (trusted contributors).** New proof - modules, decoration instances, and ordinal-track slices. Apply via - issue → review → merge under the relevant `proofs/agda/` path with the - build invariant green. - -- **Perimeter 3 — Community Sandbox (open to all).** Docs (`.adoc`), - tutorial walkthroughs, wiki pages, `.well-known/` content, and spec - proposals. - -### Fork workflow - -External contributors use the standard **fork**-and-pull-request -workflow: fork the repository, branch from `main`, run `just` `validate` -locally (full Agda verify + kernel-guard), and open a PR. Maintainers -(Perimeter 1) may commit directly to feature branches. Every PR must -keep `All.agda` + `Smoke.agda` green under `--safe` `--without-K` and -introduce no banned constructs (see the pre-merge checklist above). - -## Signed commits - -Every commit that reaches the default branch must be signed; a ruleset refuses -unsigned pushes. Estate policy: -[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc). - -- **People and interactive agents** sign with an SSH key registered on GitHub - as a *signing* key (`gpg.format=ssh`, `user.signingkey=.pub`, - `commit.gpgsign=true`). The committer email must be verified on that account. -- **Apps, bots and workflows** never `git push` local commits. They write - through the API (`createCommitOnBranch` or the estate `signed-push` action) - so that GitHub signs each commit. -- Merge PRs with **squash**. The ruleset checks every commit on the PR branch, - not just the result, so one unsigned commit blocks the merge. Re-create such a - branch with signed commits (`git cherry-pick -S`) and open a new PR. - Rebase-merge replays commits unsigned and is disabled. +See the current [contribution guide](../CONTRIBUTING.md) at the repository root. diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml index a719a773..7b66f468 100644 --- a/.github/copilot/coding-agent.yml +++ b/.github/copilot/coding-agent.yml @@ -1,6 +1,6 @@ mcp_servers: boj-server: - command: npx - args: ["-y", "@hyperpolymath/boj-server@latest"] + command: bunx + args: ["--bun", "@hyperpolymath/boj-server@0.4.7"] env: BOJ_URL: http://localhost:7700 diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index a76705e4..90dd67fb 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -4,32 +4,41 @@ version: 'v0.0.3' workflows: '.github/workflows/agda.yml': + - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/cache@v6.1.0' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' '.github/workflows/codeql.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' - 'github/codeql-action@v4.39.1' - '.github/workflows/governance.yml': - - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/governance.yml': [] '.github/workflows/hypatia-scan.yml': - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': - - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/metadata.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/mirror.yml': [] '.github/workflows/pages.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346' - 'actions/deploy-pages@v5.0.1' + - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': + - 'hyperpolymath/smtp-notify-action@e384daf6167a7a7567642d6a62060106244d2413' - 'hyperpolymath/smtp-notify-action@v0.5.1' - '.github/workflows/scorecard.yml': - - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' - '.github/workflows/secret-scanner.yml': - - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': ref: 'v6.1.0' @@ -51,11 +60,21 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346': + ref: 'v5.0.1' + commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' + owner_id: 44036562 + repo_id: 438112499 'actions/deploy-pages@v5.0.1': ref: 'v5.0.1' commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 + 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -66,6 +85,13 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'actions/upload-pages-artifact@v5.0.0': ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' @@ -73,21 +99,6 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': - ref: 'v2.0.5' - commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - owner_id: 42048915 - repo_id: 356423100 - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': - ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - owner_id: 1940490 - repo_id: 260749683 - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': - ref: 'v3.0.0' - commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' - owner_id: 26415196 - repo_id: 297874902 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' @@ -98,50 +109,23 @@ dependencies: commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' owner_id: 9919 repo_id: 259445878 - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': - ref: 'v4.38.0' - commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' - owner_id: 9919 - repo_id: 259445878 'github/codeql-action@v4.39.1': ref: 'v4.39.1' commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' owner_id: 9919 repo_id: 259445878 + 'hyperpolymath/smtp-notify-action@e384daf6167a7a7567642d6a62060106244d2413': + ref: 'v0.5.1' + commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413' + owner_id: 6759885 + repo_id: 1352485172 'hyperpolymath/smtp-notify-action@v0.5.1': ref: 'v0.5.1' commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413' owner_id: 6759885 repo_id: 1352485172 - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': - ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' - commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' - owner_id: 297579217 - repo_id: 1116521501 - uses: - - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: 'v2.4.4' - commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' - owner_id: 67707773 - repo_id: 421101922 - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': - ref: 'v2.2.0' - commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' - owner_id: 108928776 - repo_id: 512644635 - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': - ref: 'v0.10.0' - commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' - owner_id: 135788 - repo_id: 208510314 + 'step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e': + ref: 'v2.14.2' + commit: 'sha1-5ef0c079ce82195b2a36a210272d6b661572d83e' + owner_id: 88700172 + repo_id: 422287306 diff --git a/.github/workflows/agda.yml b/.github/workflows/agda.yml index bf6ccac0..284e01da 100644 --- a/.github/workflows/agda.yml +++ b/.github/workflows/agda.yml @@ -1,228 +1,117 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. -# (MPL-2.0 is automatic legal fallback until PMPL is formally recognised) - name: Agda on: - # Direct pushes only on the integration branches. Feature-branch - # validation is fully covered by the pull_request trigger below — - # gating WIP pushes to no-PR branches with a full multi-minute Agda - # build was the dominant self-inflicted load on the shared estate - # Actions concurrency pool, and also double-fired (push + PR) on PR - # branches. No proof coverage is lost: PRs and post-merge main still - # run the full suite. push: branches: [main, master] pull_request: + workflow_dispatch: -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates don't pile up queued full-suite builds. Safe here — this -# workflow only typechecks (read-only, no publish or mutation). concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: read-all +permissions: + contents: read jobs: check: - runs-on: ubuntu-latest - # Bound the job so a hung typecheck/clone cannot occupy a runner for - # the 6-hour default. Generous upper bound — the warm suite is a few - # minutes; a cold stdlib+suite build is well under this. + runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@v7.0.1 - - # Fast static gate (no Agda): enforce the EchoKernel funext-free - # certificate and that every Echo*.agda is classified in - # docs/echo-types/echo-kernel-note.adoc. Fails the run before the - # multi-minute typecheck if the kernel cone or the note drifts. - - name: Kernel funext-free certificate + classification guard + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Kernel certificate and module classification run: sh scripts/kernel-guard.sh - - - name: Check experimental aggregate covers its direct modules - run: bash scripts/check-experimental-aggregate.sh - - - name: Check Agda invocation profiles (static) - run: python3 scripts/check-agda-invocations.py - - - name: Install Agda and standard library + - name: Experimental aggregate coverage run: | - sudo apt-get update - sudo apt-get install -y agda git - - - name: Record & sanity-check toolchain - run: | - set -e - ver="$(agda --version | head -n1)" - echo "CI Agda: $ver" - echo "Local/flake reproducible Agda is pinned via flake.guix;" - echo "exact-version CI parity (CI-via-flake) is the tracked" - echo "P1 follow-up — see docs/foundation.adoc / proof-debt" - echo "ledger item 'CI Agda pin'. This step makes the version" - echo "VISIBLE and minimally-asserted, not silently floating." - case "$ver" in - *"version 2."*) : ;; - *) echo "::error::unexpected Agda: $ver"; exit 1 ;; - esac - - - name: Foundation guardrail (--safe/--without-K, no pragmas/postulates) + bash scripts/check-experimental-aggregate.sh + bash scripts/test-experimental-aggregate.sh + - name: Agda invocation profiles + run: sh scripts/check-agda-invocations.sh + - name: Foundation guardrail run: bash tools/check-guardrails.sh proofs/agda - - - name: Fetch Agda standard library (v2.3) - id: stdlib - run: | - STDLIB_DIR="$HOME/agda-stdlib" - git clone --depth 1 --branch v2.3 https://github.com/agda/agda-stdlib.git "$STDLIB_DIR" - test "$(git -C "$STDLIB_DIR" rev-parse HEAD)" = 8326c7475af1fa456ca04a0203c168d5d7ff842b - echo "stdlib_dir=$STDLIB_DIR" >> "$GITHUB_OUTPUT" - - - name: Fetch absolute-zero library (PINNED) - id: absz - env: - # Pinned 2026-10-01 (was 3ff5cee7, 2026-05-18) to the known-good revision the suite is - # green against (foundation provenance audit). Bump - # deliberately, never float: an unpinned dependency is an - # unpinned trust boundary. - ABSZ_REF: f486c29903434589117fa0662c6f29b0f17d1d5f - run: | - ABSZ_DIR="$HOME/absolute-zero" - git clone https://github.com/hyperpolymath/absolute-zero.git "$ABSZ_DIR" - git -C "$ABSZ_DIR" checkout --quiet "$ABSZ_REF" - ACTUAL="$(git -C "$ABSZ_DIR" rev-parse HEAD)" - if [ "$ACTUAL" != "$ABSZ_REF" ]; then - echo "::error::absolute-zero pin mismatch: want $ABSZ_REF got $ACTUAL" - exit 1 - fi - echo "absz_commit=$ACTUAL" >> "$GITHUB_OUTPUT" - echo "absz_dir=$ABSZ_DIR" >> "$GITHUB_OUTPUT" - - - name: Register libraries for Agda - run: | - mkdir -p "$HOME/.agda" - - STDLIB_LIB="$RUNNER_TEMP/standard-library.agda-lib" - cat > "$STDLIB_LIB" < "$ABSZ_LIB" < "$HOME/.agda/libraries" - printf '%s\n' "standard-library" > "$HOME/.agda/defaults" - - # Cache Agda interface (.agdai) files. A fresh runner otherwise - # recompiles the entire stdlib subset + the whole proof development - # from scratch every run (the multi-minute cold pass). Agda validates - # each .agdai against its source, so a stale cache is always safe — - # it just means more modules recompile. The key rotates on any proof - # source change or absolute-zero bump; restore-keys give a warm - # partial cache even when it does. - - name: Cache Agda interface files - uses: actions/cache@v6.1.0 + - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries + run: bash scripts/setup-agda.sh + - name: Cache interface files for this compiler and dependency set + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | - ~/agda-stdlib/**/*.agdai - ~/absolute-zero/**/*.agdai + ${{ runner.temp }}/echo-agda/**/*.agdai proofs/agda/**/*.agdai - # Key reflects reality: stdlib v2.3 + the PINNED absz commit - # + source hash. (Previously hard-coded a stale "agda2.6.3"; - # corrected 2026-05-18. The cold-check job below never uses - # this cache, so a cache anomaly cannot mask a real break.) - key: agdai-${{ runner.os }}-stdlib2.3-absz${{ steps.absz.outputs.absz_commit }}-${{ hashFiles('proofs/agda/**/*.agda') }} + key: agdai-${{ runner.os }}-2.7.0.1-stdlib8326c747-abszf486c299-${{ hashFiles('proofs/agda/**/*.agda') }} restore-keys: | - agdai-${{ runner.os }}-stdlib2.3-absz${{ steps.absz.outputs.absz_commit }}- - agdai-${{ runner.os }}-stdlib2.3- - - - name: Typecheck full suite - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda - - - name: Smoke-check headline theorems - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda - - - name: Typecheck characteristic lane (Gate #2 audit modules) - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda - - - name: Typecheck examples lane (Gate #3 canonical examples) - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda - - # Cubical lane: the (epi, mono) truncation discharge. A --cubical - # --safe island (zero postulates) that CONSTRUCTS ∥_∥ as a HIT — - # it cannot be imported by the --safe --without-K All.agda, so it - # is typechecked directly here. Its --without-K-profile shadow is - # EchoImageFactorizationPropPostulated (proof-debt (a)/(c)). - - name: Typecheck cubical lane (epi/mono truncation discharge) - run: agda --safe --cubical -i proofs/agda proofs/agda/EchoImageFactorizationPropCubical.agda - - # Experimental lane: the echo-additive grade tree, typechecked through - # its own aggregate root (--safe --without-K from the pragmas); - # nothing here is imported by All.agda or Smoke.agda, so it adds - # no claim to the shipped closure (D-2026-06-14-R1 firewall, and - # R-2026-05-18 stands). What it does buy: downstream consumers - # that vendor Grade.agda (choreographic-types) learn here, not - # in their own CI, when an edit breaks it. - - name: Typecheck experimental echo-additive lane (standalone, not in the closure) - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/experimental/echo-additive/All.agda - - # A separate entrypoint, not evidence about the shipped closure. - - name: Typecheck bit-narrowing exhibit - run: agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/NarrowingSmoke.agda + agdai-${{ runner.os }}-2.7.0.1-stdlib8326c747-abszf486c299- + - name: Typecheck shipped closure and headlines + run: | + agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda + agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda + agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda + agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda + agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda cold-check: - # Belt-and-braces: NO interface cache, --ignore-interfaces cold - # build. A green here cannot be a stale-.agdai artefact (matters - # given the documented WSL git-object-corruption risk). Runs in - # parallel with `check`; both must pass. - runs-on: ubuntu-latest - # Cold (--ignore-interfaces) build is the slowest path; still well - # under this bound. Caps a runaway/hung job below the 6-hour default. + # A separate runner and no restored interfaces: cached success never + # substitutes for checking the shipped source with the pinned compiler. + runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@v7.0.1 - - - name: Install Agda - run: | - sudo apt-get update - sudo apt-get install -y agda git - - - name: Foundation guardrail - run: bash tools/check-guardrails.sh proofs/agda - - - name: Fetch pinned libraries - id: libs - env: - ABSZ_REF: f486c29903434589117fa0662c6f29b0f17d1d5f - run: | - STDLIB_DIR="$HOME/agda-stdlib" - git clone --depth 1 --branch v2.3 https://github.com/agda/agda-stdlib.git "$STDLIB_DIR" - test "$(git -C "$STDLIB_DIR" rev-parse HEAD)" = 8326c7475af1fa456ca04a0203c168d5d7ff842b - ABSZ_DIR="$HOME/absolute-zero" - git clone https://github.com/hyperpolymath/absolute-zero.git "$ABSZ_DIR" - git -C "$ABSZ_DIR" checkout --quiet "$ABSZ_REF" - test "$(git -C "$ABSZ_DIR" rev-parse HEAD)" = "$ABSZ_REF" - mkdir -p "$HOME/.agda" - printf 'name: standard-library\ninclude: %s/src\n' "$STDLIB_DIR" > "$RUNNER_TEMP/sl.agda-lib" - printf 'name: absolute-zero\ninclude: %s/proofs/agda\n' "$ABSZ_DIR" > "$RUNNER_TEMP/az.agda-lib" - printf '%s\n%s\n' "$RUNNER_TEMP/sl.agda-lib" "$RUNNER_TEMP/az.agda-lib" > "$HOME/.agda/libraries" - printf 'standard-library\n' > "$HOME/.agda/defaults" - - - name: Cold typecheck (--ignore-interfaces, no cache) + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries + run: bash scripts/setup-agda.sh + - name: Cold typecheck shipped closure and headlines run: | agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda + agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda - agda --ignore-interfaces --safe --cubical -i proofs/agda proofs/agda/EchoImageFactorizationPropCubical.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/experimental/echo-additive/All.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/NarrowingSmoke.agda + + experimental: + name: Experimental echo-additive + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries + run: bash scripts/setup-agda.sh + - name: Check experimental aggregate coverage + run: bash scripts/check-experimental-aggregate.sh + - name: Typecheck experimental closure on its own signal + run: agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/experimental/echo-additive/All.agda + + narrowing: + name: Bit-narrowing exhibit + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries + run: bash scripts/setup-agda.sh + - name: Typecheck narrowing closure on its own signal + run: agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/NarrowingSmoke.agda + + cubical: + name: Cubical epi/mono profile + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries + run: bash scripts/setup-agda.sh + - name: Typecheck isolated full-Cubical profile + run: agda --ignore-interfaces --safe --cubical -i proofs/agda proofs/agda/EchoImageFactorizationPropCubical.agda diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c63bcf56..f000bee5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,24 +35,27 @@ jobs: matrix: include: # CodeQL `actions` language scans the GitHub Actions workflow - # files (present in every repo). The repo has no JS/TS source, - # so the prior JS/TS matrix entry recorded zero results / - # failed "no source files"; closes the Hypatia - # `codeql_missing_actions_language` finding. + # files. Agda itself is not a supported CodeQL language; its + # proof safety is checked in the Agda workflow. - language: actions build-mode: none + # The audit inventory now contains actual JavaScript runtime code. + - language: javascript-typescript + build-mode: none steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.39.1 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.39.1 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 25a0e826..1c3826f6 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -23,11 +23,24 @@ permissions: contents: read jobs: + fleet: + permissions: + contents: read + uses: hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml@34908580b98cd354caa3bfc5a000bc7935957fce + with: + enrolment: .gitbot-fleet/enrolment.json + artifact-name: fleet-report-backs + hypatia: name: Hypatia Neurosymbolic Analysis + needs: fleet + # The security scan still runs if the producer fails. Missing report-backs + # remain visible as unavailable evidence in the rendered fleet rows. + if: ${{ always() && !cancelled() }} runs-on: ubuntu-24.04 timeout-minutes: 20 permissions: + actions: read # Download this run's fleet report-back artifact. contents: read security-events: write vulnerability-alerts: read # Dependabot alerts, for Hypatia's DA rules @@ -39,6 +52,8 @@ jobs: with: fetch-depth: 0 persist-credentials: false + # Match the source-ref in the fleet envelopes. + ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Setup Elixir 1.19.4 / OTP 28.3 for Hypatia scanner uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 @@ -108,6 +123,69 @@ jobs: sarif_file: hypatia.sarif category: hypatia + - name: Preserve scanner evidence + if: always() && steps.scan.outcome == 'success' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: hypatia-findings + path: | + hypatia-findings.json + hypatia.sarif + retention-days: 14 + + - name: Fetch the pinned verdict-grid renderer + if: always() + env: + STANDARDS_SHA: ba640e9a57f22608710ffecdca282074eac55a0b + run: | + set -euo pipefail + standards="$RUNNER_TEMP/standards-grid" + git init --quiet "$standards" + git -C "$standards" remote add origin https://github.com/metadatastician/standards.git + git -C "$standards" sparse-checkout init --no-cone + git -C "$standards" sparse-checkout set scripts/verdict-grid.sh scripts/lib/verdict-grid.jq + git -C "$standards" fetch --quiet --depth=1 origin "$STANDARDS_SHA" + git -C "$standards" checkout --quiet --detach FETCH_HEAD + test "$(git -C "$standards" rev-parse HEAD)" = "$STANDARDS_SHA" + + - name: Download this run's fleet report-backs + if: always() + # Canonical consumer behavior: a missing producer artifact leaves + # enrolled rows orange. It never supplies checked-out JSON as evidence. + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: fleet-report-backs + path: ${{ runner.temp }}/fleet-report-backs + + - name: Render Hypatia and fleet evidence together + if: always() + env: + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + PR_NUMBER: ${{ github.event.pull_request.number || 'local' }} + run: | + set -euo pipefail + mkdir -p "$RUNNER_TEMP/fleet-report-backs" + bash "$RUNNER_TEMP/standards-grid/scripts/verdict-grid.sh" render \ + --out "$RUNNER_TEMP/verdict-grid" \ + --hypatia hypatia-findings.json --hypatia-sarif hypatia.sarif \ + --report-backs "$RUNNER_TEMP/fleet-report-backs" \ + --enrolment .gitbot-fleet/enrolment.json \ + --hypatia-ref "$HYPATIA_SHA" \ + --sha "$HEAD_SHA" --run "$GITHUB_RUN_ID" \ + --url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \ + --pr "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" + cat "$RUNNER_TEMP/verdict-grid/report.md" >> "$GITHUB_STEP_SUMMARY" + + - name: Preserve the rendered evidence grid + if: always() + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: hypatia-verdict-grid + path: ${{ runner.temp }}/verdict-grid + if-no-files-found: error + retention-days: 14 + - name: Enforce zero critical Hypatia findings env: CRITICAL_COUNT: ${{ steps.scan.outputs.critical }} @@ -123,6 +201,7 @@ jobs: echo "- Total findings: ${TOTAL_COUNT}" } >> "$GITHUB_STEP_SUMMARY" if [ "$CRITICAL_COUNT" != "0" ]; then + jq -c '.[] | select(.severity == "critical")' hypatia-findings.json echo "::error::Hypatia reported ${CRITICAL_COUNT} critical finding(s)" exit 1 fi diff --git a/.github/workflows/metadata.yml b/.github/workflows/metadata.yml new file mode 100644 index 00000000..7d2779da --- /dev/null +++ b/.github/workflows/metadata.yml @@ -0,0 +1,70 @@ +# SPDX-License-Identifier: MPL-2.0 +name: Metadata contracts + +on: + push: + branches: [main, master] + pull_request: + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + metadata: + name: Deed and K9 contracts + runs-on: ubuntu-24.04 + timeout-minutes: 15 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install checksum-pinned Bun 1.4.4 + run: | + set -euo pipefail + mkdir -p "$RUNNER_TEMP/metadata-bin" + curl --fail --location --retry 3 --proto '=https' \ + --output "$RUNNER_TEMP/bun-linux-x64.zip" \ + https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-x64.zip + printf '%s %s\n' \ + bf8ccbfb2b0b80159e0f9a6d15c55317add8077534dbc6130a3edb52fccb395c \ + "$RUNNER_TEMP/bun-linux-x64.zip" | sha256sum --check --strict - + unzip -q "$RUNNER_TEMP/bun-linux-x64.zip" -d "$RUNNER_TEMP/bun" + install -m 755 "$RUNNER_TEMP/bun/bun-linux-x64/bun" "$RUNNER_TEMP/metadata-bin/bun" + test "$("$RUNNER_TEMP/metadata-bin/bun" --version)" = 1.4.4 + printf '%s\n' "$RUNNER_TEMP/metadata-bin" >> "$GITHUB_PATH" + - name: Install checksum-pinned Nickel 1.18.0 + run: | + set -euo pipefail + mkdir -p "$RUNNER_TEMP/metadata-bin" + curl --fail --location --retry 3 --proto '=https' \ + --output "$RUNNER_TEMP/metadata-bin/nickel" \ + https://github.com/nickel-lang/nickel/releases/download/1.18.0/nickel-x86_64-linux + printf '%s %s\n' \ + 9cba4dd65ae9915ec61f73033aafcff307a377665a83fd8f530df086763318cb \ + "$RUNNER_TEMP/metadata-bin/nickel" | sha256sum --check --strict - + chmod +x "$RUNNER_TEMP/metadata-bin/nickel" + "$RUNNER_TEMP/metadata-bin/nickel" --version + test "$(bun --version)" = 1.4.4 + printf '%s\n' "$RUNNER_TEMP/metadata-bin" >> "$GITHUB_PATH" + - name: Fetch owning standards at the reviewed revision + env: + STANDARDS_SHA: ba640e9a57f22608710ffecdca282074eac55a0b + run: | + set -euo pipefail + standards="$RUNNER_TEMP/echo-standards" + git init --quiet "$standards" + git -C "$standards" remote add origin https://github.com/metadatastician/standards.git + git -C "$standards" fetch --quiet --depth=1 origin "$STANDARDS_SHA" + git -C "$standards" checkout --quiet --detach FETCH_HEAD + test "$(git -C "$standards" rev-parse HEAD)" = "$STANDARDS_SHA" + printf 'ECHO_STANDARDS_DIR=%s\n' "$standards" >> "$GITHUB_ENV" + - name: Validate deed and active K9 contracts + # The metadata checker validates declarations. It does not execute + # declared probes, install Agda, or rely on an Agda job's status. + run: bash tools/check-metadata.sh diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 2371e9b3..f461a822 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -9,8 +9,6 @@ on: workflow_dispatch: permissions: contents: read - pages: write - id-token: write concurrency: group: "pages" cancel-in-progress: false @@ -22,12 +20,16 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Checkout Ddraig SSG - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/ddraig-ssg + ref: c334dab63a25995ed5ce1256e4e633bad21adacd path: .ddraig-ssg + persist-credentials: false - name: Compile Ddraig working-directory: .ddraig-ssg run: idris2 Ddraig.idr -o ddraig @@ -41,10 +43,13 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v5.0.0 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '_site' deploy: + permissions: + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} @@ -54,4 +59,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5.0.1 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index b846a76c..15508481 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -40,8 +40,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Monitor outbound requests before supplying SMTP credentials + uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 + with: + egress-policy: audit - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@v0.5.1 + uses: hyperpolymath/smtp-notify-action@e384daf6167a7a7567642d6a62060106244d2413 # v0.5.1 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 8784f720..89bfb0a8 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -14,13 +14,10 @@ concurrency: cancel-in-progress: true permissions: - actions: read contents: read jobs: scan: permissions: contents: read - pull-requests: write - actions: read uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.gitignore b/.gitignore index 82ca6cd7..7f2a741d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,7 @@ *.agdai _build/ +# Local compiler receipts and import inventories; regenerated by audit tools. +/build/audit-*/ # Ignore personal Claude config but share the SessionStart toolchain hook. .claude/* !.claude/hooks/ diff --git a/.machine_readable/README.adoc b/.machine_readable/README.adoc new file mode 100644 index 00000000..c96d9633 --- /dev/null +++ b/.machine_readable/README.adoc @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += echo-types machine-readable metadata + +The single descriptive record is link:../echo-types_chora.deed[echo-types_chora.deed]. +It records the source-backed `fv` identity, proof boundaries, ecosystem, and +realignment anchor. `0-AI-MANIFEST.deed` and standalone state/anchor records +are not parallel authorities. The retired A2ML history is linked in +link:6a2/README.adoc[the retirement notice]; do not recreate it. + +The normative grammar and K9 contract live in the pinned standards source: +`metadatastician/standards`, revision +`ba640e9a57f22608710ffecdca282074eac55a0b`. +The current template reference is `hyperpolymath/rsr-template-repo`, revision +`acdc0ebd1d69f3f70995f4eec078e342078dd885`. +The registry identity is from `hyperpolymath/gv-clade-index`, revision +`2cfabd15d6cb966ed369ee13aa7174b960f45abd`, `worker/data/repos.json`. +The registry records no assignment date; none is invented here. Its old +ordinal-inclusive description is not adopted as the current project scope. + +== Operational declarations + +`contractiles//.k9.ncl` holds each verb declaration; its adjacent +`.ncl` supplies the canonical schema and run-policy data. Root Just +recipes execute checks. These Nickel records do not implement a contractile +CLI, execute their probe strings, or grant external publication authority. + +`self-validating/` holds one active Kennel metadata example and inert `.in` +templates. The old `svc/k9` mirror was retired rather than maintained twice. +The root `coordination.k9.ncl` is a pure pointer to canonical session protocols. + +== Validation + +[source,bash] +---- +ECHO_STANDARDS_DIR=/path/to/pinned/standards bash tools/check-metadata.sh +---- + +Bun, Nickel and Bash are required. The script checks the standards revision, +runs the current native DEED grammar validator and K9 `--strict` validation, +and rejects retired metadata and identity drift. Missing semantic tooling is +a failure. The frozen Python DEED validator is not used. This validation does +not run declared probes and does not award certification or an assurance grade. diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/agent_instructions/README.adoc index 531fc3aa..2c832633 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/agent_instructions/README.adoc @@ -1,13 +1,8 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= `.machine_readable/agent_instructions/` — retired += Agent instruction pointers -The `.a2ml` records that lived here were removed on 2026-09-30 by owner -ruling: the `.a2ml` surface is retired in favour of `.deed` records. - -The last tree that held them is frozen at -https://github.com/hyperpolymath/echo-types/tree/39a7a99cbe19a918843e9624010510b5fc3b8366/.machine_readable/agent_instructions[commit 39a7a99]. -Read that copy for history; do not recreate `.a2ml` files here. - -Conversion to `.deed` is tracked estate-wide in -https://github.com/hyperpolymath/rsr-template-repo/issues/209[rsr-template-repo#209]. +Read root `CLAUDE.md` for local working rules and `echo-types_chora.deed` for +repository identity and proof-profile boundaries. Session protocol bindings +live in root `coordination.k9.ncl`; their definitions remain in the pinned +standards source. These pointers grant no publication or external mutation +authority. Task-specific user instructions take precedence over template text. diff --git a/.machine_readable/bot_directives/README.adoc b/.machine_readable/bot_directives/README.adoc index 98087d34..d18fdb61 100644 --- a/.machine_readable/bot_directives/README.adoc +++ b/.machine_readable/bot_directives/README.adoc @@ -1,13 +1,7 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= `.machine_readable/bot_directives/` — retired += Bot directive boundary -The `.a2ml` records that lived here were removed on 2026-09-30 by owner -ruling: the `.a2ml` surface is retired in favour of `.deed` records. - -The last tree that held them is frozen at -https://github.com/hyperpolymath/echo-types/tree/39a7a99cbe19a918843e9624010510b5fc3b8366/.machine_readable/bot_directives[commit 39a7a99]. -Read that copy for history; do not recreate `.a2ml` files here. - -Conversion to `.deed` is tracked estate-wide in -https://github.com/hyperpolymath/rsr-template-repo/issues/209[rsr-template-repo#209]. +Repository identity and scope live in root `echo-types_chora.deed`. +Operational obligations live in the contractile declarations. No active +bot-directive record or automation authorization is asserted by this directory. +Follow the current task's explicit authority and the root working rules. diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index 64a00da4..a6da944b 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -1,108 +1,18 @@ -# Echo Types Build and Test System +# SPDX-License-Identifier: MPL-2.0 +# Compatibility entrypoint; the repository root owns execution recipes. +set working-directory := "../.." -# Build all echo type modules -build-echo: - @echo "Building echo type modules..." - agda -i proofs/agda proofs/agda/All.agda - @echo "✅ All echo modules built successfully" - -# Build stability tests -build-tests: - @echo "Building stability tests..." - agda -i proofs/agda proofs/agda/Echo/Bridges/EchoStabilityTests.agda - @echo "✅ Stability tests built successfully" - -# Run comprehensive build -build-all: - @echo "🔨 Building all echo type modules and tests..." - @echo "==========================================" - just build-echo - just build-tests - @echo "==========================================" - @echo "✅ Build complete! All modules type-check successfully" - -test-core: - @echo "Testing core echo type properties..." - agda -i proofs/agda proofs/agda/Echo/Core.agda - @echo "✅ Core tests passed" - -# Test CNO bridge -test-cno: - @echo "Testing CNO bridge..." - agda -i proofs/agda proofs/agda/Echo/Bridges/EchoCNOBridge.agda - @echo "✅ CNO bridge tests passed" - -# Test thermodynamic bridge -test-thermo: - @echo "Testing thermodynamic bridge..." - agda -i proofs/agda proofs/agda/Echo/Bridges/EchoThermodynamics.agda - @echo "✅ Thermodynamic tests passed" - -# Test categorical bridge -test-cat: - @echo "Testing categorical bridge..." - agda -i proofs/agda proofs/agda/Echo/Bridges/EchoCategorical.agda - @echo "✅ Categorical tests passed" - -# Test stability suite -test-stability: - @echo "Testing stability suite..." - agda -i proofs/agda proofs/agda/Echo/Bridges/EchoStabilityTests.agda - @echo "✅ Stability tests passed" - -# Run all tests -test-all: - @echo "🧪 Running comprehensive test suite..." - @echo "==========================================" - just test-core - just test-cno - just test-thermo - just test-cat - just test-stability - @echo "==========================================" - @echo "✅ All tests passed! Stability: 92/100" - -# Clean build artifacts -clean: - @echo "Cleaning build artifacts..." - rm -f proofs/agda/*.agdai - @echo "✅ Clean complete" +default: + @just --justfile Justfile --list -# Full build and test cycle -verify: - @echo "🔬 Full verification cycle..." - @echo "==========================================" - just clean - just build-all - just test-all - @echo "==========================================" - @echo "✅ Verification complete! System stability: 92/100" +build: + just --justfile Justfile build -# Stability report -stability-report: - @echo "📊 Stability Report" - @echo "==========================================" - @echo "Core Echo Types: 98/100 ✅" - @echo "CNO Bridge: 95/100 ✅" - @echo "Thermodynamic Bridge: 90/100 ✅" - @echo "Categorical Bridge: 88/100 ✅" - @echo "Integration: 92/100 ✅" - @echo "==========================================" - @echo "Overall Stability: 92/100 ✅" - @echo "Target Stability: 97/100 🎯" - @echo "==========================================" - @echo "📈 Stability Improvement Plan:" - @echo " 1. Increase test coverage to 100%" - @echo " 2. Add property-based testing" - @echo " 3. Formal verification of key theorems" - @echo " 4. Cross-system verification (Coq/Lean)" - @echo "==========================================" +test: + just --justfile Justfile test -# Enforce the EchoKernel funext-free certificate + classification note -# (static; no Agda needed). CI calls this same recipe. -kernel-guard: - @sh scripts/kernel-guard.sh +guard: + just --justfile Justfile guard -# Default target -default: - just verify +validate: + just --justfile Justfile validate diff --git a/.machine_readable/contractiles/README.adoc b/.machine_readable/contractiles/README.adoc new file mode 100644 index 00000000..0c1d5433 --- /dev/null +++ b/.machine_readable/contractiles/README.adoc @@ -0,0 +1,23 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += echo-types contractile declarations + +Each of `must`, `trust`, `adjust`, `dust`, `bust`, and `intend` has a +`.k9.ncl` declaration and a paired `.ncl` schema/run-policy record. +The schemas and shared `_base.ncl` derive from `rsr-template-repo` +`acdc0ebd1d69f3f70995f4eec078e342078dd885`, adapted to pure evaluation. +The declarations describe this repository's actual proof roots, guard scripts, +metadata checks, retirement history, and next validation work. + +All six components are Yard-level declarations with no subprocess, filesystem +write, or network grant. They have no signature claim. Probe strings name host +commands; evaluating Nickel does not execute them. The historically proposed +contractile CLI is not assumed to exist. The root Justfile owns `build`, `test`, +`guard`, and `validate`; this directory's Justfile only delegates to it. + +Declaration statuses are `declared` until a distinct receipt supports a later +status. `removed` on the two Dust entries describes file retirement, not a +proof assurance score. No measured recovery time is asserted. No fabricated stability scores or inherited template +sign-off dates remain in these declarations. + +Validate grammar and K9 semantics with `bash tools/check-metadata.sh` from the +repository root. Run the named root recipes separately to discharge obligations. diff --git a/.machine_readable/contractiles/_base.ncl b/.machine_readable/contractiles/_base.ncl new file mode 100644 index 00000000..85b756b5 --- /dev/null +++ b/.machine_readable/contractiles/_base.ncl @@ -0,0 +1,140 @@ +# SPDX-License-Identifier: MPL-2.0 +# +# _base.ncl — Shared contractile base +# +# Provides four named schema fragments imported by every verb runner: +# +# pedigree_schema — canonical pedigree block shape +# status_core_doc — documentation of the shared status trio (String list) +# probe_schema — target structured probe form (spec only; verb files +# still use probe | String with TODO comments) +# run_defaults — default runner behaviour +# +# Usage in a verb runner: +# +# let base = import "../_base.ncl" in +# { +# pedigree = base.pedigree_schema & { +# contractile_verb = "must", +# semantics = "invariant", +# security = { +# leash = 'Kennel, +# trust_level = "read-only verification", +# allow_network = false, +# allow_filesystem_write = false, +# allow_subprocess = true, +# }, +# metadata = { +# name = "must-runner", +# version = "1.0.0", +# description = "...", +# paired_xfile = "must.k9.ncl#declaration", +# author = "Jonathan D.A. Jewell ", +# }, +# }, +# schema = { ... }, +# run = base.run_defaults & { on_any_fail = "exit-nonzero" }, +# } +# +# See: docs/CONTRACTILE-SPEC.adoc §Shared Base +{ + # ------------------------------------------------------------------------- + # pedigree_schema + # + # The canonical shape of the `pedigree` block required in every verb runner. + # Verb runners merge this with their verb-specific values using Nickel's `&` + # (right-priority merge). Override contractile_verb, semantics, security.*, + # and metadata.* in each verb. + # ------------------------------------------------------------------------- + pedigree_schema = { + schema_version | String | default = "1.0.0", + contractile_verb | String | default = "UNSET", # MUST override in verb + semantics | String | default = "UNSET", # MUST override in verb + security = { + leash | [| 'Kennel, 'Yard, 'Hunt |] | default = 'Kennel, + trust_level | String | default = "UNSET", # MUST override in verb + allow_network | Bool | default = false, + allow_filesystem_write | Bool | default = false, + allow_subprocess | Bool | default = false, + # verb-specific additional security fields go in the verb's merge override: + # e.g. authorised_probes_only (trust), injection_scope (bust), + # destructive_mode_requires_flag (dust) + }, + metadata = { + name | String | default = "UNSET", # MUST override in verb + version | String | default = "1.0.0", + description | String | default = "UNSET", # MUST override in verb + paired_xfile | String | default = "UNSET", # MUST override in verb + author | String | default = "Jonathan D.A. Jewell ", + }, + }, + + # ------------------------------------------------------------------------- + # status_core_doc + # + # Documents the minimum shared status values present in every verb's status + # enum: declared, verified, failing. + # + # Nickel does not support structural enum extension, so verb files reproduce + # their full enum verbatim in `schema`. This field serves as documentation + # and for tooling that introspects the base. + # + # Verbs that extend status_core (i.e. all except must + trust): + # adjust: + 'partial + # bust: + 'drilled + # dust: 'declared, 'proposed, 'approved, 'removed (non-standard) + # intend: intents: 'declared, 'in_progress, 'done, 'deferred, 'retired + # wishes: 'declared, 'in_progress, 'achieved, 'abandoned + # (the wishes schema was absorbed from the deprecated `lust` + # verb 2026-04-18; lust/ dir removed estate-wide) + # + # See: docs/CONTRACTILE-SPEC.adoc §Per-Verb Extension + # ------------------------------------------------------------------------- + status_core_doc = "status_core values: declared | verified | failing — extended per verb", + + # ------------------------------------------------------------------------- + # probe_schema + # + # The TARGET structured probe form. See: docs/CONTRACTILE-SPEC.adoc §Probe + # + # IMPORTANT: This is a spec-only definition. Existing verb runner files still + # use `probe | String` with a `# TODO: migrate to probe_schema` comment. + # This is a breaking change; migration happens when the CLI supports both + # forms. + # + # Adopters writing new xfiles should prefer the structured form: + # probe = { + # command = "test -f my-file", + # timeout_seconds = 60, + # allowed_exit_codes = [0], + # permission_class = 'read_only, + # } + # ------------------------------------------------------------------------- + probe_schema = { + command | String, + timeout_seconds | Number | default = 300, + allowed_exit_codes | Array Number | default = [0], + permission_class + | [| 'read_only, 'filesystem_write, 'subprocess, 'network |] + | default + = 'read_only, + }, + + # ------------------------------------------------------------------------- + # run_defaults + # + # Default runner behaviour. Verb runners merge this with verb-specific + # overrides using Nickel's `&` (right-priority merge). + # + # Most verbs override on_any_fail: + # "exit-nonzero" : hard gate (must, trust, bust, adjust-gating) + # "continue-with-warnings": advisory (dust, adjust) + # "continue" : never gate (intend — covers both intents and wishes) + # ------------------------------------------------------------------------- + run_defaults = { + on_pass = "continue", + on_any_fail = "exit-nonzero", + report_format = "json", + emit_summary = true, + }, +} diff --git a/.machine_readable/contractiles/adjust/adjust.k9.ncl b/.machine_readable/contractiles/adjust/adjust.k9.ncl new file mode 100644 index 00000000..0cce34de --- /dev/null +++ b/.machine_readable/contractiles/adjust/adjust.k9.ncl @@ -0,0 +1,52 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:adjust", + contractile_verb = "adjust", + side_effects = [ + ], + metadata = { + name = "echo-types-adjust", + version = "1.0.0", + description = "Pure adjust declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "adjust.k9.ncl#declaration", + paired_runner = "adjust.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "adjust.ncl", + declaration = "adjust.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + requirements = [ + { + id = "proof-drift", + description = "Proof-root membership changes require inventory refresh and all root checks.", + probe = "just audit-inventory && just test", + status = 'declared, + notes = "Zero tolerance for silently changing the ordinary theory profile." + }, + { + id = "metadata-drift", + description = "A standards revision change requires review, pin update and semantic validation.", + probe = "bash tools/check-metadata.sh", + status = 'declared, + notes = "Declare adoption only after the new gates actually run." + } + ] + } +} diff --git a/.machine_readable/contractiles/adjust/adjust.ncl b/.machine_readable/contractiles/adjust/adjust.ncl new file mode 100644 index 00000000..811e2042 --- /dev/null +++ b/.machine_readable/contractiles/adjust/adjust.ncl @@ -0,0 +1,54 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical adjust schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "adjust", + semantics = "accessibility compliance", + security = { + leash = 'Kennel, + trust_level = "fixes allowed where deterministic", + allow_network = false, + allow_filesystem_write = true, # `adjust fix` may write (deterministic patches only) + allow_subprocess = false, + }, + metadata = { + name = "adjust-runner", + version = "1.0.0", + description = "Evaluates accessibility requirements from the adjust.k9.ncl declaration. Fixes deterministic items; flags the rest for human review.", + paired_xfile = "adjust.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + requirements + | Array { + id | String, + description | String, + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String, + # status_core values: 'declared, 'verified, 'failing; adjust adds 'partial + status | [| 'declared, 'partial, 'verified, 'failing |] | default = 'declared, + compliance | String | optional, # e.g. "WCAG 2.1 AA" + notes | String | optional, + fix | String | optional, # deterministic fix command (optional) + }, + }, + + # Runner behaviour — inherits from base.run_defaults. + # adjust is advisory (continue-with-warnings) not a hard gate. + # auto_fix_when_available is adjust-specific. + run = + base.run_defaults + & { + on_any_fail = "continue-with-warnings", # accessibility is progress-tracked, not a hard gate by default + report_format = "json", + emit_summary = true, + auto_fix_when_available = false, + }, +} diff --git a/.machine_readable/contractiles/bust/bust.k9.ncl b/.machine_readable/contractiles/bust/bust.k9.ncl new file mode 100644 index 00000000..039eb8dd --- /dev/null +++ b/.machine_readable/contractiles/bust/bust.k9.ncl @@ -0,0 +1,47 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:bust", + contractile_verb = "bust", + side_effects = [ + ], + metadata = { + name = "echo-types-bust", + version = "1.0.0", + description = "Pure bust declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "bust.k9.ncl#declaration", + paired_runner = "bust.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "bust.ncl", + declaration = "bust.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + failure_modes = [ + { + id = "missing-validator", + description = "Missing standards or Nickel fails validation rather than becoming a pass.", + class = 'panic, + injection_probe = "ECHO_STANDARDS_DIR=/nonexistent bash tools/check-metadata.sh", + recovery_probe = "bash tools/check-metadata.sh", + status = 'declared, + notes = "Declared negative control; no recovery duration is asserted." + } + ] + } +} diff --git a/.machine_readable/contractiles/bust/bust.ncl b/.machine_readable/contractiles/bust/bust.ncl new file mode 100644 index 00000000..a11df2e8 --- /dev/null +++ b/.machine_readable/contractiles/bust/bust.ncl @@ -0,0 +1,56 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical bust schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "bust", + semantics = "error handling + failure recovery", + security = { + leash = 'Kennel, + trust_level = "controlled failure injection; scoped to system-under-test", + allow_network = false, + allow_filesystem_write = true, # drills may write transient state (tmp dirs, test DBs) + allow_subprocess = false, + injection_scope = "system-under-test-only", + }, + metadata = { + name = "bust-runner", + version = "1.0.0", + description = "Exercises declared failure modes and verifies recovery paths. Hard-gates on any failure mode without working recovery.", + paired_xfile = "bust.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + failure_modes + | Array { + id | String, + description | String, + class | [| 'network, 'disk_full, 'oom, 'timeout, 'partial_write, 'panic, 'crash, 'rollback, 'concurrency |], + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + injection_probe | String, # command that deterministically causes this failure + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + recovery_probe | String, # command that verifies recovery (exit 0 = recovered) + expected_recovery_time_seconds | Number | default = 30, + # status_core values: 'declared, 'verified, 'failing; bust adds 'drilled + status | [| 'declared, 'drilled, 'verified, 'failing |] | default = 'declared, + notes | String | optional, + }, + }, + + # Runner behaviour — inherits from base.run_defaults. + # bust adds record_recovery_times for performance tier feeding. + run = + base.run_defaults + & { + on_any_fail = "exit-nonzero", # missing or broken recovery blocks merge + report_format = "json", + emit_summary = true, + record_recovery_times = true, # feeds the performance tier + }, +} diff --git a/.machine_readable/contractiles/dust/dust.k9.ncl b/.machine_readable/contractiles/dust/dust.k9.ncl new file mode 100644 index 00000000..64263b50 --- /dev/null +++ b/.machine_readable/contractiles/dust/dust.k9.ncl @@ -0,0 +1,56 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:dust", + contractile_verb = "dust", + side_effects = [ + ], + metadata = { + name = "echo-types-dust", + version = "1.0.0", + description = "Pure dust declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "dust.k9.ncl#declaration", + paired_runner = "dust.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "dust.ncl", + declaration = "dust.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + removal_candidates = [ + { + id = "retired-a2ml", + description = "Keep retired A2ML records absent.", + target = ".machine_readable/6a2/*.a2ml", + reason = "Owner retirement on 2026-09-30; successor descriptions live in the root chora.", + probe = "bash tools/check-metadata.sh", + status = 'removed, + notes = "History remains at Git tree 39a7a99cbe19a918843e9624010510b5fc3b8366." + }, + { + id = "duplicate-k9-mirror", + description = "Retire files from the duplicate svc/k9 mirror.", + target = ".machine_readable/svc/k9/", + reason = "One active self-validating tree prevents mirror drift.", + probe = "bash tools/check-metadata.sh", + status = 'removed, + notes = "Empty untracked directories may remain on Windows; prior files remain in Git history." + } + ] + } +} diff --git a/.machine_readable/contractiles/dust/dust.ncl b/.machine_readable/contractiles/dust/dust.ncl new file mode 100644 index 00000000..37d9e65d --- /dev/null +++ b/.machine_readable/contractiles/dust/dust.ncl @@ -0,0 +1,56 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical dust schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "dust", + semantics = "exnovation / removal", + security = { + leash = 'Kennel, + trust_level = "proposes deletion; --apply required to execute", + allow_network = false, + allow_filesystem_write = true, # --apply mode writes (deletes) + allow_subprocess = false, + destructive_mode_requires_flag = "--apply", + }, + metadata = { + name = "dust-runner", + version = "1.0.0", + description = "Identifies and optionally removes exnovation targets listed in the dust.k9.ncl declaration. Destructive mode gated behind --apply.", + paired_xfile = "dust.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + removal_candidates + | Array { + id | String, + description | String, + target | String, # file / path / symbol / dep name + reason | String, # why it's a removal candidate + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String | optional, # command that confirms it's still removable + # dust has a non-standard status progression (no 'verified): + # 'declared → 'proposed → 'approved → 'removed + status | [| 'declared, 'proposed, 'approved, 'removed |] | default = 'declared, + approver | String | optional, # who signed off (for 'approved / 'removed) + notes | String | optional, + }, + }, + + # Runner behaviour — inherits from base.run_defaults. + # dust is advisory; apply_requires_approval is dust-specific. + run = + base.run_defaults + & { + on_any_fail = "continue-with-warnings", + report_format = "json", + emit_summary = true, + apply_requires_approval = true, # only 'approved items get swept, even with --apply + }, +} diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl new file mode 100644 index 00000000..b086f5df --- /dev/null +++ b/.machine_readable/contractiles/intend/intend.k9.ncl @@ -0,0 +1,52 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:intend", + contractile_verb = "intend", + side_effects = [ + ], + metadata = { + name = "echo-types-intend", + version = "1.0.0", + description = "Pure intend declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "intend.k9.ncl#declaration", + paired_runner = "intend.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "intend.ncl", + declaration = "intend.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + intents = [ + { + id = "metadata-reconciliation", + description = "Collect canonical grammar and semantic validator receipts.", + probe = "bash tools/check-metadata.sh", + status = 'declared + }, + { + id = "proof-receipts", + description = "Keep proof roots and assumption boundaries independently reviewable.", + probe = "just test", + status = 'declared + } + ], + wishes = [ + ] + } +} diff --git a/.machine_readable/contractiles/intend/intend.ncl b/.machine_readable/contractiles/intend/intend.ncl new file mode 100644 index 00000000..fa10263e --- /dev/null +++ b/.machine_readable/contractiles/intend/intend.ncl @@ -0,0 +1,65 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical intend schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "intend", + semantics = "north-star (commitments + aspirations)", + security = { + leash = 'Kennel, + trust_level = "read-only reporting", + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, # probe commands may shell out (intents only; wishes never probe) + }, + metadata = { + name = "intend-runner", + version = "2.0.0", + description = "Reports progress toward committed next-actions and lists horizon aspirations. Non-gating. Absorbed `lust` semantics 2026-04-18.", + paired_xfile = "intend.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + intents + | Array { + id | String, + description | String, + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String | optional, # shell command that indicates done-ness + status | [| 'declared, 'in_progress, 'done, 'deferred, 'retired |] | default = 'declared, + notes | String | optional, + target_date | String | optional, + }, + wishes + | Array { + id | String, + description | String, + horizon | [| 'near, 'mid, 'far |] | default = 'mid, + why | String | optional, + status | [| 'declared, 'in_progress, 'achieved, 'abandoned |] | default = 'declared, + notes | String | optional, + } + | optional, + }, + + # Runner behaviour — inherits from base.run_defaults. + # intend never blocks; it is a report only. + # emit_diff is intent-specific (declared vs observed probes). + # emit_grouped_by_horizon renders wishes grouped by near/mid/far. + run = + base.run_defaults + & { + on_pass = "continue", + on_any_fail = "continue", # never blocks; it's a report + report_format = "json", + emit_summary = true, + emit_diff = true, # declared vs observed (intents) + emit_grouped_by_horizon = true, # wishes grouped by horizon (absorbed from lust) + }, +} diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl new file mode 100644 index 00000000..36957f9f --- /dev/null +++ b/.machine_readable/contractiles/must/must.k9.ncl @@ -0,0 +1,66 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:must", + contractile_verb = "must", + side_effects = [ + ], + metadata = { + name = "echo-types-must", + version = "1.0.0", + description = "Pure must declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "must.k9.ncl#declaration", + paired_runner = "must.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "must.ncl", + declaration = "must.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + invariants = [ + { + id = "ordinary-root", + description = "Ordinary aggregate checks under its declared safe, without-K profile.", + probe = "just build", + status = 'declared, + severity = 'critical + }, + { + id = "proof-roots", + description = "Check declared proof roots separately with captured results.", + probe = "just test", + status = 'declared, + severity = 'critical + }, + { + id = "guards", + description = "Kernel, invocation and aggregate profile guards pass.", + probe = "just guard", + status = 'declared, + severity = 'critical + }, + { + id = "metadata", + description = "DEED grammar and K9 semantic validation pass against pinned standards.", + probe = "bash tools/check-metadata.sh", + status = 'declared, + severity = 'high + } + ] + } +} diff --git a/.machine_readable/contractiles/must/must.ncl b/.machine_readable/contractiles/must/must.ncl new file mode 100644 index 00000000..f1bc6e24 --- /dev/null +++ b/.machine_readable/contractiles/must/must.ncl @@ -0,0 +1,54 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical must schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "must", + semantics = "invariant", + security = { + leash = 'Kennel, + trust_level = "read-only verification", + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, # verification probes may shell out (e.g. grep, test -f) + }, + metadata = { + name = "must-runner", + version = "1.0.0", + description = "Evaluates every invariant in the adjacent must.k9.ncl declaration as a hard gate.", + paired_xfile = "must.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + # Contract schema — the shape every must declaration (must.k9.ncl `declaration`) targets. + # Used by `contractile must typecheck`. + schema = { + invariants + | Array { + id | String, + description | String, + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String, # shell command; exit 0 = pass + # status_core values: 'declared, 'verified, 'failing + status | [| 'declared, 'verified, 'failing |] | default = 'declared, + severity | [| 'critical, 'high, 'medium |] | default = 'critical, + notes | String | optional, + fix | String | optional, + }, + }, + + # Runner behaviour — consumed by the contractile CLI dispatcher. + # Inherits from base.run_defaults; on_any_fail is the hard-gate default. + run = + base.run_defaults + & { + on_any_fail = "exit-nonzero", # hard gate + report_format = "json", + emit_summary = true, + }, +} diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl new file mode 100644 index 00000000..38dc029c --- /dev/null +++ b/.machine_readable/contractiles/trust/trust.k9.ncl @@ -0,0 +1,56 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Pure declaration; no execution, side effects or signature claim. +{ + pedigree = { + schema_version = "1.0.0", + component_type = "contractile:trust", + contractile_verb = "trust", + side_effects = [ + ], + metadata = { + name = "echo-types-trust", + version = "1.0.0", + description = "Pure trust declaration for echo-types; explicit host actions discharge probes.", + paired_xfile = "trust.k9.ncl#declaration", + paired_runner = "trust.ncl" + }, + security = { + leash = 'Yard, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false + }, + capabilities = [ + ], + trident = { + cardinality = "one per repository", + runner = "trust.ncl", + declaration = "trust.k9.ncl#declaration", + authority = "declaration; root recipes provide execution and receipts" + } + }, + declaration = { + verifications = [ + { + id = "assumption-boundary", + description = "Full-Cubical and postulated roots stay separate from the ordinary aggregate.", + probe = "just guard", + status = 'declared + }, + { + id = "registry-identity", + description = "Use recorded fv identity without inventing identifiers or dates.", + probe = "bash tools/check-metadata.sh", + status = 'declared + }, + { + id = "no-execution-claim", + description = "Metadata validation never executes embedded probe strings.", + probe = "bash tools/check-metadata.sh", + status = 'declared + } + ] + } +} diff --git a/.machine_readable/contractiles/trust/trust.ncl b/.machine_readable/contractiles/trust/trust.ncl new file mode 100644 index 00000000..5af77b88 --- /dev/null +++ b/.machine_readable/contractiles/trust/trust.ncl @@ -0,0 +1,81 @@ +# SPDX-License-Identifier: MPL-2.0 +# Canonical trust schema/run-policy data adapted for echo-types. +# This expression does not execute probes; root recipes execute checks. +let base = import "../_base.ncl" in + +{ + pedigree = + base.pedigree_schema + & { + contractile_verb = "trust", + semantics = "security + provenance + safe-hacking", + security = { + leash = 'Kennel, + trust_level = "verification + authorised-probe", + allow_network = false, # verifications are offline by default + allow_filesystem_write = false, # trust writes NOTHING + allow_subprocess = false, + authorised_probes_only = true, # probe section must explicitly list allowed targets + }, + metadata = { + name = "trust-runner", + version = "1.0.0", + description = "Security + provenance verifications plus authorised safe-hacking probes. All probes are scoped to the repo under test; never hits external systems.", + paired_xfile = "trust.k9.ncl#declaration", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + verifications + | Array { + id | String, + description | String, + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String, # read-only; exit 0 = pass + # status_core values: 'declared, 'verified, 'failing + status | [| 'declared, 'verified, 'failing |] | default = 'declared, + # trust uses all four severity levels (from base.severity_core) + severity | [| 'critical, 'high, 'medium, 'low |] | default = 'high, + notes | String | optional, + }, + + # Safe-hacking + testing section (added 2026-04-17 per user direction). + # Each probe here is an ACTIVELY EXECUTED test — fuzz runs, chaos probes, + # auth-bypass attempts, injection tests. All scoped to the current repo. + safe_hacking + | { + scope | String, # e.g. "this-repo-only" / "localhost" + allowed_probe_classes + | Array [| 'fuzz, 'property_test, 'chaos, 'auth_bypass, 'injection, 'timing |] + | default + = [], + probes + | Array { + id | String, + class | [| 'fuzz, 'property_test, 'chaos, 'auth_bypass, 'injection, 'timing |], + description | String, + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + probe | String, # command to run the probe + expected_outcome | [| 'probe_blocks_attempt, 'probe_finds_no_issue |], + timeout_seconds | Number | default = 300, + notes | String | optional, + } + | default + = [], + } + | default + = { scope = "this-repo-only", allowed_probe_classes = [], probes = [] }, + }, + + # Runner behaviour — inherits from base.run_defaults. + # trust has an extra field for unexpected safe-hacking outcomes. + run = + base.run_defaults + & { + on_any_fail = "exit-nonzero", # hard gate on verifications + safe_hacking_on_unexpected_outcome = "exit-nonzero", # probe found what it shouldn't = block + report_format = "json", + emit_summary = true, + }, +} diff --git a/.machine_readable/integrations/README.adoc b/.machine_readable/integrations/README.adoc index bd015397..568d707e 100644 --- a/.machine_readable/integrations/README.adoc +++ b/.machine_readable/integrations/README.adoc @@ -1,13 +1,8 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= `.machine_readable/integrations/` — retired += Integration pointers -The `.a2ml` records that lived here were removed on 2026-09-30 by owner -ruling: the `.a2ml` surface is retired in favour of `.deed` records. - -The last tree that held them is frozen at -https://github.com/hyperpolymath/echo-types/tree/39a7a99cbe19a918843e9624010510b5fc3b8366/.machine_readable/integrations[commit 39a7a99]. -Read that copy for history; do not recreate `.a2ml` files here. - -Conversion to `.deed` is tracked estate-wide in -https://github.com/hyperpolymath/rsr-template-repo/issues/209[rsr-template-repo#209]. +Root `echo-types_chora.deed` records the source-backed ecosystem relationships. +`absolute-zero` supplies CNO definitions; `EchoTypes.jl` is an executable +finite-domain companion. The ordinal lane is maintained separately in +`ordinal-notation`; no ordinal work is authorized by these metadata records. +No connector, credential, deployed service, or external write access is implied. diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index efa51790..fb0c865a 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -1,3 +1,10 @@ .hypatia-ignore CLAUDE.md build/ # build orchestration: guix.scm relocated here (canon 1.2.1 guix-primary template_ref = "build/") + +echo-types_chora.deed + +coordination.k9.ncl + +.gitbot-fleet/ # explicit report-back enrollment; no bot mutation authority +.containerignore # local-only build outputs excluded from the carrier context diff --git a/.machine_readable/self-validating/README.adoc b/.machine_readable/self-validating/README.adoc index 1583b3be..a9c4da00 100644 --- a/.machine_readable/self-validating/README.adoc +++ b/.machine_readable/self-validating/README.adoc @@ -1,186 +1,20 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) Jonathan D.A. Jewell -= K9 Contractiles — echo-types -:toc: left -:icons: font += echo-types K9 components and source templates -This is echo-types' copy of the shared estate k9 template set -(reference: nextgen-typing / maa-framework `.machine_readable/self-validating/`), -adapted only in repo-identity fields. The examples point at this repo's -real validation targets: `agda -i proofs/agda proofs/agda/All.agda` -(full suite), `agda -i proofs/agda proofs/agda/Smoke.agda` (headline -pins), `scripts/kernel-guard.sh` and `tools/check-guardrails.sh` -(guardrails). Added at the 2026-06-12 governance checkpoint. +`examples/project-metadata.k9.ncl` is an active Kennel data component. Its +`fv` identity and UUID8 come from gv-clade-index revision +`2cfabd15d6cb966ed369ee13aa7174b960f45abd`; its version describes the metadata +component, not a claimed project release. -== What Are K9 Contractiles? +Files ending `.k9.ncl.in` are inert templates. They are not installed K9 +components, are never executed, and are excluded from active-component checks. +In particular the unsigned Hunt setup example remains an uninstantiated +example. Do not treat its signature placeholders as signatures or copy it to +an active component without satisfying the current K9 contract. -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. +Active operational declarations live in `../contractiles/`; their probes +refer to real root recipes. The old duplicate `svc/k9` mirror is retired. -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp .machine_readable/self-validating/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp .machine_readable/self-validating/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp .machine_readable/self-validating/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.a2ml**:: K9 components can generate or validate STATE.a2ml -**ECOSYSTEM.a2ml**:: K9 can automate cross-repo operations -**META.a2ml**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/k9-svc/blob/main/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/k9-svc.git ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/k9-svc/blob/main/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/k9-svc/blob/main/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/k9-svc/blob/main/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/k9-svc +The normative source is standards `1-formats/k9/spec/K9-CONTRACT-SPEC.adoc` +and `spec/contract/k9_contract.ncl`, pinned by `tools/check-metadata.sh`. +Run that script from the repository root with Bun and Nickel available. diff --git a/.machine_readable/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl.in similarity index 100% rename from .machine_readable/self-validating/examples/ci-config.k9.ncl rename to .machine_readable/self-validating/examples/ci-config.k9.ncl.in diff --git a/.machine_readable/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl index 19ffdd49..4f03034d 100644 --- a/.machine_readable/self-validating/examples/project-metadata.k9.ncl +++ b/.machine_readable/self-validating/examples/project-metadata.k9.ncl @@ -1,60 +1,33 @@ K9! # SPDX-License-Identifier: MPL-2.0 -# Example Kennel-level K9 component: Project metadata -# Security Level: Kennel (pure data, no execution) -# No signature required - { pedigree = { schema_version = "1.0.0", component_type = "project-metadata", + metadata = { + name = "echo-types-project-metadata", + version = "1.0.0", + description = "Source-true identity; project release version deliberately omitted." + }, security = { leash = 'Kennel, - trust_level = "data-only", allow_network = false, allow_filesystem_write = false, allow_subprocess = false, + signature_required = false }, - metadata = { - name = "project-metadata", - version = "1.0.0", - description = "Pure data configuration for project metadata", - author = "Jonathan D.A. Jewell ", - }, + capabilities = [ + ] }, - - # Project configuration project = { name = "echo-types", - version = "0.1.0", - description = "Constructive Agda formalization of fiber-based structured loss (echo types)", - - repository = { - url = "https://github.com/hyperpolymath/echo-types", - type = "git", - }, - - author = { - name = "Jonathan D.A. Jewell", - email = "j.d.a.jewell@open.ac.uk", - organization = "hyperpolymath", - }, - - license = "MPL-2.0", - - keywords = [ - "agda", - "formal-verification", - "echo-types", - "rhodium-standard", - "rsr", - "hyperpolymath", - ], - }, - - # Export as JSON for other tools - export = { - format = "json", - destination = "project-metadata.json", - }, + repository = "https://github.com/hyperpolymath/echo-types", + clade = "fv", + prefixed_name = "fv-echo-types", + uuid_v8 = "081ce0dd-51b8-80de-916a-f4593d7bbfbd", + identity_source = "gv-clade-index@2cfabd15d6cb966ed369ee13aa7174b960f45abd:worker/data/repos.json", + description = "Constructive Agda formalization of fiber-based structured loss.", + code_license = "MPL-2.0", + documentation_license = "Per-file notices; see docs/audit/2026-11-06-license-inventory.adoc" + } } diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl.in similarity index 100% rename from .machine_readable/self-validating/examples/setup-repo.k9.ncl rename to .machine_readable/self-validating/examples/setup-repo.k9.ncl.in diff --git a/.machine_readable/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl.in similarity index 100% rename from .machine_readable/self-validating/template-hunt.k9.ncl rename to .machine_readable/self-validating/template-hunt.k9.ncl.in diff --git a/.machine_readable/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl.in similarity index 100% rename from .machine_readable/self-validating/template-kennel.k9.ncl rename to .machine_readable/self-validating/template-kennel.k9.ncl.in diff --git a/.machine_readable/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl.in similarity index 100% rename from .machine_readable/self-validating/template-yard.k9.ncl rename to .machine_readable/self-validating/template-yard.k9.ncl.in diff --git a/.machine_readable/svc/k9/README.adoc b/.machine_readable/svc/k9/README.adoc deleted file mode 100644 index c156ebaa..00000000 --- a/.machine_readable/svc/k9/README.adoc +++ /dev/null @@ -1,72 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= K9 Contractiles (echo-types) -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, -validation, and deployment logic in a single Nickel file. They implement the -RSR principle of "self-describing artifacts" by embedding contracts and -orchestration directly in the component. echo-types uses them for repository -self-validation against the `--safe --without-K` zero-postulate proof -discipline. - -== The Three Security Levels ("The Leash") - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Components in this directory - -[cols="1,3"] -|=== -| File | Purpose - -| `methodology-guard.k9.ncl` -| The echo-types-specific guard: enforces `--safe --without-K`, the zero - postulate ceiling (outside the Ordinal track), the believe_me / sorry / - Admitted / unsafeCoerce / Obj.magic ban, Smoke-pin + All-wiring coverage, - and the funext-free kernel cone via `scripts/kernel-guard.sh`. - -| `examples/project-metadata.k9.ncl` -| Kennel-level echo-types project metadata (name, version target, license, - the three workstreams). - -| `examples/ci-config.k9.ncl` -| Yard-level CI shape mirroring `.github/workflows/agda.yml` (Agda + stdlib - versions, the All.agda / Smoke.agda / kernel-guard gate). - -| `examples/setup-repo.k9.ncl` -| Hunt-level toolchain bootstrap (Agda >= 2.6.3 + stdlib v2.3 from source). - -| `template-kennel.k9.ncl` / `template-yard.k9.ncl` / `template-hunt.k9.ncl` -| Starting-point templates for new components at each leash level. -|=== - -== Validate / run - -[source,sh] ----- -# Kennel: export as JSON -nickel export examples/project-metadata.k9.ncl > project-metadata.json - -# Yard: typecheck contracts -nickel typecheck examples/ci-config.k9.ncl - -# Hunt (signature required): dry-run first -./must --dry-run run examples/setup-repo.k9.ncl ----- - -== Integration with the rest of .machine_readable/ - -* `6a2/STATE.a2ml` — K9 can validate the current-state surface is non-template. -* `6a2/META.a2ml` — K9 enforces the architectural / proof-discipline decisions. -* `agent_instructions/methodology.a2ml` — the methodology-guard ceilings live there. - -== Reference - -* K9-SVC Specification: https://github.com/hyperpolymath/k9-svc/blob/main/SPEC.adoc -* IANA Media Type: `application/vnd.k9+nickel` diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/svc/k9/examples/ci-config.k9.ncl deleted file mode 100644 index 50835331..00000000 --- a/.machine_readable/svc/k9/examples/ci-config.k9.ncl +++ /dev/null @@ -1,99 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# Yard-level K9 component: echo-types CI configuration with validation -# Security Level: Yard (Nickel evaluation, contract validation) -# Mirrors .github/workflows/agda.yml — Signature recommended - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "ci-configuration", - security = { - leash = 'Yard, - trust_level = "validated-config", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - metadata = { - name = "echo-types-ci-config", - version = "1.0.0", - description = "Agda proof-suite CI configuration with runtime validation", - author = "Jonathan D.A. Jewell ", - }, - }, - - ci = { - platform - | [| 'GitHubActions, 'GitLabCI, 'Codeberg |] - = 'GitHubActions, - - toolchain = { - agda_version - | String - | std.string.NonEmpty - = "2.6.3", - stdlib_version - | String - | std.string.NonEmpty - = "2.3", - locale = "C.UTF-8", - }, - - # The proof gate — order matters: All before Smoke before kernel-guard. - steps = [ - { - name = "Checkout", - action = "actions/checkout@v4", - sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11", - }, - { - name = "Install agda-stdlib v2.3 from source", - run = "git clone --depth 1 --branch v2.3 https://github.com/agda/agda-stdlib.git /opt/agda-stdlib", - }, - { - name = "Typecheck verified suite", - run = "agda -i proofs/agda proofs/agda/All.agda", - }, - { - name = "Typecheck headline pins", - run = "agda -i proofs/agda proofs/agda/Smoke.agda", - }, - { - name = "Kernel-cone certificate", - run = "scripts/kernel-guard.sh", - }, - { - name = "No unsafe constructs", - run = "scripts/check-no-unsafe.sh", - }, - ], - - security = { - enabled | Bool = true, - scanners = [ - { name = "CodeQL" }, - { name = "OSSF Scorecard", enabled = true }, - { name = "Hypatia", scan_for = "neurosymbolic-findings" }, - { name = "secret-scanner", scan_for = "secrets" }, - ], - }, - - notifications = { - on_success = "never", - on_failure = "always", - channels = ["email"], - }, - }, - - validation = { - # The two typecheck steps + kernel-guard are mandatory. - check_all_agda = - std.array.any (fun s => std.record.has_field "run" s && s.run == "agda -i proofs/agda proofs/agda/All.agda") ci.steps, - check_smoke = - std.array.any (fun s => std.record.has_field "run" s && s.run == "agda -i proofs/agda proofs/agda/Smoke.agda") ci.steps, - check_kernel_guard = - std.array.any (fun s => std.record.has_field "run" s && s.run == "scripts/kernel-guard.sh") ci.steps, - check_security = ci.security.enabled == true, - }, -} diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/svc/k9/examples/project-metadata.k9.ncl deleted file mode 100644 index 2470a382..00000000 --- a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl +++ /dev/null @@ -1,83 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# Kennel-level K9 component: echo-types project metadata -# Security Level: Kennel (pure data, no execution) -# No signature required - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "project-metadata", - security = { - leash = 'Kennel, - trust_level = "data-only", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - metadata = { - name = "echo-types-project-metadata", - version = "1.0.0", - description = "Pure data configuration for the echo-types proof library", - author = "Jonathan D.A. Jewell ", - }, - }, - - project = { - name = "echo-types", - id = "org.hyperpolymath.echo-types", - version_target = "0.1.1", - description = "Constructive Agda formalisation of fiber-based structured loss (\"echo types\"): Echo f y := Σ (x : A) , (f x ≡ y).", - - repository = { - url = "https://github.com/hyperpolymath/echo-types", - type = "git", - canonical_forge = "github", - mirrors = ["gitlab", "codeberg"], - }, - - author = { - name = "Jonathan D.A. Jewell", - email = "j.d.a.jewell@open.ac.uk", - organization = "hyperpolymath", - }, - - license = "MPL-2.0", - - proof_discipline = { - checker = "agda", - agda_min = "2.6.3", - stdlib_min = "2.3", - flags = ["--safe", "--without-K"], - postulates_load_bearing = 0, - verified_suite = "proofs/agda/All.agda", - headline_pins = "proofs/agda/Smoke.agda", - kernel_cone_guard = "scripts/kernel-guard.sh", - }, - - workstreams = [ - "composition-track (Echo-comp-iso, cancel-iso, pentagon) — landed", - "ordinal-track (Buchholz, target Bachmann-Howard psi_0(Omega_omega)) — partial", - "establishment-track (reindexing modality of structured loss, Pillars A-F) — Pillars A-D + F closed; Pillar E open", - ], - - keywords = [ - "agda", - "homotopy-type-theory", - "fiber", - "structured-loss", - "graded-comonad", - "ordinal-notation", - "rhodium-standard", - "hyperpolymath", - ], - - # Registry-assigned; not yet known. Do not fabricate. - clade = "TODO: assign via gv-clade-index registry", - }, - - export = { - format = "json", - destination = "project-metadata.json", - }, -} diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/svc/k9/examples/setup-repo.k9.ncl deleted file mode 100644 index 5b336a1a..00000000 --- a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl +++ /dev/null @@ -1,103 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# Hunt-level K9 component: echo-types toolchain bootstrap -# Security Level: Hunt (full system access) -# SIGNATURE REQUIRED - Review carefully before use - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "setup-script", - security = { - leash = 'Hunt, - trust_level = "full-system-access", - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - signature_required = true, - }, - metadata = { - name = "echo-types-setup-repo", - version = "1.0.0", - description = "Bootstraps the Agda toolchain (Agda >= 2.6.3 + agda-stdlib v2.3 from source) so the verified suite typechecks. Derived from CLAUDE.md § Build.", - author = "Jonathan D.A. Jewell ", - }, - warnings = [ - "This component clones an external repo and writes to /opt and ~/.agda", - "Only run from a trusted source with a verified signature", - "Review all Just recipes before execution", - "Use dry-run mode first: ./must --dry-run run setup-repo.k9.ncl", - ], - side_effects = [ - "Clones agda-stdlib v2.3 into /opt/agda-stdlib", - "Writes /opt/agda-stdlib/standard-library.agda-lib (name normalised)", - "Writes ~/.agda/libraries", - "Runs `agda` over proofs/agda/All.agda (no network, CPU-bound)", - ], - }, - - config = { - stdlib_dir - | String - | std.string.NonEmpty - = "/opt/agda-stdlib", - - stdlib_branch - | String - | std.string.NonEmpty - = "v2.3", - - dry_run | Bool = false, - }, - - recipes = { - default = { - recipe = "bootstrap", - description = "Install stdlib v2.3, register it, and typecheck the suite", - }, - - "bootstrap" = { - dependencies = ["check-prerequisites", "install-stdlib", "register-stdlib"], - commands = [ - "agda -i proofs/agda proofs/agda/All.agda", - "agda -i proofs/agda proofs/agda/Smoke.agda", - "scripts/kernel-guard.sh", - ], - }, - - "check-prerequisites" = { - description = "Verify agda and git are present", - commands = [ - "command -v agda || (echo 'ERROR: agda (>= 2.6.3) not found' && exit 1)", - "command -v git || (echo 'ERROR: git not found' && exit 1)", - ], - }, - - "install-stdlib" = { - description = "Clone agda-stdlib v2.3 from source", - commands = [ - "test -d %{config.stdlib_dir} || git clone --depth 1 --branch %{config.stdlib_branch} https://github.com/agda/agda-stdlib.git %{config.stdlib_dir}", - "sed -i 's/^name: standard-library-2.3$/name: standard-library/' %{config.stdlib_dir}/standard-library.agda-lib", - ], - }, - - "register-stdlib" = { - description = "Register the library with Agda", - commands = [ - "mkdir -p ~/.agda", - "echo %{config.stdlib_dir}/standard-library.agda-lib > ~/.agda/libraries", - ], - }, - }, - - validation = { - check_stdlib_dir = std.string.length config.stdlib_dir > 0, - check_branch = std.string.length config.stdlib_branch > 0, - }, -} - -# Usage: -# 1. Review side_effects and recipes -# 2. Dry-run: ./must --dry-run run setup-repo.k9.ncl -# 3. Sign: ./must sign setup-repo.k9.ncl -# 4. Run: ./must verify && ./must run setup-repo.k9.ncl diff --git a/.machine_readable/svc/k9/methodology-guard.k9.ncl b/.machine_readable/svc/k9/methodology-guard.k9.ncl deleted file mode 100644 index 8fa87e10..00000000 --- a/.machine_readable/svc/k9/methodology-guard.k9.ncl +++ /dev/null @@ -1,75 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# K9 Validator: Methodology Guard (echo-types) -# Checks that agent work respects the echo-types proof discipline -# (--safe --without-K, zero postulates, All.agda coverage, kernel cone). -# The former .a2ml record checks (STATE, ANCHOR, coverage) were removed -# with the .a2ml records themselves; see the retirement PR. -# -# Usage: k9 validate methodology-guard - -let methodology_guard = { - name = "methodology-guard", - version = "1.0.0", - description = "Validates that agent work respects echo-types' --safe --without-K zero-postulate proof discipline", - - checks = { - safe_without_k_invariant = { - description = "Every proofs/agda module must carry --safe and --without-K in its OPTIONS pragma", - severity = "error", - check_type = "options-pragma-guard", - scope = "proofs/agda/", - required_flags = ["--safe", "--without-K"], - }, - - postulate_ceiling = { - description = "postulate count must not exceed the declared ceiling outside the Ordinal track", - severity = "error", - pattern = "^\\s*postulate", - scope = "proofs/agda/ (excluding Ordinal/)", - ceiling_key = "methodology.proof-invariants.postulate-ceiling", - default_ceiling = 0, - }, - - believe_me_ceiling = { - description = "believe_me / primTrustMe / primEraseEquality count must be zero", - severity = "error", - pattern = "believe_me|primTrustMe|primEraseEquality", - scope = "proofs/agda/", - ceiling_key = "methodology.proof-invariants.believe-me-ceiling", - default_ceiling = 0, - }, - - escape_hatch_ceiling = { - description = "sorry / Admitted / unsafeCoerce / Obj.magic count must be zero", - severity = "error", - pattern = "sorry|Admitted|unsafeCoerce|Obj\\.magic", - scope = "proofs/agda/", - default_ceiling = 0, - }, - - headline_pinned = { - description = "Every headline theorem must be pinned in Smoke.agda via a `using` clause", - severity = "warning", - check_type = "smoke-pin-guard", - file = "proofs/agda/Smoke.agda", - rule = "New named theorems in All.agda's import set should appear in a Smoke.agda `using (...)` block.", - }, - - module_wired = { - description = "Every new module must be wired into All.agda (orphan modules are dead code)", - severity = "warning", - check_type = "all-agda-coverage-guard", - file = "proofs/agda/All.agda", - }, - - kernel_cone_intact = { - description = "The funext-free kernel cone (Echo, EchoKernel) must pass scripts/kernel-guard.sh", - severity = "error", - check_type = "external-script", - script = "scripts/kernel-guard.sh", - }, - }, -} -in methodology_guard diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/svc/k9/template-hunt.k9.ncl deleted file mode 100644 index 4a56e5f6..00000000 --- a/.machine_readable/svc/k9/template-hunt.k9.ncl +++ /dev/null @@ -1,79 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9 Hunt-level template: Full execution with Just recipes -# Security Level: Hunt (full system access) -# SIGNATURE REQUIRED - Review carefully before use - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')", - security = { - leash = 'Hunt, - trust_level = "full-system-access", - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - signature_required = true, - }, - metadata = { - name = "TODO: component-name", - version = "1.0.0", - description = "TODO: Detailed description of what this component does", - author = "Jonathan D.A. Jewell ", - }, - warnings = [ - "This component has full system access", - "Only run from trusted sources with verified signatures", - "Review all Just recipes before execution", - "Use dry-run mode first: ./must --dry-run run your-file.k9.ncl", - ], - side_effects = [ - "TODO: List what files/directories this creates or modifies", - "TODO: List what commands this executes", - "TODO: List what network access this requires", - ], - }, - - config = { - target_dir - | String - | std.string.NonEmpty - = "/tmp/k9-output", - - dry_run | Bool = false, - }, - - recipes = { - default = { - recipe = "TODO: main-task", - description = "TODO: What the default recipe does", - }, - - "main-task" = { - dependencies = ["check-prerequisites"], - commands = [ - "echo 'TODO: Add your commands here'", - ], - }, - - "check-prerequisites" = { - description = "Verify required tools and permissions", - commands = [ - "echo '✓ Prerequisites checked'", - ], - }, - }, - - validation = { - check_target_dir = std.string.length config.target_dir > 0, - }, -} - -# Usage: -# 1. Fill in TODO items above -# 2. Define configuration with contracts -# 3. Implement Just recipes with your commands -# 4. Test with dry-run: ./must --dry-run run your-file.k9.ncl -# 5. Sign: ./must sign your-file.k9.ncl -# 6. Users verify and run: ./must verify && ./must run your-file.k9.ncl diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/svc/k9/template-kennel.k9.ncl deleted file mode 100644 index 4de42d7b..00000000 --- a/.machine_readable/svc/k9/template-kennel.k9.ncl +++ /dev/null @@ -1,52 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9 Kennel-level template: Pure data configuration -# Security Level: Kennel (data-only, no execution) -# No signature required - safe for any use - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')", - security = { - leash = 'Kennel, - trust_level = "data-only", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - metadata = { - name = "TODO: component-name", - version = "1.0.0", - description = "TODO: Brief description of what this component contains", - author = "Jonathan D.A. Jewell ", - }, - }, - - # Your configuration data here - config = { - setting_1 = "value", - setting_2 = 42, - setting_3 = true, - - nested = { - key = "value", - }, - - list = [ - "item1", - "item2", - ], - }, - - export = { - format = "json", # or "yaml", "toml" - destination = "output.json", - }, -} - -# Usage: -# 1. Fill in TODO items above -# 2. Add your configuration data to config = { ... } -# 3. Validate: nickel typecheck your-file.k9.ncl -# 4. Export: nickel export your-file.k9.ncl > output.json diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/svc/k9/template-yard.k9.ncl deleted file mode 100644 index e308eb74..00000000 --- a/.machine_readable/svc/k9/template-yard.k9.ncl +++ /dev/null @@ -1,66 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9 Yard-level template: Configuration with validation -# Security Level: Yard (Nickel evaluation with contracts) -# Signature recommended but not required - -{ - pedigree = { - schema_version = "1.0.0", - component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')", - security = { - leash = 'Yard, - trust_level = "validated-config", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - metadata = { - name = "TODO: component-name", - version = "1.0.0", - description = "TODO: Brief description with validation details", - author = "Jonathan D.A. Jewell ", - }, - }, - - # Configuration with Nickel contracts for validation - config = { - name - | String - | std.string.NonEmpty - = "TODO: default value", - - port - | Number - | std.contract.from_predicate (fun p => p > 0 && p < 65536) - = 8080, - - enabled | Bool = true, - - environment - | [| 'Development, 'Staging, 'Production |] - = 'Development, - - items - | Array String - | std.array.NonEmpty - = ["item1", "item2"], - }, - - # Cross-field validation rules - validation = { - check_items = std.array.length config.items > 0, - check_production = - if config.environment == 'Production then - config.enabled == true - else - true, - }, -} - -# Usage: -# 1. Fill in TODO items above -# 2. Define your config with appropriate contracts -# 3. Add validation rules in validation = { ... } -# 4. Validate: nickel typecheck your-file.k9.ncl -# 5. Evaluate: nickel eval your-file.k9.ncl diff --git a/.tool-versions b/.tool-versions index 3241328a..5841e2e2 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1,5 +1,3 @@ -agda 2.7.0 -ghc 9.8.2 -cabal 3.12.1.0 -rust 1.82.0 +# Agda 2.7.0.1 is provisioned by scripts/setup-agda.sh. +bun 1.4.4 just 1.40.0 diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index 1770942b..8c682986 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -4,6 +4,12 @@ :toc: macro :toclevels: 2 + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + _the No-Bullshit file: what we affirm was true and checkable at this moment_ [NOTE] @@ -122,7 +128,7 @@ drift from what we verified, we say so here rather than quietly leave the reader to find out. * *`README.adoc`* — *absent.* The canonical README for this repo is - link:README.md[`README.md`]; `readme.adoc` and `EXPLAINME.adoc` are deliberate + link:README.adoc[`README.md`]; `readme.adoc` and `EXPLAINME.adoc` are deliberate one-line pointers _to_ it. So the estate's nominal `README.adoc` filename is not present, but a canonical README _is_ — `README.md`. Noted, not glossed. * *`EXPLAINME.adoc`* — *present*, as a pointer redirecting to `README.md`. @@ -140,7 +146,7 @@ to find out. loss whose verified closure typechecks green under `--safe --without-K` with a funext-free, postulate-free kernel cone and no escape pragmas in the closure — a genuinely machine-checked CORE (the Echo Σ-fiber calculus, its totality / -orthogonal-factorisation / no-section / graded-loss / decoration spine, the +factorisation / no-left-inverse / indexed-loss / decoration spine, the general monoid/group `EchoAggregation` theorem, and a large sound-carrier ordinal-notation development) — alongside an explicitly fenced PERIPHERY of documented postulate trust-boundaries, experiments, and unwired modules kept out @@ -235,7 +241,7 @@ we name them as three. gates take `funext` as an explicit hypothesis). That qualification is the honest content, not a defect. * *The retracted "graded comonad" reading stands retracted* (R-2026-05-18): - echo-types is a loss-graded _reindexing modality_ (thin-poset action); the + the core interface is a preorder-indexed diagram, without reflective modality structure; the experimental `echo-additive/` tree is not wired into the shipped closure. The current Agda workflow invokes its separate aggregate as a step in both jobs, not as an independently named job; see `PROOF-STATUS.adoc` diff --git a/CITATION.cff b/CITATION.cff index 05e5567f..3ebd0df4 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -1,8 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell cff-version: 1.2.0 -title: "echo-types: a definitionally-grounded, loss-graded reindexing modality (Agda)" -message: "If you cite this software, please cite the Zenodo DOI." +title: "echo-types: dependent fibres and indexed structured-loss models (Agda)" +message: "Please cite this software using the author and repository information below; no verified DOI is recorded." type: software authors: - given-names: Jonathan @@ -15,31 +15,27 @@ abstract: > Constructive Agda formalisation of fibre-based "structured loss" types. Defines Echo f y := Σ (x : A) , (f x ≡ y), shows it is definitionally the homotopy fibre (echo↔fib), and develops a - loss-graded reindexing modality on top with a pointwise - (funext-relative) mediator property, a separating model, and a - carrier-parametric abstraction over a fixed grade poset. Under - --safe --without-K throughout with zero postulates and a - falsifiable retraction discipline. See paper.adoc and - types-abstract.adoc for the mechanised metatheory write-up. + preorder-indexed diagram with a pointwise mediator property, + conditional function-level results, and scoped counterexamples + for selected lossy encodings. The ordinary checked roots use + --safe --without-K; separate Cubical and postulated presentations + have distinct trust boundaries. Novelty and priority are unresolved. + See docs/foundation.adoc for dated coverage and verification limits. keywords: - agda - - graded modality + - indexed family - homotopy fibre - structured loss - - reindexing modality + - reindexing - formal methods - mechanised metatheory license: MPL-2.0 -# === PLACEHOLDER: paste concept DOI here after first Zenodo mint === -doi: 10.5281/zenodo.0000000 -# === END PLACEHOLDER === preferred-citation: type: software - title: "echo-types: a definitionally-grounded, loss-graded reindexing modality (Agda)" + title: "echo-types: dependent fibres and indexed structured-loss models (Agda)" authors: - given-names: Jonathan orcid: "https://orcid.org/0000-0002-3078-6652" family-names: Jewell url: "https://github.com/hyperpolymath/echo-types" - doi: 10.5281/zenodo.0000000 year: 2026 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 00000000..b7cb8c1f --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,33 @@ + + +# Contributing to echo-types + +Echo is the standard dependent fibre, presented in Agda with scoped models of structured loss. Start with [README.adoc](README.adoc), the [roadmap](roadmap.adoc), and the [foundation and trust boundary](docs/foundation.adoc). The extracted ordinal programme belongs in `hyperpolymath/ordinal-notation`. + +## Propose a change + +Search existing issues, then describe the problem, expected behaviour, and a minimal reproduction or concrete proof obligation. For proof failures include the source revision, Agda version, dependency revisions, command, and complete diagnostic. For proposed theorems state the assumptions and distinguish source inspection from completed typechecking. + +Use the fork-and-pull-request workflow with a focused `docs/`, `fix/`, or `feat/` branch from `main`. Keep unrelated work separate. Maintainers decide acceptance under [GOVERNANCE.adoc](GOVERNANCE.adoc); participation follows [CODE_OF_CONDUCT.adoc](CODE_OF_CONDUCT.adoc). Report vulnerabilities through [SECURITY.adoc](SECURITY.adoc). + +## Check the change + +Register the Agda standard library and absolute-zero library at the revisions recorded in [docs/foundation.adoc](docs/foundation.adoc). Then, from the repository root: + +```sh +bash scripts/check-grade3.sh +``` + +This script runs the seven existing workflow roots with uncached interfaces and their declared profiles, plus static guards. For the additional bounded foundation-audit entrypoint and source manifest, see [the audit evidence](docs/audit/2026-11-06-evidence.adoc). Save stdout and stderr, including warnings; a successful root check covers its imports rather than every tracked file. + +Ordinary proofs use `--safe --without-K --cubical-compatible`. The Cubical island is checked separately with `--safe --cubical`. The three existing guard exceptions are listed in the foundation document; they are not a general exemption for new files. Preserve termination, coverage, positivity, and the explicit trust boundaries. Do not introduce unsolved holes, postulates, unsafe primitives, or escape pragmas into the ordinary checked development. State any extra equality principle as an explicit hypothesis. + +Keep theorem compatibility names stable where practical, and update affected imports, smoke pins, and documentation. Do not infer novelty from a scoped counterexample, single-use enforcement from duplicable values, or physical claims from arithmetic models. Retain dated retraction and proof records and append corrections. Record user-visible changes in [CHANGELOG.adoc](CHANGELOG.adoc). + +## Commits and review + +Use descriptive Conventional Commit messages and include the Developer Certificate of Origin sign-off (`git commit -s`). Follow the estate [signed-commit policy](https://github.com/hyperpolymath/standards/blob/ba640e9a57f22608710ffecdca282074eac55a0b/docs/SIGNING-POLICY.adoc). A DCO sign-off and a cryptographic signature serve different purposes. + +Describe what changed, why, and the exact checks performed in the pull request. Kernel, bridge, aggregate, and guard changes need explicit maintainer review. Preserve existing licence notices and third-party attribution; licence changes require an owner decision. + +This root guide is the current contribution entrypoint. `.github/CONTRIBUTING.md` points here; use the live foundation document for proof profiles and trust exceptions. diff --git a/Containerfile b/Containerfile index 3987ba2a..638754af 100644 --- a/Containerfile +++ b/Containerfile @@ -1,22 +1,24 @@ # SPDX-License-Identifier: MPL-2.0 -# Containerfile — podman-build fallback when stapeln is unavailable. - -# TODO(scaffold): pin @sha256 -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -USER root -RUN apk add --no-cache agda ghc cabal +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +# Rootless Podman fallback: verify All with the same pinned compiler/libraries as CI. +FROM cgr.dev/chainguard/wolfi-base@sha256:0efdcacdc6ab6d4f00507f1c0aa35e6bcbd50f838a45fe560e0e3b12056e3181 AS build +# Package provisioning needs the base image's build-time administrator. Proof +# downloads, checking and the delivered carrier run as an unprivileged user. +RUN apk add --no-cache bash curl git xz coreutils ca-certificates && mkdir -p /build && chown 65532:65532 /build +USER 65532:65532 WORKDIR /build -COPY echo-types.agda-lib ./ -COPY proofs ./proofs - -RUN agda -i proofs/agda proofs/agda/All.agda - -FROM cgr.dev/chainguard/static:latest AS runtime -USER nonroot +ENV HOME=/build AGDA_TOOLS_DIR=/build/toolchain +COPY --chown=65532:65532 scripts/setup-agda.sh ./scripts/setup-agda.sh +RUN bash scripts/setup-agda.sh +COPY --chown=65532:65532 echo-types.agda-lib ./ +COPY --chown=65532:65532 proofs ./proofs +RUN bash -c 'source "$AGDA_TOOLS_DIR/env.sh"; agda --safe --without-K --cubical-compatible --no-libraries -i proofs/agda -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" proofs/agda/All.agda' +# The carrier has a real shell for its informational entrypoint. It is not a +# service and does not bundle the compiler or claim all proof roots were checked. +FROM cgr.dev/chainguard/wolfi-base@sha256:0efdcacdc6ab6d4f00507f1c0aa35e6bcbd50f838a45fe560e0e3b12056e3181 AS runtime +USER 65532:65532 COPY --from=build /build/proofs /app/proofs COPY --from=build /build/echo-types.agda-lib /app/echo-types.agda-lib - -ENTRYPOINT ["/bin/sh", "-c", "echo 'echo-types is a proof-artefact carrier; mount /app/proofs into your downstream Agda project.'"] +ENTRYPOINT ["/bin/sh", "-c", "printf '%s\n' 'Echo Types proof-source carrier: All.agda checked with Agda 2.7.0.1. Recheck with the documented pinned libraries before downstream use.'"] diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index dc1e73d1..b185ad65 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -5,6 +5,12 @@ :icons: font :doctype: article + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + This file backs every factual claim in link:README.adoc[README.adoc] with code paths and honest caveats. Read it if you are doing due diligence — checking whether the story matches the code. == Claim-to-implementation map @@ -82,23 +88,23 @@ The Julia companion has no funext and therefore shadows only the unconditional f [quote, README.adoc] ____ -Novel separation proofs: Echo is not distinguished by Shannon entropy; LL !A := 1 gives a shallow-encoding gap; equal measure does not imply equal Echo. +Scoped counterexamples: the selected finite entropy surrogate, LL !A := 1 encoding, and resource measures forget fibre information. These do not separate Echo from general Σ-types or arbitrary encodings. Novelty and priority are unresolved. ____ How this is implemented:: * `link:proofs/agda/EchoEntropy.agda[]` — Shannon entropy cannot distinguish distinct echoes over the same output. * `link:proofs/agda/EchoLLEncoding.agda[]` — The linear logic encoding `LL !A := 1` collapses informative distinctions that Echo preserves. -* `link:proofs/agda/EchoSeparation/NotResourceInstance.agda[]` — `equal-measure-does-not-imply-equal-echo` and `measure-not-injective`: no residue measure determines the echo. +* `link:proofs/agda/Echo/Separation/NotResourceInstance.agda[]` — `equal-measure-does-not-imply-equal-echo` and `measure-not-injective`: no residue measure determines the echo. Caveat:: These establish *negative* identity (Echo ≠ X). The falsifiability criteria also require *positive* identity (characteristic theorems that are naturally Echo-shaped). The positive side is open. -=== No-section family proves structured loss is irreversible +=== Historical no-section family rules out exact left-inverse recovery [quote, README.adoc] ____ -No section of a collapsing map. +No left inverse of a collapsing map; right inverses can exist. ____ How this is implemented:: @@ -203,7 +209,7 @@ drift; ordinal-notation's copies are the maintained ones. [CAUTION] ==== -**Cross-repo bridge conformance is not machine-checked.** `EchoCNOBridge.agda` imports from `absolute-zero`; `EchoJanusBridge` targets `januskey`. End-to-end conformance is not yet verified. See `link:docs/echo-types/cross-repo-bridge-status.md[]`. +**Cross-repo bridge conformance is not machine-checked.** `EchoCNOBridge.agda` imports from `absolute-zero`; `EchoJanusBridge` targets `januskey`. End-to-end conformance is not yet verified. See `link:docs/bridges/cross-repo-bridge-status.adoc[]`. ==== [CAUTION] @@ -227,7 +233,7 @@ drift; ordinal-notation's copies are the maintained ones. | Domain-replacement factorization exists (module name is misnomer) | `proofs/agda/EchoNoSectionGeneric.agda` -| No section of a collapsing map +| No left inverse of a collapsing map | `proofs/agda/EchoOrthogonalFactorizationSystem.agda` | WFS witness (module name overclaims OFS) diff --git a/FOUNDATIONS_BRIDGE.adoc b/FOUNDATIONS_BRIDGE.adoc index 2cf86efd..eabaab4c 100644 --- a/FOUNDATIONS_BRIDGE.adoc +++ b/FOUNDATIONS_BRIDGE.adoc @@ -1,3 +1,9 @@ + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + == Foundations bridge — consuming `+echo-types+` and `+tropical-resource-typing+` This is a downstream integration brief for `+my-lang+` or any other @@ -50,19 +56,19 @@ soundness _parametrically_ over the interface via `+resource_laws_sufficient_for_consumers+`), then instantiate at any algebra above with no algebraic re-proof. -==== Axis 3 — Echo modality (`+echo-types+`) +==== Axis 3 — Echo indexed diagram (`+echo-types+`) * *What it is:* structured *residue / loss / forgetting / projection* — the remainder of an information-losing map, `+Echo f y := Σ (x : A), (f x ≡ y)+`. -* *Indexed by a thin poset:* `+Echo.Index.ThinPoset+`; the canonical -index is the three-point loss order `+keep ≤ residue ≤ forget+` +* *Indexed by a thin preorder:* `+Echo.Index.ThinPoset+`; the canonical +abstract `ThinPoset` record has no antisymmetry field. The canonical index is the three-point loss order `+keep ≤ residue ≤ forget+` (`+grade-thinPoset+`). Thinness (order proofs are propositional) is load-bearing, not cosmetic. -* *Proves residual metatheory:* `+Echo.Modality.Core+` / +* *Specifies an indexed action:* `+Echo.Modality.Core+` / `+Echo.Modality.Interface+` give `+degrade+`, the unit law `+degrade-id+`, the path-independence law `+degrade-compose+`, and the -no-section theorem `+no-section-of-collapsing-map+`; the +no-left-inverse theorem `+no-section-of-collapsing-map+` (historical name retained); the downstream-instantiable record is `+EchoModality+` (canonical witness `+grade-echoModality+`). * *Independent of the resource algebra at the core:* diff --git a/FOUNDATION_CONTRACT.adoc b/FOUNDATION_CONTRACT.adoc index b817f7b5..2e95e911 100644 --- a/FOUNDATION_CONTRACT.adoc +++ b/FOUNDATION_CONTRACT.adoc @@ -1,6 +1,6 @@ == Echo Types Foundation Contract -Echo Types exports the *residual-modality axis*. This document is the +Echo Types exports the *indexed-residue axis*. This document is the stable contract that downstream languages (e.g. my-lang) build against. It fixes the vocabulary, the exported interface, and — above all — the boundary invariant that keeps Echo from being collapsed into a @@ -12,7 +12,7 @@ modules are: [width="100%",cols="34%,33%,33%",options="header",] |=== |Concern |Module |File -|Echo index (thin poset) |`+Echo.Index.ThinPoset+` +|Echo index (thin preorder) |`+Echo.Index.ThinPoset+` |`+proofs/agda/Echo/Index/ThinPoset.agda+` |Echo modality (core) |`+Echo.Modality.Core+` (+ @@ -29,8 +29,7 @@ All build under `+--safe --without-K+`, with zero postulates. === Echo index -The modality is indexed by a *thin poset/order of degradation or -retention*. The canonical instance is the three-point loss order +The family is indexed by a *thin preorder of degradation or retention*. The compatibility record name `ThinPoset` does not add an antisymmetry field. The canonical instance is the three-point loss order .... keep ≤ residue ≤ forget @@ -46,17 +45,16 @@ _Anti-collapse_ below). === Echo core -Echo core proves degradation, composition, no-section/irreversibility, +Echo core proves degradation, composition, failure of exact left-inverse recovery, and residue/fibre behaviour: * the fibre functor `+Echo f y := Σ (x : A) , (f x ≡ y)+` — the structured remainder of an information-losing `+f+`; * the index-graded modality with `+degrade+`, the unit law `+degrade-id+`, and the path-independence law `+degrade-compose+`; -* the generic no-section theorem `+no-section-of-collapsing-map+` +* the generic no-left-inverse theorem (historical identifier retained) `+no-section-of-collapsing-map+` (Echo’s irreversibility is a property of non-injectivity); -* an abstract `+EchoModality+` record that downstream instantiates at -its own fibration, with the canonical `+grade-echoModality+` witness. +* an abstract `+EchoModality+` diagram-action record with the canonical `+grade-echoModality+` witness. It does not specify reflective modality structure. *Echo core is measure-independent.* The modules `+Echo.Modality.Core+`, `+Echo.Modality.Interface+`, and `+Echo.Index.ThinPoset+` import *no* @@ -117,9 +115,7 @@ determined by a semiring-valued grade/measure): `+EchoSeparating.sep-degrade-compose-fails+`). The characteristic law `+degrade-compose+` is carried _precisely_ by thinness of the echo index. The separating model keeps the generic Σ-functoriality laws but -drops thinness, and composition then breaks at a checked -`+true ≢ false+`. The graded Echo structure is genuine structure on an -axis no semiring grade supplies. +drops thinness, and independence from an arbitrary parallel direct arrow fails at `+true ≢ false+`. Composition with the chosen composite remains functorial. This is no general separation from semiring encodings or Σ-types. . *Measure* — `+equal-measure-does-not-imply-equal-echo+` and `+measure-not-injective+`. A residue measure (the trivial-residue projection) sends two genuinely-distinct Echo residues (`+echo-true+`, @@ -130,8 +126,7 @@ point against a measure that is _not_ a strawman: `+visible-measure+` genuinely reads the residue and lands in a two-point carrier (`+visible-measure-informative+` shows it discriminates elsewhere), yet still cannot separate two residues that agree on the visible bit. Equal -residue measure therefore does not imply equal Echo: any such measure is -a lossy observation, never the identity criterion of Echo. +residue measure therefore does not imply equal Echo for these particular measures. The examples do not show that every possible measure is lossy. === Vocabulary @@ -139,7 +134,7 @@ Use these terms precisely; they name three orthogonal things. * *resource grade* — a binder/resource quantity, belonging to the resource algebra / semiring axis. -* *echo index* — the thin-poset index of the Echo modality, e.g. +* *echo index* — the thin-preorder index of the Echo modality, e.g. `+keep ≤ residue ≤ forget+`. Inhabitants of `+Ix+`. * *residue measure* — a semiring/resource-algebra-valued _observation_ of an Echo residue (a `+ResidueMeasure+`). diff --git a/GLOSSARY.adoc b/GLOSSARY.adoc index b4ac78f0..b54b99b0 100644 --- a/GLOSSARY.adoc +++ b/GLOSSARY.adoc @@ -5,6 +5,12 @@ :icons: font :doctype: article + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + Cross-reference glossary for link:README.adoc[README.adoc], link:EXPLAINME.adoc[EXPLAINME.adoc], and the `echo-types` wiki. Terms are classified as **standard** (existing mathematical concept used without modification), **rephrased** (standard concept given project-specific vocabulary), or **project-specific** (originating in this project). == Core concepts @@ -106,7 +112,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification @@ -321,7 +327,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification| Written | Spoken @@ -424,7 +430,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification| Written | Spoken @@ -610,7 +616,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification @@ -724,7 +730,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification @@ -981,7 +987,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification @@ -1143,7 +1149,7 @@ Degrade:: [[no-section]] No-section theorem:: - A proof that a collapsing (non-injective) map `f` has no section — there is no `s : B → A` with `f ∘ s = id`. This is the formal witness that the loss is irreversible. + Compatibility term for a no-left-inverse theorem: if `f : A → B` collapses distinct sources, no `s : B → A` satisfies `s ∘ f = id`. It does not rule out a categorical section with `f ∘ s = id`; Boolean collapse to unit has two such right inverses. *Classification:* **standard** (consequence of non-injectivity in dependent type theory). == Classification diff --git a/Justfile b/Justfile index afd04824..45d26d82 100644 --- a/Justfile +++ b/Justfile @@ -1,114 +1,54 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -# Echo Types Build and Test System +# Agda 2.7.0.1. See scripts/setup-agda.sh and docs/build.adoc for pinned libraries. +set shell := ["bash", "-eu", "-o", "pipefail", "-c"] -# Build all echo type modules -build-echo: - @echo "Building echo type modules..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda - @echo "✅ All echo modules built successfully" +default: + @just --list -# Build stability tests -build-tests: - @echo "Building stability tests..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/EchoStabilityTests.agda - @echo "✅ Stability tests built successfully" +# Ordinary profile; AGDA_STDLIB and ABSOLUTE_ZERO_AGDA are required paths. +build: + agda --safe --without-K --cubical-compatible --no-libraries -i proofs/agda -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" proofs/agda/All.agda -# Run comprehensive build -build-all: - @echo "🔨 Building all echo type modules and tests..." - @echo "==========================================" - just build-echo - just build-tests - @echo "==========================================" - @echo "✅ Build complete! All modules type-check successfully" +build-echo: build +build-all: build -test-core: - @echo "Testing core echo type properties..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Echo.agda - @echo "✅ Core tests passed" +# Changed proof modules and all seven aggregate roots; logs are receipts. +test: + bash tools/check-audit.sh -# Test CNO bridge -test-cno: - @echo "Testing CNO bridge..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/EchoCNOBridge.agda - @echo "✅ CNO bridge tests passed" +test-all: test +verify: guard test -# Test thermodynamic bridge -test-thermo: - @echo "Testing thermodynamic bridge..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/EchoThermodynamics.agda - @echo "✅ Thermodynamic tests passed" +# Static checks are distinct from typechecking. +guard: + sh scripts/kernel-guard.sh + bash tools/check-guardrails.sh proofs/agda + sh scripts/check-experimental-aggregate.sh + sh scripts/check-agda-invocations.sh -# Test categorical bridge -test-cat: - @echo "Testing categorical bridge..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/EchoCategorical.agda - @echo "✅ Categorical tests passed" +kernel-guard: + sh scripts/kernel-guard.sh -# Test stability suite -test-stability: - @echo "Testing stability suite..." - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/EchoStabilityTests.agda - @echo "✅ Stability tests passed" +metadata: + bash tools/check-metadata.sh -# Run all tests -test-all: - @echo "🧪 Running comprehensive test suite..." - @echo "==========================================" - just test-core - just test-cno - just test-thermo - just test-cat - just test-stability - @echo "==========================================" - @echo "✅ All tests passed! Stability: 92/100" +validate: guard metadata test -# Clean build artifacts -clean: - @echo "Cleaning build artifacts..." - rm -f proofs/agda/*.agdai - @echo "✅ Clean complete" +audit-inventory: + bun tools/audit-inventory.mjs -# Full build and test cycle -verify: - @echo "🔬 Full verification cycle..." - @echo "==========================================" - just clean - just build-all - just test-all - @echo "==========================================" - @echo "✅ Verification complete! System stability: 92/100" +# Actual tool coverage is recorded; neither scanner certifies Agda proofs. +panic: + mkdir -p build/audit-2026-11-06 + panic-attack assail . --output build/audit-2026-11-06/panic.json -# Stability report -stability-report: - @echo "📊 Stability Report" - @echo "==========================================" - @echo "Core Echo Types: 98/100 ✅" - @echo "CNO Bridge: 95/100 ✅" - @echo "Thermodynamic Bridge: 90/100 ✅" - @echo "Categorical Bridge: 88/100 ✅" - @echo "Integration: 92/100 ✅" - @echo "==========================================" - @echo "Overall Stability: 92/100 ✅" - @echo "Target Stability: 97/100 🎯" - @echo "==========================================" - @echo "📈 Stability Improvement Plan:" - @echo " 1. Increase test coverage to 100%" - @echo " 2. Add property-based testing" - @echo " 3. Formal verification of key theorems" - @echo " 4. Cross-system verification (Coq/Lean)" - @echo "==========================================" +pons: + mkdir -p build/audit-2026-11-06 + pons scan . --format json > build/audit-2026-11-06/pons.json -# Enforce the EchoKernel funext-free certificate + classification note -# (static; no Agda needed). CI calls this same recipe. -kernel-guard: - @sh scripts/kernel-guard.sh - -# Aggregate compliance gate: full Agda verify + kernel-guard certificate -validate: verify kernel-guard - @echo "validate: proofs verified + kernel guard passed" +stability-report: + @echo 'No numerical stability metric is defined. See PROOF-STATUS.adoc and docs/audit/ for scoped evidence.' -# Default target -default: - just verify +clean: + find proofs/agda -type f -name '*.agdai' -delete diff --git a/PROOF-STATUS.adoc b/PROOF-STATUS.adoc index 4c441d2a..6a080cac 100644 --- a/PROOF-STATUS.adoc +++ b/PROOF-STATUS.adoc @@ -4,6 +4,12 @@ :toc: :sectnums: + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [abstract] Honest status of the echo-types Agda formalisation: what is *proved*, what is *open*, and the build/guardrail invariant. echo-types is a constructive Agda diff --git a/README.adoc b/README.adoc index d52929c6..8a116325 100644 --- a/README.adoc +++ b/README.adoc @@ -5,13 +5,18 @@ :icons: font :doctype: article -image:https://img.shields.io/badge/OpenSSF-BestPractices-green[link="https://www.bestpractices.dev/projects/XXXX"] + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + Constructive Agda development treating proof-relevant fibers as first-class witnesses for structured information loss — loss that is not total erasure. == Overview -Most formalisms recognise two cases: reversible maps (no important loss) and irreversible maps (loss occurs and is usually forgotten). Echo types target a third case: **irreversible maps where the fiber over each output retains a proof-relevant constraint on what was lost**. +This library presents standard dependent fibres as proof-relevant witnesses for structured loss. A fibre inhabitant contains an actual source and a proof of its output; it is not automatically a compact description of all possible origins. Given `f : A → B`, the echo at `y : B` is the homotopy fiber: @@ -21,7 +26,7 @@ This is the standard preimage fiber, not a new construction. What this repo cont * **Emphasis** — treating fibers as first-class structured-loss witnesses rather than bookkeeping artifacts. * **Taxonomy** — a mechanised classification grid of loss kinds × residue shapes. -* **Separation proofs** — matched-negatives proving Echo is not reducible to Shannon entropy, linear-logic encodings, or resource grades. +* **Scoped counterexamples** — selected entropy summaries, shallow linear-logic encodings, and resource measures discard fibre information; this is not a separation from Σ-types or every encoding. * **Audience surfaces** — provenance, security, probabilistic, and differential views, each with honest bounds. * **Honesty infrastructure** — a living retraction ledger recording every retracted claim, its counterexample, and its narrowing. @@ -68,7 +73,7 @@ This is the **domain-replacement factorization**: the middle object `Σ B (Echo | Standard sigma/fiber lemmas | `Echo.agda` -| No section of a collapsing map +| No left inverse of a collapsing map | Standard consequence of non-injectivity | `EchoNoSectionGeneric.agda` @@ -81,15 +86,15 @@ This is the **domain-replacement factorization**: the middle object `Σ B (Echo | Tier 2 modules | Echo is not distinguished by Shannon entropy -| **Novel separation proof** +| Scoped counterexample; novelty and priority unresolved | `EchoEntropy.agda` | LL `!A := 1` shallow-encoding gap -| **Novel separation proof** +| Scoped counterexample; novelty and priority unresolved | `EchoLLEncoding.agda` | Equal measure does not imply equal Echo -| **Novel separation proof** +| Scoped counterexample; novelty and priority unresolved | `EchoSeparation.NotResourceInstance` | Audience surfaces (provenance, security, probabilistic, differential) @@ -97,7 +102,7 @@ This is the **domain-replacement factorization**: the middle object `Σ B (Echo | `EchoProvenance.agda`, `EchoSecurity.agda`, `EchoProbabilisticSupport.agda`, `EchoDifferential.agda` |=== -The matched-negatives are where the identity claim does its hardest work: proving your object is not its obvious neighbours is how distinctness gets earned. +The matched-negatives concern the stated encodings and observations. They establish neither a general separation from dependent pairs nor a priority claim. == Known technical gaps @@ -154,7 +159,7 @@ The useful formulation is not "loss became total erasure" but "loss left a decla | Tier 1 | **FiberTotalCompletion**: `A ≃ Σ B (Echo f)` (standard, restated) + **WeakFactorizationSystem**: factorization existence + fiber identification (unconditional) + -**NoSectionGeneric**: no section of a collapsing map +**NoSectionGeneric**: no left inverse of a collapsing map (historical theorem names retained) | Tier 2 | LossTaxonomy · ResidueTaxonomy · DecorationStructure · ≡m @@ -270,7 +275,7 @@ Requires standard-library v2.3 or later registered alongside. == Citation -Cite via the Zenodo DOI in `CITATION.cff`. The Zenodo record is the canonical citation target; GitHub's "Cite this repository" widget resolves directly to it. +Use the author and repository metadata in link:CITATION.cff[CITATION.cff]. No verified DOI is currently recorded; the configured Zenodo release webhook does not by itself establish a published archive record. == License diff --git a/TOPOLOGY.adoc b/TOPOLOGY.adoc index 2567720c..4063113b 100644 --- a/TOPOLOGY.adoc +++ b/TOPOLOGY.adoc @@ -31,13 +31,15 @@ echo-types/ ├── Containerfile # podman-build fallback ├── Justfile # primary command runner ├── INDEX.adoc # legacy file map (parallel to this TOPOLOGY) -├── README.md # canonical README (readme.adoc + EXPLAINME.adoc are pointers since the 2026-06-12 dedup) -├── roadmap.adoc + roadmap-gates.adoc # legacy lowercase; canonical is ROADMAP.adoc (rename pending) -├── flake.guix + flake.lock # (pending) -├── guix.scm # (pending) +├── CONTRIBUTING.md # contribution guide and actual verification entrypoints +├── README.adoc # project overview; EXPLAINME.adoc is the longer explanation +├── roadmap.adoc # canonical roadmap (lowercase filename) +├── roadmap-gates.adoc # scoped research and evaluation gates └── (RSR template files at root) ---- +For planned work use link:roadmap.adoc[roadmap.adoc]; no uppercase `ROADMAP.adoc` exists in this checkout. + == Cross-repo dependencies * `hyperpolymath/standards` — schema references for 6a2 file formats (consumed at the *spec* level, not as code). diff --git a/coordination.k9.ncl b/coordination.k9.ncl new file mode 100644 index 00000000..543f12b5 --- /dev/null +++ b/coordination.k9.ncl @@ -0,0 +1,55 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Thin coordination bindings for central session-management standards + +{ + pedigree = { + schema_version = "1.0.0", + component_type = "session:coordination-binding", + metadata = { + name = "echo-types-session-coordination", + version = "1.0.0", + description = "Pointers to canonical session protocols; no executable grant.", + }, + security = { + leash = 'Kennel, + allow_network = false, + allow_filesystem_write = false, + allow_subprocess = false, + signature_required = false, + }, + }, + + session_management = { + source_of_truth = "https://github.com/metadatastician/standards/tree/ba640e9a57f22608710ffecdca282074eac55a0b/3-practice/session-management-standards", + canonical_commands = [ + "intake repo ", + "checkpoint change ", + "verify maintenance ", + "verify substantial ", + "verify release ", + "close planned ", + "close urgent ", + "recover repo ", + "handover full ", + "handover split ", + "handover model ", + "handover human ", + ], + }, + + signals = [ + { name = "session.intake", command = "intake repo " }, + { name = "session.checkpoint", command = "checkpoint change " }, + { name = "session.verify.maintenance", command = "verify maintenance " }, + { name = "session.verify.substantial", command = "verify substantial " }, + { name = "session.verify.release", command = "verify release " }, + { name = "session.close.planned", command = "close planned " }, + { name = "session.close.urgent", command = "close urgent " }, + { name = "session.recover", command = "recover repo " }, + { name = "session.handover.full", command = "handover full " }, + { name = "session.handover.split", command = "handover split " }, + { name = "session.handover.model", command = "handover model " }, + { name = "session.handover.human", command = "handover human " }, + ], +} diff --git a/core/skepticisms/is-this-just-sigma-types.adoc b/core/skepticisms/is-this-just-sigma-types.adoc index ec037316..bc8ad10b 100644 --- a/core/skepticisms/is-this-just-sigma-types.adoc +++ b/core/skepticisms/is-this-just-sigma-types.adoc @@ -1,3 +1,9 @@ + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:../../docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../../docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + == Is this just Sigma Types? === The Skeptical Position @@ -21,7 +27,7 @@ tasks, the abstraction fails. === Reinterpretation vs. Novelty -The novelty must reside in the API and the categorical/compositional +Any potential contribution would reside in the API and the categorical/compositional properties exposed by the wrapper, demonstrating that `+Echo+` behaves coherently under lossy operations in a way that bare Sigma types do not automatically communicate. @@ -41,12 +47,11 @@ universal property`", no "`graded comonad`", no "`model-independence`". A raw `+Σ (x : A) (f x ≡ y)+` gives `+proj₁+` trivially; the user can always extract the original `+x+`. The Echo programme proves that _no_ -section exists once specific lossy interfaces are applied. The witness +left inverse exists once specific lossy interfaces are applied; general Σ-types express the same invariant. The witness is a _family_ across five separate decoration layers: -* `+EchoCharacteristic.no-section-collapse+` — no section of the -`+Bool → ⊤+` collapse map. -* `+EchoCharacteristic.no-section-visible+` — no section recovering the +* `+EchoCharacteristic.no-section-collapse+` — no left inverse of the `+Bool → ⊤+` collapse map, which has two right inverses. +* `+EchoCharacteristic.no-section-visible+` — no left inverse recovering the pre-image from a visible output alone. * `+EchoResidue.no-section-collapse-to-residue+` — weakening to a residue is provably one-way. @@ -57,8 +62,7 @@ is one-way (defined as the residue lemma). case. All six are pinned in `+Smoke.agda+`. The family is what carries the -weight: each decoration _separately_ refuses the section that a raw Σ -would admit. See also `+docs/theorem-index.md+` and the prose write-up +weight only as selected examples: each non-injective collapse lacks a left inverse. Raw Σ can express exactly these examples; it admits no missing inverse. See also `+docs/theorem-index.md+` and the prose write-up at `+docs/characteristic.adoc+`. ==== 2. Loss is graded, and downgrades cannot be reversed @@ -76,13 +80,13 @@ the loss-grade order. Same recipe lands at: ** `+EchoCost+` (cost-indexed refinement), ** `+EchoSearch+` (witness-search refinement). * _Up-step is not._ `+no-section-weaken+` (item 1) is the same statement -on the other diagonal — once degraded, no inverse exists. +on the other diagonal — that non-injective down-map has no left inverse. -Honest framing: this is a _thin-poset reindexing modality_, not a graded +Honest framing: this is a _preorder-indexed diagram_, not a graded comonad. The retraction at `+docs/retractions.adoc#R-2026-05-18+` narrowed an earlier "`graded comonad`" claim. The reindexing modality is the load-bearing structure and is the right answer to "`is Σ enough?`": -Σ alone gives neither the monotone reindex nor the no-section dual. +Both the indexed action and the non-injectivity theorem are definable with ordinary dependent pairs and equality. This does not separate Echo from general Σ-types. ==== 3. Echo is the homotopy fibre; bridges from other "`loss-tracker`" frameworks exist diff --git a/docs/CLAIMS_AUDIT.adoc b/docs/CLAIMS_AUDIT.adoc index 4d04440a..6b104dea 100644 --- a/docs/CLAIMS_AUDIT.adoc +++ b/docs/CLAIMS_AUDIT.adoc @@ -920,3 +920,13 @@ and `NONE-PROPOSED` / `LOCATE-FAILED` placeholders. The four WEAKER-THAN-CLAIM rows are the load-bearing follow-ups for the next Gate G1 session; the remainder of the inventory is either backed at strength or honestly framed as a non-claim. + +[NOTE] +==== +2026-11-06 context: entries above retain their historical dates. For current fibre, inverse-direction, categorical-interface and verification boundaries, consult link:audit/2026-11-06-evidence.adoc[the foundation evidence ledger]. Historical “no-section” negatives concern left inverses; a scoped erasure obstruction does not prohibit every graded comonad. +==== + +[NOTE] +==== +2026-11-06 archival update (#193): the historical root `CLAUDE.md.audit` variant is now link:archive/provenance/CLAUDE.md.audit[archived under docs/archive/provenance]. Its bytes and original licence notice are unchanged. The adjacent link:archive/provenance/CLAUDE-audit-provenance.adoc[provenance record] identifies the original source revision, blob, and SHA256. The root `CLAUDE.md` remains the active instruction file. +==== diff --git a/docs/archive/provenance/CLAUDE-audit-provenance.adoc b/docs/archive/provenance/CLAUDE-audit-provenance.adoc new file mode 100644 index 00000000..b76994cf --- /dev/null +++ b/docs/archive/provenance/CLAUDE-audit-provenance.adoc @@ -0,0 +1,12 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Archived Claude audit variant — provenance + +On 2026-11-06, the tracked root file `CLAUDE.md.audit` was moved without changing its bytes to link:CLAUDE.md.audit[the archived audit variant], addressing issue #193. It is historical audit material, not the active agent instruction file. The active file remains `CLAUDE.md` at the repository root. + +* Original path: `CLAUDE.md.audit`. +* Source revision: `cd85288dcce55191ad477c0fa7d1d2421514a0d3`. +* Original Git blob: `17a15843fbd7eb831cbb09d9dcc92e63a87e3079`. +* SHA256 before and after relocation: `44c0b15c14b3b4b66649a4eeb130222983bd1bebbedc451b572881345a67a374`. + +The original location mentioned in `docs/CLAIMS_AUDIT.adoc` is retained as a historical record. Its current archival location is the link above; statements inside the old variant must be interpreted at their original date. diff --git a/CLAUDE.md.audit b/docs/archive/provenance/CLAUDE.md.audit similarity index 100% rename from CLAUDE.md.audit rename to docs/archive/provenance/CLAUDE.md.audit diff --git a/docs/audit/2026-11-06-evidence.adoc b/docs/audit/2026-11-06-evidence.adoc new file mode 100644 index 00000000..c36536e7 --- /dev/null +++ b/docs/audit/2026-11-06-evidence.adoc @@ -0,0 +1,113 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Foundation audit evidence — 2026-11-06 + +== Scope and baseline + +The initial foundation-audit stage authorized bounded local changes only; commits, pushes, and pull requests were outside that initial authorization. Later on 2026-11-06, the user authorized implementing the agreed local corrections and then pushing/merging under the applicable repository gates. Release actions therefore follow that later authorization and its verification requirements. Ordinal mathematics remains excluded; residual imports are build evidence only. The link:2026-11-06-repository-readiness.adoc[release issue log] records the final publication scope and gate outcomes. + +The baseline is main `cd85288dcce55191ad477c0fa7d1d2421514a0d3`, tree `74db6f3b4f4907ca02fb45903a161e1546b9ff6e`. Remote Agda workflow run `41687674126` was reported successful for that baseline. That is historical remote evidence, not a fresh local result. Baseline inventory: 382 tracked files, 147 Agda files, 144 in scope after excluding three ordinal files; 127 files in the union of seven CI-root closures and 17 outside it. These numbers must not be carried forward to the edited tree without recounting. + +== Baseline source inspection + +* `Echo.agda`, `EchoTotalCompletion.agda`: standard dependent fibre and source-retaining total completion; no general distinction from Σ and no grade parameter. +* `EchoNoSectionGeneric.agda`: historical no-section identifiers negate a left inverse. Boolean collapse has two constant right inverses. +* `Echo/Index/ThinPoset.agda`, `Echo/Modality/Interface.agda`: thin preorder fields and a diagram action; no antisymmetry or reflective-modality interface. +* `EchoSeparating.agda`: the counterexample concerns arbitrary parallel arrows. Chosen-composite functoriality is a separate law. +* `EchoVariance.agda`: supplied-factorisation fibre inverses do not supply a full tropical graded monad. +* The baseline experimental `GradedComonadStructure` omits naturality; any new companion must provide its additional obligations explicitly. A universal ban on graded comonads involving loss does not follow from an erasing-carrier obstruction. +* Baseline `EchoCNOBridge.agda`: constant `Program → ⊤`, ignored program index and ignored certificate. Unrestricted identity-fibre equivalence does not characterize identity: Boolean negation is the counterexample. +* `EchoResidueCell.agda`: read-after-consume equation, with duplicable original inputs. No runtime refinement follows. +* `EchoThermodynamicsArbitrary.agda`: model cost equations with a finite-count compatibility result; no physical theorem follows solely from those definitions. +* `.github/workflows/agda.yml`, `tools/check-guardrails.sh`: seven roots, three guard exemptions, current N5 inclusion, exact dependency commits, apt Agda 2.x, and no flake-check job. The formerly named flake facility is absent. + +== Fresh local verification + +Agda `2.7.0.1` completed all 15 direct/audit entrypoints and all seven existing CI roots successfully on the edited proof snapshot. The latter include `All`, `Smoke`, `characteristic/All`, `examples/All`, `experimental/echo-additive/All`, `NarrowingSmoke`, and the separate Cubical root. Ordinary checks use the safe, without-K profile; the Cubical root retains its separate safe Cubical profile. These are local results, distinct from remote baseline run `41687674126`. + +Raw receipts are local-only, ignored artifacts under `build/audit-2026-11-06/`; they are not committed and will not be available through these links in a remote checkout. The links are usable in this working checkout or after reproducing the commands. Tracked summaries in this ledger and link:2026-11-06-repository-readiness.adoc[the release issue log] provide the reviewable results and reproduction requirements. The local artifacts are: link:../../build/audit-2026-11-06/results.tsv[entrypoint results], link:../../build/audit-2026-11-06/compiler.txt[compiler version], link:../../build/audit-2026-11-06/base-commit.txt[base revision], link:../../build/audit-2026-11-06/proof-sources.sha256[proof-source SHA256 manifest], and individual logs. Comparing the checked snapshot's manifest with the workspace covered 145 proof files with zero mismatches. This establishes the identity of that proof snapshot, not coverage of every file outside the checked imports. + +The foundation guardrail passes with the same three baseline exemptions and no added exemption. The fresh `--ignore-interfaces` AuditSmoke check also passes with exit 0; its proof sources remain unchanged. This cold check covers the audit closure, not an assertion that every tracked proof was independently cold-checked. The coordinating audit appends the exact commands and cold receipt below. + +The local inventory after these edits is 155 Agda files, 152 in scope after excluding the same three ordinal files, and 135 in the union of the seven existing CI-root closures. The 17 outside that union are unchanged. These are current local counts; the historical baseline counts above remain dated to their own revision. + +The checks emit `UnsupportedIndexedMatch` warnings, including standard-library warnings and warnings on the new ordered-erasure proofs `grade-change-compose` and `grade-change-δ`. Agda accepts these proofs in the recorded profile, but reports a limitation on Cubical transport computation for those indexed matches. A successful check is not a claim that those transports compute in Cubical mode. Consult the individual logs for the exact diagnostics. + +== Checked local declarations and their scope + +`EchoSourcePreserving` proves that a source-preserving fibre isomorphism with identity fibres yields pointwise identity, and constructs the converse with its pointwise inverse laws. Boolean negation supplies the counterexample to unrestricted fibre equivalence as an identity criterion. + +`EchoCNOSemantics` ties a stored provenance witness and certificate to the same program. It relates native nullness using `CNO.state-eq` to `IsCNO` within the pinned dependency's total, zero-energy model, and supplies a Nop negative control. Its `SourcePreservingStateMap` criterion characterizes native nullness using a source-preserving *map of relation-valued fibres*. That record does not assert the two inverse laws of `EchoSourcePreserving.FibreIso`; the two interfaces must not be conflated. + +`EchoDependentPushforward` proves family hom-setoid category laws, pushforward/reindexing action laws, a natural hom correspondence, unit/counit triangles, a terminal-family fibre comparison, and a natural isomorphism for composition. The equality on homs is pointwise, without a global funext or UIP axiom. The composition comparison is not a full proof of coherence for an arbitrary base-indexed pseudofunctor or fibration package. + +`EchoGradedComonadNaturality.NaturalGradedComonad` supplies the missing pointwise congruence and naturality obligations as a companion preserving the existing record. The F1, natural-grade, and list-grade witnesses pass their local checks. Grade-local UIP for natural/list transports is not a global source-type UIP principle. `EchoNaturalityIndependence` provides the bounded countermodel motivating the extra interface fields. + +`EchoErasingGradedComonad` checks a natural graded comonad whose grade-zero carrier is `A` and positive-grade carriers are unit, including a non-injective erasure witness. Its ordinary natural-order degradation maps and compatibility equations are also accepted, subject to the Cubical transport warnings above. This refutes a blanket impossibility of graded comonads involving information loss. It does not identify the construction with an intended tropical Echo model or recover erased sources. `EchoThinPreorderExample` confirms that the abstract thin-preorder record need not satisfy antisymmetry. + +The choices and bounded research packets are recorded in `2026-11-06-foundation-decisions.adoc`. No new linear runtime or ordered tropical programme is implied by these repairs. + +== Open research obligations + +Novelty and priority require a literature comparison. Scoped lossy-encoding counterexamples do not separate Echo from Σ-types, all resource algebras, or arbitrary linear encodings. The source-sensitive CNO characterization is now proved at the explicit scopes above. Reflective modality structure, a full tropical graded monad, full base-indexed categorical coherence, runtime refinement, minimal residue storage, and physical interpretations remain separate specification and evidence obligations. Ordinal proof work is outside this audit. + +== Exact toolchain and reproduction + +* Compiler: Agda 2.7.0.1, Linux executable SHA-256 `6de41437c14c05c9fe576d724cc67386444c0fa9fee662a08250fefb91bee8b6`. +* Standard library: `8326c7475af1fa456ca04a0203c168d5d7ff842b`. +* absolute-zero: `f486c29903434589117fa0662c6f29b0f17d1d5f`. +* Dependency Agda sources have no tracked differences from those revisions. Non-Agda working-tree files are not evidence about proof dependencies. +* Local implementation: `C:/Users/sudoodle/OneDrive/Documents/ChatGPT/TYPE THEORY/echo-types-proof-work`. + +To avoid Windows/OneDrive interface-loading overhead, the final checks used a Linux snapshot at `/tmp/echo-audit-20261106.xrmuUy/repo`, with adjacent `agda`, `stdlib` and `cno` directories. SHA-256 comparison verified all 145 proof-source files against the working tree. The two final edits after the cold audit were comment corrections in `All` and `EchoVariance`; the final `All` check passed, and the final source manifest was compared again with the checked snapshot. The cold `AuditSmoke` dependency sources were unchanged. + +The reproducible ordinary/Cubical suite is `tools/check-audit.sh`; from the snapshot root the environment was: + +[source,bash] +---- +export Agda_datadir=/tmp/echo-audit-20261106.xrmuUy/agda/data +export AGDA=/tmp/echo-audit-20261106.xrmuUy/agda/bin/agda +export AGDA_STDLIB=/tmp/echo-audit-20261106.xrmuUy/stdlib/src +export ABSOLUTE_ZERO_AGDA=/tmp/echo-audit-20261106.xrmuUy/cno +bash tools/check-audit.sh +---- + +It passed 15 direct/audit targets and the seven existing CI roots. The separate cold check also exited zero: + +[source,bash] +---- +"$AGDA" --ignore-interfaces --no-libraries --safe --without-K --cubical-compatible \ + -i proofs/agda -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" \ + proofs/agda/AuditSmoke.agda +---- + +`tools/check-guardrails.sh proofs/agda` passed with its three existing exemptions. A line-ending-normalized temporary copy of the unchanged guard script was used under WSL. `git diff --check` also passed. The original inventory receipt used `python3 tools/audit-inventory.py` (historical command at that audit step). The current replacement is `bun tools/audit-inventory.mjs`; its equivalence check is being verified separately. Static coverage is explicitly separate from compiler evidence. + +Local receipts are retained in ignored `build/audit-2026-11-06/`: `results.tsv`, `compiler.txt`, `provenance.txt`, `inventory.json`, `proof-sources.sha256`, `proof-sources-initial.sha256`, `manifest-verification.log`, and individual compiler logs (including `AuditSmoke-cold.log` and `All-final.log`). The original manifest preserves the initial suite/cold-check snapshot; the final manifest includes the two comment corrections. These are local checks, not a new remote CI run. + +No commit, push, branch publication, or pull request was made. Existing ordinal source files were not edited; their inherited aggregate imports were treated only as build boundaries. + +== Governance documentation remediation (2026-11-06) + +The documentation pass read the current `main` snapshots of `hyperpolymath/rsr-template-repo` at `acdc0ebd1d69f3f70995f4eec078e342078dd885` and `hyperpolymath/standards` at `ba640e9a57f22608710ffecdca282074eac55a0b`. The relevant sources were the template's `CONTRIBUTING.adoc`, root-cleanup proposal and standards audit, plus standards' `3-practice/LICENCE-POLICY.adoc`, `docs/SIGNING-POLICY.adoc`, and `scripts/check-licence-consistency.sh`. Template placeholders and proposals were interpreted as such, not as certifications or an instruction to copy nonexistent paths. + +Root `CONTRIBUTING.md` now names the actual roadmap, changelog, trust boundaries, and verification script; `.github/CONTRIBUTING.md` points to it (#323). `TOPOLOGY.adoc` names the existing lowercase roadmap and AsciiDoc README (#192). The placeholder OpenSSF green badge was removed without asserting a replacement certification (#191). + +The root `CLAUDE.md.audit` file was relocated without changing its bytes to `docs/archive/provenance/CLAUDE.md.audit` (#193); its adjacent provenance record stores the original path, revision, blob, and SHA256. The current root instruction file is still `CLAUDE.md`. Every baseline dated entry in `docs/foundation.adoc` was checked against Git and retained unchanged; #335's current correction was appended. The obsolete flake filename now occurs in documentation only inside dated foundation history. + +For #282, `LICENSE` already has a matching MPL-2.0 SPDX header and body; it has no diff. No licence text or existing licence identifier was changed. The latest standards licence-consistency script was run read-only against this workspace through WSL and exited 0: header/body agreement and the retired-identifier scan passed. Shell startup emitted mise warnings for its unresolved Agda registry entry, missing Rust/just versions, and untrusted local configuration; those were not silently treated as proof-toolchain checks. An initial Git Bash invocation failed to fork and was stopped; only the completed WSL invocation is the licence-gate receipt. + +Contribution links resolve, the archive matches its pre-move SHA256, and `git diff --check` passes. These local checks do not certify OpenSSF status or modify remote repository settings. The older CC-BY-4.0 documentation declaration in README and `LICENSE-docs` differs from many per-file CC-BY-SA-4.0 headers and the estate default; reconciling that existing licence history remains an owner decision, outside this no-relicensing correction. + +The current static invocation-profile check is `sh scripts/check-agda-invocations.sh`. Earlier Python invocations in dated receipts describe the previous implementation; they are not current setup instructions. The Bun inventory conversion and shell guard conversion require their own equivalence checks, distinct from the completed Agda source checks above. + +=== Prose licence scope — owner decision packet + +`LICENSE-docs` was introduced by Jonathan D.A. Jewell in commit `d30dc732d81dc50b361b1c586d45f8a581812c56` (2026-04-23) and contains CC Attribution 4.0 text. Current README combines an MPL-2.0 header with a blanket CC-BY-4.0 prose declaration; owner-authored commit `a3853b744f745ba126a93b47638f59c1a0d49fce` (2026-08-17, “Change license and revise Echo Types glossary”) reinstated that combination. In contrast, `docs/foundation.adoc` has a CC-BY-SA-4.0 header, and CLAUDE's 2026-06-18 record describes owner-authorized ShareAlike relicensing of nine named files. The current `FOUNDATION_CONTRACT.adoc` and `docs/theorem-index.adoc` counterparts have no leading SPDX header. That record does not identify `LICENSE-docs` as changed. Commit authorship and file notices provide provenance, not a complete determination of rights over every historical contribution. + +The bounded decision is the intended licence scope per path: either document the existing split and resolve README's conflicting notices explicitly, or authorize a broader prose-policy reconciliation after checking its scope and provenance. The estate's current ShareAlike default alone does not establish which project-specific historical notices should be rewritten. Preserve the existing licence texts and prior notices until that owner decision. The successful code-LICENSE consistency gate does not resolve this prose question. + +The bounded link:2026-11-06-license-inventory.adoc[licence inventory] records the actual current notices, nine-path ruling, later owner commits, missing declarations, and the pending per-file versus prospective-ShareAlike choice. It is evidence rather than legal assurance. + +=== Authorization and receipt-delivery update (2026-11-06) + +The opening scope paragraph now distinguishes the initial local-only audit from the user's later authorization to implement, push, and merge under gates. This records the change in authorization rather than treating the original stage as permanent. The raw `build/audit-*/` receipt files are ignored local outputs, not remotely available evidence attachments. Reproducible commands, exact source/toolchain identifiers, successful results, and material warnings must remain in tracked summaries and link:2026-11-06-repository-readiness.adoc[the release issue log]; a link to an ignored local log alone is insufficient for remote review. diff --git a/docs/audit/2026-11-06-foundation-decisions.adoc b/docs/audit/2026-11-06-foundation-decisions.adoc new file mode 100644 index 00000000..b1d71308 --- /dev/null +++ b/docs/audit/2026-11-06-foundation-decisions.adoc @@ -0,0 +1,174 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Foundation decisions and bounded follow-up work — 2026-11-06 + +== Authority, scope, and baseline + +The coordinating review may implement and check local changes. No commits, +pushes, or pull requests are authorized. Ordinal mathematics is excluded. +The work starts at main `cd85288dcce55191ad477c0fa7d1d2421514a0d3`. +The existing proof workspace contained eight authorized edited files from +the earlier proof chat; those changes were retained and completed here. + +link:2026-11-06-evidence.adoc[The evidence ledger] separates baseline remote +CI from fresh local checks and records toolchain, source hashes and warnings. + +== Decisions made + +[cols="1,4,4",options="header"] +|=== +|Decision |Chosen contract |Reason and boundary +|M1: categorical foundation +|Families at an explicit common universe, with fibrewise functions and +pointwise hom equality. Keep the intensional fibre kernel unchanged. +|`EchoDependentPushforward` gives hom-setoid category laws, functor laws, +natural transposition, unit/counit and triangle equations. No global +function extensionality, global UIP, resizing, or assumption that every +Agda `Set` is a homotopy set is introduced. +|M2: CNO meaning +|Keep the legacy API compatible; add `CertifiedProgramEcho p`, binding +the stored program to `p` and retaining `IsCNO p`. Use native `state-eq`. +|`EchoCNOSemantics` connects certification to execution under the pinned +total evaluator and zero-energy model. It does not silently strengthen +pointwise memory equality to propositional equality of states. +|M3: graded interface +|Add `NaturalGradedComonad S` as a companion to the existing record. +|The companion requires map action to respect pointwise equality, +counit/comultiplication naturality, and equality uniqueness for grades. +Natural/list grade uniqueness is proved from decidable equality; this +does not assert global UIP for residues or source types. +|M4: scope and research direction +|Use dependent pushforward as the established account of core composition. +Treat the ordered loss diagram and concrete graded comonads as separately +specified structures. Withdraw universal separation/novelty assertions. +|A monotone erasing graded comonad refutes a blanket obstruction even with +ordinary natural-number degradation. It does not settle the intended +extended tropical model. Linear runtime enforcement, minimal complements, +reflective modalities and priority claims need independent targets. +|=== + +== Completed implementation obligations + +[cols="1,2,5",options="header"] +|Original action |Implementation |Acceptance meaning +|D1/D2 +|Corrected active source comments, README, contracts, canonical docs and +roadmaps; dated historical records retain their context. +|Left-inverse wording, thin-preorder scope, parallel-arrow independence, +retained-witness recovery, CNO and thermodynamic limits, CI coverage, +truncation profiles and compiler pinning are distinguished. +|P1 +|`EchoSeparating`, `EchoThinPreorderExample` +|The parallel-arrow category and its Boolean action are functorial; +arbitrary-arrow independence still fails. Thinness does not imply antisymmetry. +|P2 +|`EchoCharacteristic`, `EchoResidue`, `EchoNoSectionGeneric` +|Two right inverses of Boolean collapse coexist with no input-reconstructing +left inverse. Compatibility theorem names are retained. +|P3 + M3 +|`EchoGradedComonadF1`, both instances, companion record +|Concrete naturality, map congruence and grade equality witnesses are +packaged for the existing natural-number and list constructions. +|P4 +|`EchoSourcePreserving`, `EchoErasingGradedComonad` +|Boolean negation satisfies unrestricted fibre equivalence but is not +identity. The erasing graded comonad satisfies the structural and naturality +laws while positive-grade Boolean recovery fails; monotone grade-change +naturality, composition and comultiplication compatibility are also proved. +|P5 +|`EchoSourcePreserving`, `EchoCNOSemantics` +|Source-preserving fibre isomorphisms characterize pointwise identity. +For native CNO relation-valued fibres, a source-preserving MAP criterion +characterizes native nullity. Inverse equations for relation witnesses are +not asserted. Empty/Halt certificates and a Nop negative control are supplied. +|P6 +|`EchoDependentPushforward` +|Dependent pushforward is left adjoint to reindexing at the pointwise +hom-setoid level; Echo is pushforward of the terminal family. Composition +is a natural isomorphism for fixed base maps. Full base-indexed identity +and triple-composition coherence are not included in this claim. +|Additional bounded result +|`EchoNaturalityIndependence` +|A one-object category with Boolean endomaps satisfies the objectwise +comonad equations with negation as counit/comultiplication, but fails +naturality against a constant map. This is a categorical countermodel, +not an inhabitant of the existing polymorphic `Set → Set` record. +|D3 +|Evidence ledger, this decision record, `AuditSmoke`, `tools/check-audit.sh` +|Claims refer to explicit declarations, assumptions, compiler receipts and +remaining obligations. New mathematical claims require successful checks. +|=== + +== Bounded follow-up packets + +These are specified follow-ups, not claims of completed implementation. +Each must preserve the current safety profile, add no postulates or global +extensionality axiom, and pass direct checking plus the affected aggregate. +No task may silently expand into ordinal work or a runtime implementation. + +[cols="1,1,4,4",options="header"] +|Packet |Model |Exact task |Acceptance and escalation boundary +|F1: arbitrary source-preserving comparison +|Medium +|Generalize `EchoSourcePreserving` from `f` versus identity to `f,g : A → B`. +Define source-preserving fibre maps in both directions from a pointwise +equation; obtain the equation from one source-preserving forward map. +|Recover `f x ≡ g x` by applying the map to the canonical witness over +`f x`. Prove inverse equations when packaging the induced fibre isomorphism. +No claim about arbitrary equivalences without source preservation. +|F2: native CNO packaging +|Medium +|Package the existing implications among `NativeNull p`, `IsCNO p`, +`CertifiedProgramEcho p` and `SourcePreservingStateMap p` as logical +equivalences; prove composition via the native certificate API. +|Logical implications only: do not equate proof records or assert a +propositional isomorphism of relation-witness spaces. Preserve same-program +indices and the pinned dependency's model assumptions. +|F3: base-composition coherence +|High +|Add the identity-base pushforward isomorphism and triple-composition +coherence; identify the terminal-family instance with `Echo-comp-iso`. +|State diagrams pointwise, use equality elimination, and check all legs +have matching indices. Do not use funext to collapse diagram equations. +The root reviews the diagram orientations before any pseudofunctor claim. +|F4: epistemic dependent products +|High +|Define the right dependent product along `obs`, give the natural hom +correspondence `Reindex obs ⊣ Product obs`, and identify the existing +universal-over-observation-fibres predicate as its proposition-valued case. +|Prove both round trips, naturality and triangles pointwise. Keep this +adjunction separate from the loss diagram and from probabilistic knowledge. +|F5: iterated-product graded monad +|High +|Invert the already natural F1/list splitting isomorphisms, define the +unit and multiplication, and prove the graded-monad coherence equations. +|Use the same explicit grade monoids and pointwise hom equality. A map +with multiplication's shape is insufficient. Do not transfer the result +to the general fibre kernel or tropical loss interpretation. +|F6: reproducible evidence refresh +|Medium +|Run `tools/check-audit.sh` with the recorded compiler/dependency revisions; +refresh source manifests, import-closure counts, and the dated status table. +|Do not change theorem meanings, compiler flags, or dependency revisions to +obtain a pass. Report exact failure and return it to the coordinator. +|=== + +== Research questions that are not routine proof repair + +* A minimal-residue theorem must specify the representation class, its +cost measure, and whether domains are finite/decidable. A retained source +witness is sufficient for recovery; it is not automatically minimal. +* Enforced consumption requires an operational or typing contract, such +as opaque handles and a heap transition system. The present pure Agda +cell permits retaining an earlier holding value. A Rust/Idris refinement +needs an identified implementation revision and a simulation relation. +* A tropical claim must give the complete index category, tensor/unit, +infinity behavior, grade-change direction and coherence laws. The new +natural-number counterexample rules out using loss alone as an obstruction. +* Priority cannot be inferred from successful typechecking or internal +gate labels. The kernel is a standard dependent fibre; a proposed new +contribution needs a precise additional theorem or an evaluated application +advantage and a primary-literature comparison. + +The coordinator retains responsibility for theorem meanings and these +research decisions; the bounded packets delegate implementation, not +permission to strengthen claims. diff --git a/docs/audit/2026-11-06-license-inventory.adoc b/docs/audit/2026-11-06-license-inventory.adoc new file mode 100644 index 00000000..3d844c6c --- /dev/null +++ b/docs/audit/2026-11-06-license-inventory.adoc @@ -0,0 +1,109 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Prose licence inventory and bounded decision — 2026-11-06 +:toc: macro + +== Scope + +This is an evidence inventory of the current local notices relevant to the README/prose conflict and CLAUDE's nine-file ruling. It is not a repository-wide rights audit or legal assurance. The source baseline is `cd85288dcce55191ad477c0fa7d1d2421514a0d3`, with the current uncommitted documentation corrections. No existing licence text or licence identifier is changed by this inventory. + +== Current notices and supporting texts + +[cols="2,3,3",options="header"] +|=== +| Source | Observed declaration | Scope limitation + +| link:../../README.adoc[README.adoc] +| Leading SPDX identifier `MPL-2.0`; License section repeats it, while the next paragraph declares `docs/`, README, and roadmap prose `CC-BY-4.0` and points to `LICENSE-docs`. +| The header and blanket prose sentence do not give one consistent declaration for README itself. The blanket sentence also overlaps files with explicit ShareAlike headers. + +| link:../../LICENSE[LICENSE] +| `SPDX-License-Identifier: MPL-2.0` and matching MPL 2.0 body; copyright notice names Jonathan D.A. Jewell, 2024–2026. +| This file has no diff. The latest standards code-licence consistency check passes; that check does not settle prose scope. + +| link:../../LICENSE-docs[LICENSE-docs] +| CC Attribution 4.0 International body; no leading SPDX identifier. +| This is the text named by the blanket README declaration. Its presence alone does not resolve conflicting file-specific notices. + +| link:../../LICENSES/CC-BY-SA-4.0.txt[LICENSES/CC-BY-SA-4.0.txt] +| Attribution-ShareAlike 4.0 International text. +| A supporting licence text, not by itself a per-path scope declaration. + +| link:../foundation.adoc[docs/foundation.adoc] +| `CC-BY-SA-4.0` SPDX header; copyright names Jonathan D.A. Jewell, 2025–2026. +| A concrete file-specific notice overlapping README's blanket CC-BY-4.0 sentence. + +| link:../../CONTRIBUTING.md[CONTRIBUTING.md] and link:../../.github/CONTRIBUTING.md[.github/CONTRIBUTING.md] +| The newly written guide and pointer carry `CC-BY-SA-4.0` and a 2026 copyright notice naming Jonathan D.A. Jewell. +| New text follows the current estate prose default. This does not relicense older files. + +| link:../archive/provenance/CLAUDE.md.audit[archived CLAUDE.md.audit] +| Original `MPL-2.0` notice retained unchanged; original copyright names Jonathan D.A. Jewell. +| Archived provenance is preserved byte-for-byte; it is not a current instruction or a precedent for relicensing other prose. +|=== + +== Nine-file ruling recorded in CLAUDE + +The 2026-06-18 session entry in link:../../CLAUDE.md[CLAUDE.md] reports an owner-authorized move of nine long-form documents to `CC-BY-SA-4.0`, identifying abbreviated commits `879ec9b` and `f6cc023`. The entry's illustrative “before → after” strings both read ShareAlike, so that line alone does not prove each predecessor's actual identifier. The table distinguishes the historical path names from their current filename counterparts; it does not infer that a missing current header has been restored or that every intervening migration preserved it. + +[cols="2,2,2",options="header"] +|=== +| Historical path named in ruling | Current counterpart | Current leading SPDX notice +| `FOUNDATION_CONTRACT.md` +| link:../../FOUNDATION_CONTRACT.adoc[`FOUNDATION_CONTRACT.adoc`] +| No leading SPDX identifier found +| `docs/theorem-index.md` +| link:../../docs/theorem-index.adoc[`docs/theorem-index.adoc`] +| No leading SPDX identifier found +| `docs/CLAIMS_AUDIT.adoc` +| link:../../docs/CLAIMS_AUDIT.adoc[`docs/CLAIMS_AUDIT.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `docs/echo-types/fibration-package.adoc` +| link:../../docs/echo-types/fibration-package.adoc[`docs/echo-types/fibration-package.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `docs/echo-types/universal-property.adoc` +| link:../../docs/echo-types/universal-property.adoc[`docs/echo-types/universal-property.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `wiki/Architecture.adoc` +| link:../../wiki/Architecture.adoc[`wiki/Architecture.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `wiki/Overview.adoc` +| link:../../wiki/Overview.adoc[`wiki/Overview.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `wiki/Roadmap.adoc` +| link:../../wiki/Roadmap.adoc[`wiki/Roadmap.adoc`] +| `CC-BY-SA-4.0` (line 1) +| `wiki/Working-Rules.adoc` +| link:../../wiki/Working-Rules.adoc[`wiki/Working-Rules.adoc`] +| `CC-BY-SA-4.0` (line 1) +|=== + +Seven mapped files have explicit ShareAlike headers; `FOUNDATION_CONTRACT.adoc` and `docs/theorem-index.adoc` have no leading SPDX identifier. Those two missing declarations are evidence gaps, not permission to assign a licence automatically. The ruling does not name `LICENSE-docs` or README as one of those nine files. + +== Provenance that prevents an automatic sweep + +* Owner commit `d30dc732d81dc50b361b1c586d45f8a581812c56` (2026-04-23, “meta: add explicit top-level licenses”) introduced `LICENSE-docs` with the Attribution 4.0 body. +* Owner commit `ac99259f6294cacd95d05ff19c9f4d0d359b732f` (2026-06-13, “docs(licence): align prose SPDX headers to CC-BY-SA-4.0 (ShareAlike)”) changed `docs/foundation.adoc` from `CC-BY-4.0` to `CC-BY-SA-4.0`. +* Owner-authored commit `a3853b744f745ba126a93b47638f59c1a0d49fce` (2026-08-17, “Change license and revise Echo Types glossary”) replaced README's ShareAlike header with MPL-2.0 and reinstated the blanket CC-BY-4.0 prose sentence. This later explicit project history cannot be dismissed solely because the estate default says ShareAlike. +* Current standards snapshot `ba640e9a57f22608710ffecdca282074eac55a0b`, `3-practice/LICENCE-POLICY.adoc` Rule 1, defaults original prose to `CC-BY-SA-4.0`; `docs/AUDIT.adoc` makes licence/SPDX drift manual-only. Template snapshot `acdc0ebd1d69f3f70995f4eec078e342078dd885` supplies the current contribution/signing examples. Neither source supplies a project-specific decision resolving README's contradictory notices. + +Commit authorship and copyright labels establish observable provenance; they do not establish complete ownership of every historical contribution or resolve the effect of earlier notices. No inference of relicensing authority is made here. + +== What the pending choice changes + +[cols="2,3,3",options="header"] +|=== +| Choice | Bounded follow-up | Material still requiring an owner decision + +| Preserve a per-file split +| Describe the intended path-specific policy instead of a blanket prose sentence; retain supporting texts for the licences actually declared. +| Resolve README's competing MPL/BY declarations and the two missing current headers using their provenance. Confirm whether the nine-file ruling still defines their intended scope. + +| ShareAlike for future prose, preserving historical grants +| State a prospective policy and its effective scope; record the existing notices and history instead of rewriting archived material. +| Specify how existing files and future edits are treated, and which notices are to be reconciled. This choice alone does not authorize a blanket rewrite of existing licences. +|=== + +While the choice is pending, keep current legal texts and existing identifiers unchanged, preserve archive bytes and historical records, and report the ambiguity explicitly. Any later metadata or notice correction should cite the chosen scope and the specific files it affects. + +The coordinating link:2026-11-06-repository-readiness.adoc[repository-readiness log] records the pending owner decision and any subsequently authorized notice changes. diff --git a/docs/audit/2026-11-06-repository-readiness.adoc b/docs/audit/2026-11-06-repository-readiness.adoc new file mode 100644 index 00000000..e0e391b3 --- /dev/null +++ b/docs/audit/2026-11-06-repository-readiness.adoc @@ -0,0 +1,173 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Repository readiness and issue log — 2026-11-06 +:toc: + +== Scope and release rule + +The owner authorized local implementation, then explicitly authorized pushes, +pull requests and appropriate merges on 2026-11-06. This supersedes the audit's +initial read-only and subsequent local-only phases. Ordinal mathematics remains +excluded; the three residual ordinal source files are unchanged. + +This ledger distinguishes source corrections, executed checks, external service +results and unresolved decisions. A configured scanner is not a passing scan; +an unsupported language is not clean coverage. No certification or numerical +stability score is asserted. The six bounded mathematical follow-up packets in +link:2026-11-06-foundation-decisions.adoc[the foundation decisions] remain research +work; repository setup does not discharge them. + +Baseline main: `cd85288dcce55191ad477c0fa7d1d2421514a0d3`. +Work branch: `audit/foundations-and-repository-standards-20261106`. +No failing or absent mandatory check is to be bypassed for merge. + +== Owning sources consulted + +[cols="2,4",options="header"] +|=== +|Source |Revision +|`metadatastician/standards` |`ba640e9a57f22608710ffecdca282074eac55a0b` +|`hyperpolymath/rsr-template-repo` |`acdc0ebd1d69f3f70995f4eec078e342078dd885` +|`hyperpolymath/k9-ecosystem` |`20f6be5b5a14a48680b236955b5c4ad9033d00d4` +|`hyperpolymath/deed-ecosystem` |`5b1d7f50f11054d85376972af90785c83d5665c0` +|`hyperpolymath/contractiles` |`213fe715ffc11e8dac729c7cd835cfb54d11f999` +|`hyperpolymath/gv-clade-index` |`2cfabd15d6cb966ed369ee13aa7174b960f45abd` +|`hyperpolymath/panic-attack` |`6d3d52a632626109ceef1102a8141b2cfa27fe70` +|`hyperpolymath/pons-asinorum` |`b9ab55c6973514a731c7659a2fbee21b5037b1ef` +|=== + +The standards repository has moved owners. Its proof policy, language policy, +DEED/K9 validators, template, repository-settings payload, Actions allowlist and +ruleset derivation policy are the authorities used here. The template is a +reference, not an unrelated nested repository copied into Echo Types. + +== Findings and disposition + +[cols="1,3,5",options="header"] +|=== +|Issue/finding |Evidence |Disposition / acceptance +|#330; workflow startup failures +|Governance run `41687676542` explicitly rejects the transferred +`metadatastician/standards` reusable workflow; Secret Scanner `41687680268` also +has zero jobs. Both were triggered by the owner, so these failures are distinct +from the historical arena actor incident. +|Apply the current canonical allowlist and require fresh jobs/check results. +Old startup-failed runs cannot be retried; use a new branch/PR run. +|#324 allowlist drift +|Live list had 93 entries; current canon has 95. Tailscale was already present. +|Applied the exact case-sensitive union without pruning. Added the transferred +standards-workflow pattern and `step-security/harden-runner@*`; required SHA +pinning remains enabled. +|Repository permissions +|Default workflow token was write and workflows could approve PR reviews. +|Applied canonical read-only default and disabled workflow PR approvals. +Repository merge settings are squash-only; security updates, vulnerability +alerts, secret scanning and push protection remain enabled. +|#322 compiler provenance +|Old CI used unpinned distribution packages. +|`scripts/setup-agda.sh` pins official Agda 2.7.0.1 archive SHA256 +`975b515a14877ab6bce5bfc641e16c4a3ee52ca5d7f846577dee80aa2145db8a`, +stdlib `8326c7475af1fa456ca04a0203c168d5d7ff842b`, and absolute-zero +`f486c29903434589117fa0662c6f29b0f17d1d5f`. Positive setup and wrong-checksum/ +nonexistent-version rejection checks pass locally. +|#321 / #320 distinct proof lanes +|Experimental and narrowing roots existed as steps, without distinct job signals. +|Separate experimental, narrowing and Cubical jobs, preserving core and cold +checks. Require real pass results and negative mutation checks before closure. +|#269 / #268 scan coverage and token scopes +|CodeQL actions scan works; several Scorecard findings refer to old action refs +and token scopes. +|Pin direct actions, grant writes only to jobs needing them, and scan the actual +JavaScript tooling. Neither CodeQL nor Scorecard proves Agda theorems. +|Hypatia alert #329 +|Tracked Python invocation checker violates the current language policy. +|Replaced with `scripts/check-agda-invocations.sh`. New inventory uses +`bun tools/audit-inventory.mjs`; its Agda closure counts and outside-closure list +match the prior inventory exactly. No blanket suppression added. +|Hypatia alerts #328, #244, #240 +|Missing chora deed, npx configuration and workflow hardening findings. +|Populate canonical metadata; update runtime configuration and workflow +hardening; fresh Hypatia result is required. +|#323 / #189 / #190 / #188 metadata and template drift +|Retired A2ML, uninstantiated template fields, stale contractiles and missing +root CONTRIBUTING were still active. +|Migrate to the current one-deed model and scoped K9 declarations; preserve +provenance through Git. Use native pinned validators, including Nickel semantics. +No fabricated signatures, certifications or execution receipts. +|#197 clade +|The current owning registry already assigns `fv-echo-types`. +|Use that assignment and its registered identifiers. Its stale ordinal-inclusive +description is not copied as Echo Types scope. +|#282 code licence +|Baseline LICENSE already has a correct MPL-2.0 SPDX header. +|Latest standards licence check passes. No licence text alteration is needed. +The independent prose-licence decision is recorded below. +|#191 / #192 / #193 documentation hygiene +|Placeholder badge, wrong roadmap/README paths, root working-audit dump. +|Remove misleading badge; correct paths; archive the working audit with original +blob and SHA256 provenance. +|#335 foundation history +|Removed toolchain source was still described as current. +|Correct current authority while preserving dated history; historical revisions +are not rewritten as if they used the new toolchain. +|Invented stability metrics +|Justfile printed fixed percentages without a defined measurement. +|Replace with actual build/check recipes and explicit absence of such a metric. +|Toolchain scaffold +|mise enabled unrelated runtimes, package managers and tasks. +|Keep only Bun and just; provision pinned Agda through the checked setup helper. +|PANIC Windows checkout +|Upstream tracked report filenames contain colons, invalid on Windows. +|Record this upstream portability limitation. The checked-out scanner source can +be built; omitted historical reports are not represented as a complete checkout. +|=== + +== Check evidence + +The earlier local proof receipt is in +link:2026-11-06-evidence.adoc[the foundation evidence ledger]. It covers 15 direct +audit roots plus all seven existing aggregate roots and a cold AuditSmoke check. +Its known `UnsupportedIndexedMatch` warnings remain recorded, not suppressed. + +`bun tools/audit-inventory.mjs` reproduces 155 Agda files, 152 in scope, 135 in +the union of seven existing root closures and 17 outside. It is a static import +inventory, not evidence that all 155 files typecheck. The source manifest and +raw logs are local ignored artifacts under `build/audit-2026-11-06/`; this tracked +ledger and linked CI runs provide the distributable summary. + +Baseline GitHub inventory: 28 open code-scanning alerts from Hypatia/Scorecard; +zero open Dependabot alerts and zero open GitHub secret-scanning alerts. This +snapshot is not a claim about future alerts or scanner completeness. The raw +alert values/secrets were not copied into this document. + +PANIC/PONS scans, semantic DEED/K9 validation, final PR checks and final alert +reconciliation are pending in this working ledger and must be appended before +readiness is declared. + +== Decisions and obligations that setup does not settle + +* Prose licensing: historical owner decisions use both CC-BY-4.0 and + CC-BY-SA-4.0. See link:2026-11-06-license-inventory.adoc[the evidence inventory]. + Repository-wide relicensing is not inferred from a generic compliance request. +* OpenSSF Best Practices registration, independent human code review and + published research/DOI validation are not fabricated to clear a score. +* Entropy infrastructure, cross-repository language mirrors, external bridge + research and ordinal work are not silently closed by this release. + +== Reproduction commands + +[source,shell] +---- +git rev-parse HEAD +bun tools/audit-inventory.mjs +sh scripts/check-agda-invocations.sh +sh scripts/kernel-guard.sh +bash tools/check-guardrails.sh proofs/agda +sh scripts/check-experimental-aggregate.sh +bash scripts/setup-agda.sh +# Source the env.sh path reported by setup before local proof checks. +bash tools/check-audit.sh +ECHO_STANDARDS_DIR=/path/to/pinned/standards bash tools/check-metadata.sh +panic-attack assail . --output build/audit-2026-11-06/panic.json +pons scan . --format json --no-speculative --fail-on error +git diff --check +---- diff --git a/docs/bridges/ECHO-CNO-BRIDGE.adoc b/docs/bridges/ECHO-CNO-BRIDGE.adoc index 89362497..01cff87d 100644 --- a/docs/bridges/ECHO-CNO-BRIDGE.adoc +++ b/docs/bridges/ECHO-CNO-BRIDGE.adoc @@ -1,501 +1,32 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -# Echo Types to CNOs Bridge += Echo and certified null operations — bridge boundary +:toc: macro -## Overview +== State preservation and fibres -This document establishes the theoretical bridge between **Echo Types** (from the echo-types repository) and **Certified Null Operations (CNOs)** (from the absolute-zero repository). +A state-preserving semantic function `p : A → A` satisfies `∀ s → p s ≡ s`. Such a function has fibres equivalent to identity fibres. The converse requires the fibre comparison to preserve the source projection; unrestricted fibre equivalence forgets which source is attached to which target. -## Key Insight +The earlier proposed definition `UniversalCNO p = ∀ s → Echo p s ≃ Echo id s` does *not* characterize state preservation. Boolean negation is an equivalence, has contractible fibres like identity, and changes every Boolean. This is a counterexample to that proposed characterization. The former `CNO-Category-Equivalence` declaration on this page was illustrative prose, not a theorem establishing equivalence with absolute-zero's native certificate. -**CNOs are a special case of echo types where the computation is the identity function.** +`EchoSourcePreserving` now proves the source-preserving criterion: preserving `proj₁` as part of the fibre isomorphism yields pointwise identity, and pointwise identity constructs such a fibre isomorphism with both pointwise inverse laws. Its local Agda 2.7.0.1 check passed. This is the corrected characterization for ordinary equality-valued fibres. -- **Echo Types**: `Echo f y := Σ (x : A) , (f x ≡ y)` - fibers over arbitrary functions -- **CNOs**: Programs that preserve state completely (`f = id`) -- **Bridge**: `Echo id s` represents all states that map to `s` under identity (i.e., only `s` itself) +== Baseline bridge -## Mathematical Foundation +At baseline `cd85288dcce55191ad477c0fa7d1d2421514a0d3`, `EchoCNOBridge.agda` imports native `CNO.Program` and `CNO.IsCNO`, but its map is the constant `Program → ⊤`. Its `ProgramEcho _` ignores its program index, and `cno-program-echo p _` ignores the certificate. Every program has this echo witness. Passing native certificates through composition does not by itself connect Echo to execution or state preservation. -### Echo Type Definition +A semantic replacement must use the native execution semantics and the `CNO.state-eq` evidence. Merely importing a certificate type does not establish that bridge. The local audit adds `EchoCNOSemantics` and `EchoSourcePreserving`, using same-program certificates, native `CNO.state-eq`, and source-preserving fibre comparisons. Their local Agda 2.7.0.1 checks passed, along with the ordinary CI roots. `CertifiedProgramEcho` binds the provenance witness and certificate to the same program. `NativeNull` and `IsCNO` imply each other within the pinned dependency’s total, zero-energy model; the Nop negative control changes the program counter. `SourcePreservingStateMap` characterizes native nullness through a source-preserving map of relation-valued fibres using `state-eq`. Its record does not assert the two inverse laws of the ordinary `FibreIso` interface. This is a scoped semantic bridge, not a theorem about all operational models. -```agda -Echo : ∀ {a b} {A : Set a} {B : Set b} (f : A → B) → B → Set (a ⊔ b) -Echo {A = A} f y = Σ A (λ x → f x ≡ y) -``` +== Thermodynamic model -### CNO as Echo Type +`EchoThermodynamics`, `EchoThermodynamicsFinite`, and `EchoThermodynamicsArbitrary` define arithmetic cost functions and prove equations about them under their stated hypotheses. The arbitrary-carrier construction uses decidable occupancy and agrees with finite counting under a subsingleton hypothesis. Its zero-cost conclusion is a model theorem, not a measurement of physical energy or a mechanized proof of physical Landauer/Bennett laws. -For a CNO, the computation function `f` is the identity: +`EchoThermoCollapseImpossible` refutes the stated finite-natural count interface under its requirements for arbitrarily large finite subfamilies. It does not refute every possible quantitative treatment of infinite fibres: extended cardinalities, infinity-valued costs, and weaker interfaces are different specifications. -```agda -cno-identity : ProgramState → ProgramState -cno-identity = id +The source files do not establish a Shannon-information preservation theorem, thermodynamic optimality of native CNO execution, or equivalence between all CNO properties and fibre shape. Inhabited fibres alone do not prove termination of an operational program, and singleton fibres alone do not express absence of side effects. --- CNO echo type -Echo cno-identity s = Σ (s' : ProgramState) , (id s' ≡ s) -``` +== Runtime boundary -This simplifies to a singleton fiber containing only the original state `s`. +The Agda Holding/Spent cell proves that reading the value returned by `consume` yields `nothing`. The original holding value can be reused or duplicated. This does not enforce affine or linear consumption. There is no checked refinement connecting the Agda model to a Rust or Idris implementation in this audit. -## Core Theorems - -### Theorem 1: CNO-Singleton Equivalence - -```agda -cno-echo-equivalence : ∀ (s : ProgramState) → - Echo cno-identity s ≃ ((s' : ProgramState) × (s' ≡ s)) -``` - -**Proof**: The echo over identity is equivalent to a singleton pair `(s, refl)`. - -### Theorem 2: All CNOs are Echoes - -```agda -all-cnos-are-echos : ∀ (p : ProgramState → ProgramState) → - (∀ σ → p σ ≡ σ) → - ∀ σ → Echo p σ ≃ Echo id σ -``` - -**Proof**: Any state-preserving program has echoes isomorphic to identity echoes. - -### Theorem 3: CNO Composition - -```agda -cno-composition-echo : ∀ (s : ProgramState) (e : Echo cno-identity s) → - map-over (id , (λ x → refl)) e ≡ e -``` - -**Proof**: Composing identity functions preserves echo structure. - -### Theorem 4: Bennett-reversible erasure cost (FINITE DOMAIN ONLY) - -```agda --- in EchoThermodynamics -bennett-reversible : - (f : Fin n → B) (y : B) (_≟_ : DecidableEquality B) (T : Temperature) → - FiberSize-fin f y _≟_ ≡ 1 → - fiber-erasure-bound f y _≟_ T ≡ 0 -``` - -**Status: PROVED**, and (2026-05-18) generalised three times: from -the identity to *every injective map* (`bennett-reversible-injective`), -from `Fin n` to *any Bishop-finite carrier* via transport -(`bennett-reversible-finite`, `EchoThermodynamicsFinite`), and from -there to an *arbitrary carrier with no finiteness at all* -(`bennett-reversible-arbitrary`, `EchoThermodynamicsArbitrary`), -including the genuine infinite `Program` CNO -(`bennett-reversible-cno-identity`). `bennett-reversible-id-zero` is a -corollary. The Bennett zero direction is closed for *all* carriers. - -**The infinite-carrier _quantitative collapse_ functional is -`[CLOSED-NEG]`**: not a vague gap and no longer open — the falsifiable -obligation **O-THERMO-∞** is now discharged *negatively*, its -impossibility mechanised (`collapse-cost-impossible`, -`EchoThermoCollapseImpossible`; see §"Thermodynamic Bridge" below). A -count-based collapse cost provably cannot exist on an infinite carrier -as a total `--safe` function — a settled boundary, do not reopen. The -earlier `cno-thermodynamic-optimality` formulation rested on a -hardcoded `FiberSize ≡ 1` that made the claim vacuous; that hardcode -is gone, the honest finite/Bishop-finite/arbitrary cases are proved, -and the infinite count case is settled negative. - -### Theorem 5: Information-preservation (NOT YET FORMALISED) - -The earlier `cno-information-preservation` headline referenced a -function `echo-information-loss` that was never defined and a -notion of CNO-information that has no formal analogue in the -current Agda corpus. **No theorem of this form exists in the -proven suite.** The closest formalised statement is the qualitative -`FiberSize-fin ≡ 0 ⟺ ¬ Echo` bidirectional in `EchoFiberCount` — -the count is zero exactly when no metatheoretic witness exists — -but that is a witness-presence statement, not an -information-preservation statement. - -A real Shannon-entropy / mutual-information formalisation is open -work; see `roadmap.adoc` under the deferred research / thermodynamic -items. - -### Theorem 6: Universal CNO Definition (NEW) - -```agda -UniversalCNO : ∀ {A : Ob} (p : A → A) → Set -UniversalCNO p = ∀ (s : A) → Echo p s ≃ Echo id s -``` - -**Proof**: CNOs are identity morphisms that preserve echo structure. - -### Theorem 7: Categorical Equivalence (NEW) - -```agda -CNO-Category-Equivalence : ∀ {A : Ob} (p : A → A) → - UniversalCNO p ≃ AbsoluteZeroUniversalCNO p -``` - -**Proof**: Echo categorical definition is equivalent to Absolute Zero's universal CNO definition. - -## Mapping to Absolute Zero's CNO Definition - -Absolute Zero defines CNOs with four properties: - -1. **Termination**: `Terminates(p, σ)` -2. **State Preservation**: `FinalState(p, σ) = σ` -3. **No Side Effects**: `NoSideEffects(p)` -4. **Thermodynamic Reversibility**: `ThermodynamicallyReversible(p)` - -### Echo Type Interpretation - -| Absolute Zero Property | Echo Type Interpretation | -|------------------------|--------------------------| -| `Terminates(p, σ)` | `Echo p σ` is inhabited | -| `FinalState(p, σ) = σ` | `Echo p σ` contains `(σ, refl)` | -| `NoSideEffects(p)` | `Echo p σ` is singleton (only `σ` maps to `σ`) | -| `ThermodynamicallyReversible(p)` | `Echo p σ ≃ Echo id σ` | -| `ThermodynamicOptimality(p)` | `reversible-erasure-cost p σ d T ≡ 0` _(proved for every injective `p` on **any** carrier — Bishop-finite via `fiber-erasure-bound`, arbitrary/infinite incl. the `Program` CNO via `reversible-erasure-cost` — Theorem 4; the quantitative-collapse functional on an infinite carrier is settled `[CLOSED-NEG]` — impossibility mechanised, `collapse-cost-impossible`)_ | -| `InformationPreservation(p)` | _no formalised analogue — `echo-information-loss` was never defined; see Theorem 5_ | -| `UniversalCNO(p)` | `∀ σ → Echo p σ ≃ Echo id σ` (NEW) | -| `ModelIndependence(p)` | `Echo f y ≃ Echo f' y'` across isomorphic models (NEW) | - -## Categorical Bridge (NEW) - -The `EchoCategory.agda` module establishes a comprehensive categorical formalization of echo types, directly supporting Absolute Zero's goal of universal CNO definitions through category theory. - -### Key Concepts - -1. **Echo Fibration**: Echo types form a fibration where each morphism `f : A → B` has fibers `Echo f y` over each `y : B` -2. **Echo Category**: Category where objects are echo types and morphisms preserve echo structure -3. **Universal CNO**: CNOs as identity morphisms that preserve echo structure: `∀ s → Echo p s ≃ Echo id s` -4. **Model Independence**: Echo types are preserved across isomorphic computational models - -> **Scope note (2026-05-18).** "Model Independence" *here* means the -> bare-`Echo` invariance `Echo f y ≃ Echo f' (proj₁ (isoB y))` under an -> isomorphism of the underlying objects (the `ModelIndependence` -> theorem below). This is a distinct, valid statement and is **not** -> affected by retraction R-2026-05-18, which retracted the *graded -> modality's* "two independent models / model-independence" claim -> (`GradedLossModel`/`EchoRelModel`). Do not conflate the two; this -> CNO consumer-bridge doc is firewalled from the identity claim. See -> `docs/retractions.adoc`. - -### Core Theorems - -```agda --- Echo types form a fibration -EchoFibration : Fibration -EchoFibration {A} {B} f y = Echo f y - --- Universal CNO definition (matches Absolute Zero's goals) -UniversalCNO : ∀ {A : Ob} (p : A → A) → Set -UniversalCNO p = ∀ (s : A) → Echo p s ≃ Echo id s - --- Categorical equivalence with Absolute Zero's definition -CNO-Category-Equivalence : ∀ {A : Ob} (p : A → A) → - UniversalCNO p ≃ AbsoluteZeroUniversalCNO p - --- Model independence across isomorphic models -ModelIndependence : ∀ {A B A' B' : Ob} (f : A → B) (f' : A' → B') - (isoA : A ≃ A') (isoB : B ≃ B') - (commute : ∀ a → f' (proj₁ (isoA a)) ≡ proj₁ (isoB (f a))) - {y : B} → - Echo f y ≃ Echo f' (proj₁ (isoB y)) -``` - -### Connection to Absolute Zero Goals - -1. **Universal CNO Definition**: Provides categorical foundation for `AbsoluteZeroUniversalCNO` -2. **Model Independence**: Supports cross-language CNO verification -3. **Category Theory Module**: Formalizes echo types as fibrations -4. **Functorial Properties**: Proves echo maps preserve categorical structure - -## Thermodynamic Bridge — finite-domain Landauer/Bennett bounds - -The `EchoFiberCount.agda` + `EchoThermodynamics.agda` pair -formalises the *shape* of Landauer's bound at the finite-domain -`Fin n → B` level. The earlier draft of this section claimed -significantly more than was proved (a `FiberSize ≡ 1` hardcode -made `cno-zero-energy` and `cno-zero-information-loss` vacuous); -those claims have been retracted and replaced with what is -actually in the proven suite. - -### Key Concepts - -1. **Honest fiber count**: - `FiberSize-fin f y _≟_` enumerates `Fin n` and asks the - decidable equality at each index — actual preimage count, not - a hardcoded constant. -2. **Landauer bound shape**: - `landauer-bound T n = k * T * ⌊log₂ n⌋`. Linear in T, - logarithmic in the alternatives count. `⌊log₂ 0⌋ = ⌊log₂ 1⌋ = 0` - discharges the trivial corners. -3. **Fiber erasure bound**: - `fiber-erasure-bound f y _≟_ T = landauer-bound T (FiberSize-fin f y _≟_)`. - -### Core Theorems (proved) - -```agda --- Bennett: if the fiber size at y is 1, the erasure bound is 0 -bennett-reversible : - (f : Fin n → B) (y : B) (_≟_ : DecidableEquality B) (T : Temperature) → - FiberSize-fin f y _≟_ ≡ 1 → - fiber-erasure-bound f y _≟_ T ≡ 0 - --- Identity at index zero — canonical instance -bennett-reversible-id-zero : - (_≟_ : DecidableEquality (Fin (suc m))) (T : Temperature) → - fiber-erasure-bound (λ x → x) zero _≟_ T ≡ 0 - --- Landauer worst case: every input maps to the same y -landauer-collapse : - (f : Fin n → B) (y : B) (_≟_ : DecidableEquality B) (T : Temperature) → - (∀ x → f x ≡ y) → - fiber-erasure-bound f y _≟_ T ≡ k * T * ⌊log₂ n⌋ -``` - -### The C+ gap, and how far the bound generalises (2026-05-18) - -The `STABILITY_ANALYSIS.md` §3.3 ~70% / C+ rating was driven by a -single concrete gap: the only proved zero-cost (Bennett) instance was -`bennett-reversible-id-zero` — *the identity map, at index zero*. The -general predicate `ThermodynamicOptimality(p) := fiber-erasure-bound -p σ _≟_ T ≡ 0` (Absolute-Zero mapping table) was otherwise unproved -off that one point. Two strictly stronger cases are now closed, and -the residual is pinned to one falsifiable obligation. - -**Proved — generalisation past the identity (`EchoFiberCount`, -`EchoThermodynamics`).** Zero erasure cost holds for *every injective -map*, at *every value it hits*, not just `id`/`zero`: - -```agda -FiberSize-fin-injective : - (f : Fin n → B) (y : B) (_≟_ : DecidableEquality B) - (inj : ∀ {i j} → f i ≡ f j → i ≡ j) - (i₀ : Fin n) → f i₀ ≡ y → - FiberSize-fin f y _≟_ ≡ 1 - -bennett-reversible-injective : - (f : Fin n → B) (y : B) (_≟_ : DecidableEquality B) - (inj : ∀ {i j} → f i ≡ f j → i ≡ j) - (i₀ : Fin n) → f i₀ ≡ y → (T : Temperature) → - fiber-erasure-bound f y _≟_ T ≡ 0 -``` - -This is the exact constructive content of "reversible ⇒ no -Landauer-mandated dissipation": injectivity *is* reversibility, a -singleton fiber *is* the absence of fan-in. `bennett-reversible-id-zero` -is now a corollary, not the only instance. - -**Proved — generalisation past `Fin n` to any Bishop-finite carrier -(`EchoThermodynamicsFinite`).** What blocks `Fin n → B` from -generalising is *exactly* one thing: `fiber-erasure-bound` is routed -through `FiberSize-fin`, whose totality is structural recursion on the -index bound `n` of `Fin n`. That is removed for any carrier `A` -carrying an explicit bijection `A ≃ Fin n` (record `FiniteDomain`), -by transport along the bijection — no new axiom, `--safe --without-K`, -zero postulates: - -```agda -record FiniteDomain (A : Set) : Set where - field card : ℕ; to : A → Fin card; from : Fin card → A - from∘to : ∀ a → from (to a) ≡ a - to∘from : ∀ i → to (from i) ≡ i - -bennett-reversible-finite : - (fd : FiniteDomain A) (f : A → B) (y : B) (_≟_ : DecidableEquality B) - (inj : ∀ {a a′} → f a ≡ f a′ → a ≡ a′) - (a₀ : A) → f a₀ ≡ y → (T : Temperature) → - fiber-erasure-bound-fin fd f y _≟_ T ≡ 0 - -landauer-collapse-finite : - (fd : FiniteDomain A) (f : A → B) (y : B) (_≟_ : DecidableEquality B) → - (∀ a → f a ≡ y) → (T : Temperature) → - fiber-erasure-bound-fin fd f y _≟_ T ≡ k * T * ⌊log₂ card fd ⌋ -``` - -**Proved — Bennett zero-cost on an _arbitrary_ carrier, past -Bishop-finite (`EchoThermodynamicsArbitrary`).** The finiteness in the -two results above is an artefact of routing cost through -`FiberSize-fin` (an enumeration); the *physical content* of Bennett — -a reversible map has no fan-in — needs no finiteness at all. An -injective `f : A → B` has a subsingleton fiber for *any* `A : Set a`. -Keying the Bennett cost on a decidable-inhabitation occupancy instead -of an enumeration discharges this with no finiteness hypothesis, -`--safe --without-K`, zero postulates: - -```agda -FiberSubsingleton f y = (p q : Echo f y) → proj₁ p ≡ proj₁ q -- K-free - -injective⇒fiber-subsingleton : -- any A - (inj : ∀ {x x′} → f x ≡ f x′ → x ≡ x′) → FiberSubsingleton f y - -bennett-reversible-arbitrary : -- A : Set a arbitrary; no Fin, no ≃ - (inj : ∀ {x x′ : A} → f x ≡ f x′ → x ≡ x′) - (d : Dec (Echo f y)) (T : Temperature) → - reversible-erasure-cost f y d T ≡ 0 -``` - -This is **not** a vacuous re-definition: `occupancy≡FiberSize-fin` -proves the occupancy *coincides with* the established honest count -`FiberSize-fin` on every finite restriction under the subsingleton -hypothesis, and `bennett-arbitrary-refines-finite` shows it strictly -subsumes the `Fin n` result of PR #58. The `--without-K` reason -for the first-projection form (not full fiber `isProp`) is recorded in -the module header: full `isProp` needs `B` an h-set / UIP, unavailable -under `--without-K`; the projection form is K-free provable from -injectivity and is exactly what the count needs. - -**The real CNO theorem, on the infinite carrier.** `cno-identity : -Program → Program` (the absolute-zero `Program = List Instruction` -carrier — *infinite*, the very `ProgramState`-flavoured type the -original companion remarks disclaimed) is injective, so -`bennett-reversible-cno-identity` gives erasure cost `≡ 0` at every -fiber and temperature. "A CNO dissipates zero Landauer energy" is now -a *real* theorem for the identity/injective CNO over the genuine -infinite carrier — no longer the vacuous claim the deleted -`ECHO-CNO-BRIDGE-SUMMARY.md` made. - -### O-THERMO-∞ — `[CLOSED-NEG]` (impossibility CONFIRMED) - -O-THERMO-∞ concerns *only* the **quantitative collapse** functional -(`fiber-erasure-bound` / `landauer-collapse`, the count direction) on -an infinite carrier — a strictly different functional from the -occupancy-keyed Bennett cost, which is closed for all carriers -(occupancy is capped at 1; the collapse cost grows as `⌊log₂ N⌋` with -the fiber count). It is **discharged via the second horn of its own -kill condition**: a mechanised proof that clauses (i)∧(ii) ⊢ ⊥. - -> **O-THERMO-∞ (as stated).** There is no function -> `cost : (ℕ → B) → (y : B) → DecidableEquality B → Temperature → Energy` -> that is (i) `--safe --without-K` total (no postulate, no escape -> pragma), and (ii) agrees with `fiber-erasure-bound` on every finite -> restriction `Fin n ↪ ℕ`. -> -> **Settled NEGATIVE.** `EchoThermoCollapseImpossible.collapse-cost-impossible` -> mechanises (i)∧(ii) ⊢ ⊥ verbatim, for the doc's own named witness. -> The constant map `c : ℕ → B`, `c _ = y₀` has an *infinite* fiber -> (`nat-into-collapse-fiber{-injective}` exhibits `ℕ ↪ Echo c y₀` — -> the structural reason no finite count exists). Its restriction along -> any `Fin n ↪ ℕ` is the constant `Fin n → B`, whose -> `fiber-erasure-bound` over `y₀` is `landauer-bound T n` (PR #58's -> honest `FiberSize-fin-const`). Clause (ii) then forces the *single* -> total value `cost c y₀ _≟_ T` to equal `landauer-bound T n` for -> every `n`; at `T = 1` that is `⌊log₂ n⌋`, so it must be both `0` -> (`n = 1`) and `1` (`n = 2`) — contradiction. Impossibility -> **confirmed**: the quantitative-collapse functional provably does -> *not* extend to an infinite carrier as a total `--safe` function. -> -> This is a `[CLOSED-NEG]` boundary of the theory — a settled negative -> result, **do not reopen**. It is *not* a softened "future work" item -> and it is *not* a defect: the only way a count-based collapse cost -> could exist on the infinite carrier is the (refuted) first horn, and -> the negative is now mechanised. `--safe --without-K`, zero -> postulates, zero escape pragmas; pinned in `Smoke.agda`. - -### What is still NOT proved (unchanged) - -* `echo-information-loss` and `cno-zero-information-loss` — - `echo-information-loss` was never defined in any module; - the prior claims rested on undeclared identifiers. -* `cno-energy-hierarchy`, `thermodynamic-cno-verification` — - no proven analogue exists. - -### Connection to Absolute Zero Goals - -1. **Landauer's Principle (shape)**: formalised via `landauer-bound` - and `fiber-erasure-bound`; now at the full Bishop-finite-carrier - level, not merely `Fin n`. -2. **Thermodynamic Reversibility (shape)**: proved for *every* - injective map (`bennett-reversible-injective`), lifted to any - Bishop-finite carrier (`bennett-reversible-finite`), and now to an - *arbitrary* carrier with no finiteness at all - (`bennett-reversible-arbitrary`), including the genuine infinite - `Program` CNO (`bennett-reversible-cno-identity`). - `bennett-reversible-id-zero` is a corollary. The Bennett zero - direction is closed for all carriers; the quantitative-collapse - functional on an infinite carrier (O-THERMO-∞) is now - **`[CLOSED-NEG]`** — its impossibility is mechanised - (`collapse-cost-impossible`), a settled boundary, no open - obligation remains for this Direction. -3. **Information Theory**: not bridged. Open work — see - `roadmap.adoc` (deferred research track). - -## Practical Implications - -### 1. CNO Verification via Echo Types - -Instead of proving four separate properties, we can verify CNOs by: -1. Showing the program's echo is inhabited -2. Proving the echo is isomorphic to identity echoes -3. Verifying singleton property - -### 2. Echo Type Theory as Foundation - -The bridge shows that echo type theory provides a unifying framework: -- CNOs become a special case of echo types -- Echo composition laws apply to CNO composition -- Echo preservation theorems apply to CNO state preservation - -### 3. Cross-Repository Integration - -The bridge enables: -- Using echo-type proofs in CNO verification -- Applying CNO analysis to echo-type systems -- Shared theorem libraries between repositories - -## Examples - -### Empty Program (Absolute Zero) - -```agda -empty-program-cno : Echo cno-identity (⟨ λ _ → 0 , λ _ → 0 , λ _ → 0 , 0 ⟩) -empty-program-cno = ⟨ λ _ → 0 , λ _ → 0 , λ _ → 0 , 0 ⟩ , refl -``` - -### NOP Instruction - -```agda -nop-cno : ∀ s → Echo cno-identity s -nop-cno s = s , refl -``` - -### CNO Composition - -```agda -cno-composition-example : ∀ s → Echo cno-identity s → Echo cno-identity s -cno-composition-example s e = e -``` - -## Implementation - -The bridge is implemented in four Agda modules: - -1. **`EchoCNO.agda`**: Basic bridge with core theorems -2. **`EchoCNOBridge.agda`**: Comprehensive bridge with full mapping to Absolute Zero -3. **`EchoThermodynamics.agda`**: Thermodynamic formalization -4. **`EchoCategory.agda`**: Categorical formalization (NEW) - -## Future Work - -1. **Formal Integration**: Create direct imports between repositories -2. **Automated Translation**: Tools to convert between echo-type and CNO proofs -3. **Extended Thermodynamics**: Refine energy models with real constants -4. **Category Theory**: Deepen categorical connections with more complex categories -5. **Quantum Bridge**: Extend to quantum echo thermodynamics -6. **Practical Tools**: Energy analysis and optimization tools -7. **Cross-System Verification**: Port to Coq/Lean for multi-prover verification - -## References - -- **Echo Types Repository**: `/var/mnt/eclipse/repos/echo-types/` -- **Absolute Zero Repository**: `/var/mnt/eclipse/repos/verification-ecosystem/maa-framework/absolute-zero/` -- **Core Echo Module**: `proofs/agda/Echo.agda` -- **Core CNO Module**: `proofs/agda/CNO.agda` -- **Bridge Modules**: `proofs/agda/EchoCNO.agda`, `proofs/agda/EchoCNOBridge.agda` - -## Conclusion - -The bridge between echo types and CNOs establishes that: - -1. **CNOs are singleton echoes over identity functions** -2. **Echo type theory provides a foundation for CNO verification** -3. **The two repositories can share theoretical infrastructure** - -This connection enables cross-pollination of ideas and proofs between the structured loss formalization (echo types) and the null operation verification (CNOs). \ No newline at end of file +See link:../audit/2026-11-06-evidence.adoc[the dated evidence ledger] and link:../echo-types/what-echo-is.adoc[the current foundation scope]. diff --git a/docs/build.adoc b/docs/build.adoc index c8de3f1f..7117a3ff 100644 --- a/docs/build.adoc +++ b/docs/build.adoc @@ -1,3 +1,9 @@ + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + == Build Instructions This repository contains mechanically verified proofs written in Agda. diff --git a/docs/characteristic.adoc b/docs/characteristic.adoc index 331183c8..1767ece0 100644 --- a/docs/characteristic.adoc +++ b/docs/characteristic.adoc @@ -7,11 +7,14 @@ :sectnumlevels: 3 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] -This file is the artefact the README and `roadmap-gates.adoc` require for -Gate 2 of the identity claim. It audits the nominees against the gate's -falsifier — "naturally echo-shaped, not reducible to generic sigma/fiber -lemmas" — and reports the threshold outcome. +This file retains the dated Gate-2 nominee audit. Its historical criterion “not reducible to generic sigma/fiber lemmas” is not a current general separation claim: Echo is definitionally a Sigma type. The nominees demonstrate selected constructions and encoding comparisons. Their novelty, priority, and application value remain research obligations. A nominee's survival of a specified falsifier does not establish otherwise. This is *Revision 5* (2026-05-26). It is the close-out re-audit required by `roadmap.adoc` §Lane 2: it re-checks that the @@ -33,7 +36,7 @@ parallel-instance lane discipline used to produce it. Rename or symlink at integration time. ==== -== Inherited spec +== Historical inherited spec (2026-05 audit) For the sceptic-facing evidence map ("is this just renamed Σ?", organised under five demands and cross-linked to every in-tree @@ -66,7 +69,7 @@ of `roadmap-gates.adoc` lists four nominees; the threshold scales proportionally — a comfortable pass requires at least 3 of 4 to survive, an honest minimum requires at least 2 of 4.) -== The nominee list (current) +== The nominee list (historical audit revision) Per the amended `roadmap-gates.adoc` Gate 2 table: diff --git a/docs/echo-types/MAP.adoc b/docs/echo-types/MAP.adoc index 6d3493f7..ab119610 100644 --- a/docs/echo-types/MAP.adoc +++ b/docs/echo-types/MAP.adoc @@ -5,6 +5,12 @@ :toclevels: 3 :source-highlighter: rouge + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] *The single source of truth for "what is in echo-types and where."* If you cannot find something, it is indexed here or it does not exist. @@ -159,9 +165,9 @@ in the Pillar F4 template style. the previously-pending (epi, mono) form now lands without committing the kernel to a specific truncation primitive. `proofs/agda/EchoImageFactorizationProp.agda`. -* *Generic no-section* — `no-section-of-collapsing-map`: for ANY +* *Generic no-left-inverse theorem* — `no-section-of-collapsing-map`: for ANY collapsing map with two distinct elements landing on the same - image, no section exists. Lifts the previous single-instance + image, no left inverse exists. Lifts the previous single-instance result to a structural fact about non-injectivity-at-a-point; recovers the original as a one-line corollary. `proofs/agda/EchoNoSectionGeneric.agda`. @@ -261,7 +267,7 @@ honest-bound matched-negative block. adversary. `proofs/agda/EchoDeniability.agda`. `[REAL]` * *Transaction (rollback safety, issue #174)* — `WriteSet` (staged mutations) → `RollbackLog` collapsing audit boundary; `rollback` - admits no section, so a discarded write-set is unrecoverable from the + admits no left inverse, so a discarded write-set is unrecoverable from the receipt alone (#DB-2.1). Packaged as a `Security` instance (`transaction-security`), reducing to `no-section-of-collapsing-map`. Honest-bound: NOT durability / isolation / commit-semantics (the @@ -284,7 +290,7 @@ honest-bound matched-negative block. (`sumMonoid` / `countMonoid` / `maxMonoid` / `minMonoid`, the last over `ℕ ∪ {∞}` via `Maybe ℕ`), a worked `countAggregator`, and generic non-disaggregability `no-canonical-disaggregation-of` (any - collision ⇒ no section, via `no-section-of-collapsing-map`; this + collision ⇒ no left inverse, via `no-section-of-collapsing-map`; this also discharges issue #174's no-section sibling). The macro→micro *economic* reading lives in `module Example-PairSum`: `pairSum : ℕ × ℕ → ℕ` IS the `sumMonoid` fold (`pairSum-is-fold`), @@ -299,24 +305,7 @@ honest-bound matched-negative block. is the fold's homomorphism law, NOT full SQL GROUP-BY operational semantics; `avg` is deliberately absent (not a monoid — express as `sum / count`). `proofs/agda/EchoAggregation.agda`. `[REAL]` -* *Variance verdict (monad / comonad / adjunction)* — resolves, in - `--safe` Agda rather than asserting it, the precise variance of the - loss-graded modality. Accumulation is the graded-MONAD multiplication - `accumulate : D_r (D_s A) → D_{r+s} A` (total + canonical, definable - from the layered data alone; `= Echo-comp-iso-from`); recoverability is - exact on the grade-0 fibre (`recoverable-fibre = A↔ΣEcho`, the - section/retraction adjunction); the graded-COMONAD direction fails for - genuine loss (`no-bare-recovery`, the canonical collapse has no section - via `no-section-of-collapsing-map`); and the "graded comonad" reading is - the LOSSLESS complement-storing writer of `EchoGradedComonadF1`, whose - `δ` is `coe` along a type equality and is therefore inverted by - `μ-writer`. Sharpens R-2026-05-18: echo-types is "exact on a homotopy - fibre rather than complement-storing". Honest-bound: the verdict is - about the SHAPE of the canonical structure maps and the LOCUS of - recoverability, not a universal categorical impossibility theorem - (matched `NotProved-*` block). See - `docs/echo-types/variance-resolution.adoc`. - `proofs/agda/EchoVariance.agda`. `[REAL]` +* *Variance maps and bounds* — `EchoVariance` gives inverse fibre-composition maps for a supplied factorisation, not a full tropical graded monad. `recoverable-fibre = A↔ΣEcho` retains the source and has no grade parameter. `no-bare-recovery` rules out a left inverse for Boolean collapse, whose two right inverses still exist. The writer-carrier maps retain content, and no blanket graded-comonad prohibition follows. The baseline graded-comonad record omits naturality; assess the strengthened companion separately. See `docs/echo-types/variance-resolution.adoc`. *Curated suite — single-file entry point.* The narrative deliverable that pulls the Tier-1 / Tier-2 / Tier-3 named theorems @@ -470,14 +459,14 @@ postulates. `no-recovery-once-dropped` (007 phase-2 "affine capability, linear consumption" via `EchoLinear.weaken` / `no-section-weaken`). * Proofs: `proofs/agda/EchoResidueCell.agda` — the Agda mirror of 007's - `ResidueCell` (`holding` / `spent`) operational once-only discipline. + `ResidueCell` (`holding` / `spent`) read-after-consume equations. `takeForReverse : ResidueCell f y → Maybe A` (= the Idris partial form), `consume` (Holding→Spent), `holding-reverses` / `spent-does-not-reverse` (↔ Idris `holdingReverses` / `spentDoesNotReverse`), and the headline `once-only` — after `consume`, a further `takeForReverse` is always - `nothing` (the state-machine form of the `(1 e)` linear consumption). + `nothing` on the returned consumed value. The original holding value can be reused or duplicated; this is not the `(1 e)` linear guarantee. * Scope: the type-level totality + recovery + linear→affine no-section - content, plus the once-PER-CELL replay discipline as a state machine. + content, plus a pure Holding/Spent state transformation. There is no enforced once-per-original-cell use or Rust/Idris refinement theorem. 007's linear NON-DUPLICATION quantity `(1 e : Echo f y)` is NOT re-proved in Agda (nothing stops copying a `holding` cell) — the full quantity-semantics port (`@0`-style erasure) is the documented next slice. @@ -536,9 +525,10 @@ not just Σ renamed. Each application ships Agda anchor + Nickel schema `echo-clone₁≢echo-clone₂`, `no-canonical-clone-recovery` via `no-section-of-collapsing-map`, `aggregation-as-fold` via `sumMonoid`, `FiberBundle` sidecar, `HaploDist` separation (domain = B, not Echo f). - * Nickel: `docs/echo-types/applications/haplotype-collapsing.k9.ncl` `[DRAFT]` — - `CollapsedResult` with `distance_matrix : m×m`, `fibers : Dict`, contracts - for count = length clones, keys = representatives, square matrix. + * Nickel: `docs/echo-types/applications/haplotype-collapsing.k9.ncl.in` `[DRAFT]` — + inert, unvalidated documentation specimen for `CollapsedResult`, + `distance_matrix` and `fibers`. The intended cross-field invariants are not + all encoded or established; this is not an active K9 component. * Julia: `docs/echo-types/applications/haplotype-collapsing.jl` `[DRAFT]` — `collapse_clones : Vector Clone → CollapsedResult`, O(n) grouping + O(m²) distances, `fibers` sidecar, `test_no_canonical_recovery`, diff --git a/docs/echo-types/applications-compiler-analysis.adoc b/docs/echo-types/applications-compiler-analysis.adoc index 31aedce9..92418780 100644 --- a/docs/echo-types/applications-compiler-analysis.adoc +++ b/docs/echo-types/applications-compiler-analysis.adoc @@ -3,6 +3,12 @@ :date: 2026-05-20 :toc: macro + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] Compiler analyses are a paradigmatic source of *structured loss*: every pass discards source-level information but retains a residue diff --git a/docs/echo-types/applications/haplotype-collapsing.adoc b/docs/echo-types/applications/haplotype-collapsing.adoc index 3b9c91e5..2f2b3746 100644 --- a/docs/echo-types/applications/haplotype-collapsing.adoc +++ b/docs/echo-types/applications/haplotype-collapsing.adoc @@ -98,7 +98,7 @@ It travels as a *sidecar* validated by Nickel contracts. [source,nickel] ---- -# haplotype-collapsing.k9.ncl (see companion file) +# haplotype-collapsing.k9.ncl.in (see companion file) { collapsed_representatives = [ Haplotype, ... ], # size m distance_matrix = Array (Array Number), # m × m, O(m²) compute @@ -137,11 +137,13 @@ Nickel contracts enforce: * `distance_matrix[i][j]` is symmetric, zero diagonal (optional contract) * `fibers` keys == `collapsed_representatives[*].haplotype_id` -The fiber witness is *validated* by Nickel (k9 Yard: Nickel evaluation with contracts) -but *never* inspected by the distance computation. The JEG consumes `fibers`, not -`distance_matrix`. +The design calls for Nickel validation before the distance computation. The +companion `.in` file is an inert, unvalidated documentation specimen; it does +not encode or establish every intended invariant listed above. It makes no +active K9 Yard claim. The proposed JEG consumes `fibers`, not `distance_matrix`. -See `haplotype-collapsing.k9.ncl` for the full contract. +See `haplotype-collapsing.k9.ncl.in` for the documentation-only schema specimen. +Instantiate and validate a real Nickel input before adopting this design. === Passing through metamanifold-webui @@ -453,7 +455,8 @@ Add `src/HaplotypeCollapsing.jl`: running on `representatives` only (O(m²)) * Add `fibers` sidecar to `AnnotatedNewick` export for iTOL/jplace with lineage tooltips -* Nickel validation via `Protoctist.Nickel.validate(collapsed_result, "haplotype-collapsing.k9.ncl")` +* Proposed Nickel validation after instantiating and checking a real `.ncl` + input; the inert `.in` specimen is not an input to live validation. This does NOT duplicate BioJulia logic; it composes it (Protoctist's design principle). @@ -473,7 +476,8 @@ no runtime JEG rendering, just the discrete fiber-count / no-section / fold laws == Status * Agda: `[REAL]` — `EchoHaplotypeCollapsing.agda` compiles `--safe --without-K` -* Nickel: `[DRAFT]` — `haplotype-collapsing.k9.ncl` contract, validated via `nickel typecheck` +* Nickel: `[DRAFT]` — `haplotype-collapsing.k9.ncl.in` is an inert, unvalidated + schema specimen; no active K9 component or validation receipt is asserted. * Julia: `[DRAFT]` — `haplotype-collapsing.jl` executable sketch, mirrors Agda finite shadow * JEG: `[DRAFT]` — React sketch above, to be integrated into metamanifold-webui * Protoctist.jl / EchoTypes.jl: `[OPEN]` — proposed extensions, not yet implemented @@ -486,7 +490,7 @@ no runtime JEG rendering, just the discrete fiber-count / no-section / fold laws * `proofs/agda/EchoGraded.agda` — `keep ≤ residue ≤ forget` decoration * `proofs/agda/EchoNoSectionGeneric.agda` — `no-section-of-collapsing-map` * `docs/echo-types/applications/README.adoc` — applications index -* `docs/echo-types/applications/haplotype-collapsing.k9.ncl` — Nickel schema +* `docs/echo-types/applications/haplotype-collapsing.k9.ncl.in` — documentation-only Nickel specimen * `docs/echo-types/applications/haplotype-collapsing.jl` — Julia exacts matrix separation * `docs/echo-types/applications-compiler-analysis.adoc` — sibling application (compiler analysis) * `docs/echo-types/MAP.adoc` — master content map diff --git a/docs/echo-types/applications/haplotype-collapsing.k9.ncl b/docs/echo-types/applications/haplotype-collapsing.k9.ncl.in similarity index 88% rename from docs/echo-types/applications/haplotype-collapsing.k9.ncl rename to docs/echo-types/applications/haplotype-collapsing.k9.ncl.in index e937b76e..790e4ade 100644 --- a/docs/echo-types/applications/haplotype-collapsing.k9.ncl +++ b/docs/echo-types/applications/haplotype-collapsing.k9.ncl.in @@ -1,14 +1,16 @@ # SPDX-License-Identifier: CC-BY-SA-4.0 -# haplotype-collapsing.k9.ncl — Nickel schema for haplotype collapsing with Echo fiber witness +# haplotype-collapsing.k9.ncl.in — Nickel schema for haplotype collapsing with Echo fiber witness # -# This is the k9 contract that validates the pipeline output: +# Documentation-only, unvalidated Nickel specimen; not an active K9 component. +# It has no K9 envelope, pedigree, execution authority or validation receipt. +# Intended pipeline output: # collapsed_representatives (size m) + distance_matrix (m×m) + fibers (Echo sidecar) # # Design: fiber witness travels as sidecar, never in O(n²) hot loop. # Echo f y = Σ (c : Clone) (f c ≡ y) serialized as FiberBundle. # -# Validate: nickel typecheck docs/echo-types/applications/haplotype-collapsing.k9.ncl -# Export: nickel export docs/echo-types/applications/haplotype-collapsing.k9.ncl > result.json +# To instantiate: copy to a new .ncl file, review the encoded constraints, +# and obtain actual Nickel typecheck/evaluation receipts before use. let CloneWitness = { clone_id | String, @@ -62,7 +64,7 @@ let CollapsedResult = { pipeline_version | optional | String, }, - # Invariants checked by Nickel contracts + # Intended invariants; this specimen does not encode or establish all of them # 1. distance_matrix is square and size = m # 2. fibers keys = collapsed_representatives[*].haplotype_id # 3. each fiber's count = length clones diff --git a/docs/echo-types/comparators.adoc b/docs/echo-types/comparators.adoc index 6cd71a75..19e65b4d 100644 --- a/docs/echo-types/comparators.adoc +++ b/docs/echo-types/comparators.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 2 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] Single-page comparison of Echo Types (narrowed per R-2026-05-18) against the four nearest neighbouring type systems: Granule (graded @@ -24,8 +30,7 @@ information-loss axis, that its narrowed claims are concrete and checkable, and that the per-comparator differences are mostly *structural* (different judgmental level, different categorical anchor) rather than competitive. The R-2026-05-18 narrowings apply -throughout: Echo is a thin-poset reindexing modality (not a graded -comonad), with a funext-relative pointwise mediator (not a full +throughout: the core Echo interface is a preorder-indexed diagram (not a reflective modality or graded-comonad interface), with a funext-relative pointwise mediator (not a full universal property) and carrier-parametricity over a fixed grade poset (not model-independence). ==== @@ -176,24 +181,20 @@ type level*: the affine carrier has exactly one inhabitant up to definitional equality, so even at the value level no consumer can distinguish two preimages. -*Key difference, scope.* Linear Haskell does not ship a no-section -family. Echo's `no-section-weaken` (which is `no-section-collapse-to-residue`) -proves that *no* function `LEcho affine → LEcho linear` is a section -of `weaken` — the up-step is provably not just unavailable but -non-existent. +*Selected comparison.* Echo's `no-section-weaken` (which is `no-section-collapse-to-residue`) +rules out a left inverse of `weaken`. It does not show that every up-map is nonexistent or that ordinary Agda values cannot be duplicated. *Honest verdict.* Linear Haskell is the more useful programming tool; -Echo's affine layer is the more rigorous proof-theoretic object. They -sit in different problem spaces. +Echo models a chosen affine residue carrier; it does not implement Linear Haskell's quantity discipline. They address different specifications. == What Echo does NOT do The most credibility-relevant section. Reviewers should not expect any of the following from Echo: -* *No graded comonad.* `degrade-via-join` and `degrade-compose` are +* *Core diagram is not a graded-comonad interface.* `degrade-via-join` and `degrade-compose` are thin-poset reindexing laws under a propositional order. No nested - `D_r D_s` is ever formed; no comonad multiplication exists. The + `D_r D_s` is formed in that interface. Separate experimental and writer carriers must be checked against their own naturality and law obligations. The retracted "graded comonad" framing is documented at `docs/retractions.adoc` R-2026-05-18. @@ -205,7 +206,7 @@ any of the following from Echo: * *No model-independence.* Pillar D's `EchoRelModel.GradedLossModel` provides *carrier-parametricity over a fixed grade poset* — the - comonad laws (in the narrowed-to-reindexing sense) are proved once + indexed action laws are proved once for any model. This is one structure parametric in the carrier, not multiple independent models agreeing semantically. @@ -238,9 +239,9 @@ For balance — the affirmative side of the same discipline: round-trips `refl`. Owning the deflationary admission is a credibility asset. -* *No-section family across 5 decoration layers.* See the aggregate +* *No-left-inverse examples across decoration layers.* See the aggregate row in `docs/theorem-index.md`. Each decoration *separately* - refuses the section that a raw Σ would admit. + gives a non-injectivity consequence equally expressible using raw Σ. * *Per-decoration composition law lands by the same recipe in 6 layers.* graded, linear/affine, choreographic, access, cost, diff --git a/docs/echo-types/earn-back-plan.adoc b/docs/echo-types/earn-back-plan.adoc index 460ddd31..8627b771 100644 --- a/docs/echo-types/earn-back-plan.adoc +++ b/docs/echo-types/earn-back-plan.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 3 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] After retraction R-2026-05-18 the development is *honest but thin*. This plan defines the falsifiable program to convert the retracted @@ -69,6 +75,9 @@ its grade-unit object — not redefining Echo. [#gate-F1] === Gate F1 — Genuine graded comonad (MAKE-OR-BREAK) +The current completion criterion includes naturality and congruence with pointwise equality. The baseline `GradedComonadStructure` lacks those fields, so its historical F1/F3 record inhabitants alone establish only the equations declared there. The local `EchoGradedComonadNaturality.NaturalGradedComonad` companion preserves that record and adds the missing obligations; it and the F1/natural/list witnesses now pass local Agda 2.7.0.1 checks. The evidence ledger records the compiler and profile boundaries. Neither this repair nor the writer carrier establishes a full tropical loss monad or a universal impossibility of loss-related comonads. + + *F1 is make-or-break for the graded-comonad claim*, and *F3* is gated on it (F3 is not attempted until F1 passes). *F2* and *F4* are independent of F1 and proceed in parallel — they earn back @@ -364,7 +373,7 @@ single index; it moves no claim. . *F3* (A3) — *DONE 2026-05-20*: passed via the `GradedComonadStructure` interface plus two non-isomorphic- grade-monoid instances. Closes the second-models claim *for the - graded comonad witness* — see follow-up F-2026-05-20b for scope. + record witness for its declared fields* — naturality is an additional current obligation; see follow-up F-2026-05-20b for historical scope. . *Doc-integrity* (D) — reconcile alongside step 1; removes a drift vector at near-zero cost. . *Buchholz* (B) — separate long-tail; keep the `ExtendedOrder` @@ -443,7 +452,7 @@ now unblocked. `EchoGradedComonadInterface.GradedComonadStructure` is an abstract record packaging the F1 graded-comonad signature (grade monoid + graded functor + counit + nested comultiplication + monoid laws + - functor laws + the three comonad laws) without a `⊑-prop`-equivalent + functor laws + the three comonad laws, but omitting naturality) without a `⊑-prop`-equivalent field. Two non-isomorphic-grade-monoid instances inhabit it: + [loweralpha] diff --git a/docs/echo-types/echo-kernel-note.adoc b/docs/echo-types/echo-kernel-note.adoc index 57011c95..61b5d8cc 100644 --- a/docs/echo-types/echo-kernel-note.adoc +++ b/docs/echo-types/echo-kernel-note.adoc @@ -4,6 +4,12 @@ :toc: macro :source-highlighter: rouge + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] Which Agda modules are the *kernel* (the dependency-light, funext-free core everything imports) and which are *derived*. Companion to @@ -141,22 +147,12 @@ kernel** — the boundary is real and lives outside this core. monoid-homomorphism law `aggregation-as-fold`, the four concrete instances (`sumMonoid`/`countMonoid`/`maxMonoid`/`minMonoid`), and generic non-disaggregability `no-canonical-disaggregation-of` (any - collision ⇒ no section, via `no-section-of-collapsing-map`; also + collision ⇒ no left inverse, via `no-section-of-collapsing-map`; also covers #174). The macro→micro economic reading is the `Example-PairSum` instance the oikos/betlang alib note cites (`pairSum` IS the `sumMonoid` fold). Imports `Echo` + `EchoNoSectionGeneric`. - `EchoVariance` resolves, in `--safe` Agda rather than asserting it, - the monad / comonad / adjunction status of loss accumulation - (`docs/echo-types/variance-resolution.adoc`): accumulation is the - graded-MONAD multiplication `accumulate : D_r (D_s A) → D_{r+s} A` - (total + canonical, `= Echo-comp-iso-from`); recoverability is exact on - the grade-0 fibre (`recoverable-fibre = A↔ΣEcho`, the section/retraction - adjunction); the graded-COMONAD direction fails for genuine loss - (`no-bare-recovery`, via `no-section-of-collapsing-map`); and the - "graded comonad" reading is the LOSSLESS complement-storing writer - (`μ-writer` inverts F1's `δ`). Imports `Echo`, `EchoCharacteristic`, - `EchoNoSectionGeneric`, `EchoTotalCompletion`, `EchoGradedComonadF1`. + `EchoVariance` proves supplied-factorisation fibre-composition inverses and a Boolean no-left-inverse obstruction. It does not establish a tropical graded monad or a categorical adjunction. `A↔ΣEcho` retains the source and has no grade parameter. The writer maps preserve content; erasing-carrier counit obstructions do not ban all loss-related graded comonads. The strengthened naturality companion requires separate verification. Imports `Echo`, `EchoCharacteristic`, `EchoNoSectionGeneric`, `EchoTotalCompletion`, and `EchoGradedComonadF1`. | *Earn-back gate modules* + (derived / scoped; not kernel) diff --git a/docs/echo-types/establishment-plan.adoc b/docs/echo-types/establishment-plan.adoc index 0bd64557..d799860c 100644 --- a/docs/echo-types/establishment-plan.adoc +++ b/docs/echo-types/establishment-plan.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 3 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] This document sets out the path by which "echo types" can acquire *recognised type-theoretic standing*. It is deliberately separate from @@ -87,8 +93,8 @@ strategy and is owned, not hedged: .The establishment thesis (narrowed 2026-05-18) **** Echo is the homotopy fibre, equipped with a loss-grade lattice, -carrying a *definitionally-grounded loss-graded reindexing modality* -(a thin-poset action — *not* a graded comonad). Its standing comes +carrying a *definitionally-grounded loss-indexed diagram* +(a preorder-indexed diagram; no reflective or nested graded-comonad structure is specified by this interface). Its standing comes not from being a new object but from being *exactly characterised and honestly bounded*: a definitional Σ-identity; a funext-relative pointwise mediator property; coherence equations that provably reduce @@ -143,7 +149,7 @@ the composition iso, cancel-iso, pentagon — but no _characterisation_. reindex), and the three coherence equations (`gcomonad-counit-{l,r}`, `gcomonad-coassoc`). [RETRACTED READING: "the three graded-comonad laws" / "is a graded comonad" — these are - thin-poset reindexing-coherence equations; no comonad is exhibited. + indexed-diagram coherence equations; no comonad is exhibited. See <> and R-2026-05-18.] * Authority effect (narrowed): "has a definitional identity + a funext-relative pointwise mediator property + a reindexing modality @@ -269,10 +275,8 @@ below is real and the Agda is unchanged — but its significance is the `degrade-compose` + `≤g-prop` because *there is no comonadic coherence to discharge*: a thin poset with a functorial monotone action satisfies them definitionally. This is the calibration that -shows the modality's entire content over generic Σ is thinness of the -grade order — confirmed by the separating model and by the repo's own -Gate-2 audit. Read "graded-comonad laws" below as -"thin-poset reindexing-coherence equations", and disregard the +locates the arbitrary-parallel-arrow independence requirement. Ordinary chosen-composite action laws remain valid in the separating model; no separation from general Σ follows. Read "graded-comonad laws" below as +"indexed-diagram coherence equations", and disregard the "*Thesis impact (positive)*" paragraph (struck through in substance, retained for the record). ==== @@ -399,7 +403,7 @@ reason. own Gate-2 audit contradicted two. The mechanised content is unchanged and the entries above remain accurate as a record of *what landed*; only their *significance claims* are corrected, to: - a loss-graded reindexing modality (not a comonad); a funext-relative + a loss-indexed diagram (not a comonad); a funext-relative pointwise mediator property (not a universal property); carrier-parametricity over a fixed grade poset (not model-independence); a postulate-free build that is evidence for, diff --git a/docs/echo-types/overview.adoc b/docs/echo-types/overview.adoc index 7d0d50e8..bf2f0ff7 100644 --- a/docs/echo-types/overview.adoc +++ b/docs/echo-types/overview.adoc @@ -1,3 +1,9 @@ + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + == Echo Types — Overview *Status:* working note. Paths marked _definition_ are stable within this diff --git a/docs/echo-types/paper.adoc b/docs/echo-types/paper.adoc index 0a03fa56..98e1204e 100644 --- a/docs/echo-types/paper.adoc +++ b/docs/echo-types/paper.adoc @@ -1,12 +1,18 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= Echo Types: A Definitionally-Grounded, Loss-Graded Reindexing Modality += Echo Types: A Definitionally-Grounded, Loss-Graded Indexed Diagram :toc: macro :toclevels: 3 :sectnums: :sectnumlevels: 3 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [IMPORTANT] ==== *STATUS: living draft, not for submission.* Written 2026-05-17 while @@ -20,7 +26,7 @@ Do not submit until the venue/template are chosen (Pillar E logistics are offline/author-driven) and the standing order-type-fidelity caveat is judged acceptable for the chosen venue. The TYPES extended abstract -(`types-abstract.adoc`) is the short, already-submission-ready +(`types-abstract.adoc`) is the short, withdrawn and review-required companion; this is the full CPP/ITP-style mechanised-metatheory paper it grows into. @@ -54,30 +60,9 @@ is that `Echo f y` is *definitionally* the homotopy fibre `fib f y` `refl` round-trips. We make this deflationary fact the foundation, not a footnote. -The thesis of the paper is that the type-theoretic standing that -*befits* echo is not the linear/dependent judgmental ladder — that -comparison is a category error — but a **loss-graded reindexing -modality**: a monotone family indexed by a join-semilattice of loss -grades, with a functorial reindexing action. It is *analogous to*, -and motivated by, the coeffect/quantitative lineage, but we are exact -about what is and is not mechanised. In particular it is *not* a -graded comonad in the Petriček–Orchard–Mycroft / Katsumata sense: no -nested functor `D_{r·s} ⇒ D_r D_s` is formed, and the structure maps -are the lattice-bottom coercion and the join-left reindex, not a -genuine counit/comultiplication pair. - -The contribution is a *characterisation package*, mechanised in Agda -under `--safe --without-K` with zero postulates: a definitional -identity; a pointwise (funext-relative) mediator property for the -pullback presentation; a reindexing modality whose coherence -equations provably reduce to *thinness of the grade order*; a -separating model that pins exactly that reduction; a carrier-parametric -abstraction over a fixed grade poset; and a postulate-free build — all -under a falsifiable-gate methodology with a public retraction log -(`docs/retractions.adoc`). The earlier framing of this development as -a "graded comonad with two independent models and a conservativity -metatheorem" was retracted on 2026-05-18 after adversarial review; -see <> and the retraction log. +The object is the standard dependent fibre. The additional `EchoModality` interface is a preorder-indexed diagram of types and maps, with identity and composition laws. Its abstract `ThinPoset` index omits antisymmetry; the concrete three-grade instance is an order. We retain compatibility module names, but do not infer reflective modality structure or a general graded monad/comonad from them. + +The contribution under review is an Agda presentation and examples: fibre laws, a pullback presentation, indexed diagram laws, and scoped counterexamples to particular lossy observations. Novelty and priority remain unresolved. The ordinary CI roots are checked with `--safe --without-K`; the separate Cubical root and explicit guard exemptions require their own trust account. See `docs/foundation.adoc` for the dated coverage and dependency record. This is not a repository-wide postulate-free or conservativity claim. === Why not "linear or dependent" @@ -102,10 +87,8 @@ the rest of the paper bears. of `f` along the point `y : ⊤ → B`; a `SliceHom` *is* a cone (round-trips `refl`). `echo-pullback-univ` gives existence and *pointwise* uniqueness `∀ v → m' v ≡ m v`. We do *not* claim full - terminality: `m' ≡ m` is neither stated nor provable here without - funext, so this is a funext-relative mediator property, not a - universal property in the categorical sense (Pillar B-1, §3). -. *Loss-graded reindexing modality.* A monotone family `GEcho` over + function-level equality: `m' ≡ m` requires an explicit principle such as funext in that presentation. Pointwise equality can instead be used for categorical hom-setoids (Pillar B-1, §3). +. *Loss-indexed diagram.* A monotone family `GEcho` over the loss-grade join-semilattice with a functorial reindex `degrade`. The "counit" is the identity coercion (the bottom grade `keep` is absorbed definitionally); the "comultiplication" is the @@ -114,11 +97,8 @@ the rest of the paper bears. equations (§4.2) hold for exactly one reason: the grade order is thin (`≤g-prop`) and `degrade` is functorial (`degrade-compose`). This is a thin-poset action, not a graded comonad (Pillar B-2). -. *Separating model.* the model minus its single hypothesis - `≤g-prop`: generic Σ-functoriality survives, the characteristic - composition law is refuted at a decidable witness. Read precisely, - this *measures* the modality's content over generic Σ: it is - exactly thinness of the grade order, nothing more (Pillar C, §5). +. *Parallel-arrow countermodel.* `EchoSeparating` retains ordinary fibre functoriality and gives distinct actions to two parallel arrows. It refutes a law identifying a chosen composite with every direct parallel arrow. Chosen-composite functoriality remains valid; no separation from general Σ-types follows (Pillar C, §5). + . *Carrier-parametric abstraction (not model-independence).* an abstract interface `GradedLossModel` whose `⊑-prop` field *fixes* the only load-bearing hypothesis; the coherence equations are @@ -126,12 +106,8 @@ the rest of the paper bears. poset. The "second model" is the first with a `⊤` component, agreeing definitionally (`refl`). This is carrier-parametricity, not semantic model-independence (Pillar D, §6). -. *Postulate-free build (not a conservativity metatheorem).* the - whole development typechecks `--safe --without-K` with zero - postulates / zero escape pragmas, CI-enforced. With `Echo = Σ` - definitionally this is *evidence for* conservativity over MLTT+Σ; - it is not a mechanised proof-theoretic conservativity theorem, - and is no longer stated as one (§6.2). +. *Scoped safe builds.* The seven workflow roots have their declared profiles; the ordinary roots use `--safe --without-K`, while the Cubical root is checked separately. The guard script exempts three named modules. Successful baseline CI establishes neither a typecheck of all tracked files nor a conservativity metatheorem. The current 15 direct/audit entrypoints and seven existing roots pass local Agda 2.7.0.1 checks, with profile and warning details in the evidence ledger. The fresh `--ignore-interfaces` AuditSmoke check also passes with exit 0 on unchanged proof sources (§6.2). + . *Methodology.* falsifiable gates with explicit retraction actions; identity claims settled negatively and logged, including this development's own framing retraction (§7, <>). @@ -242,11 +218,11 @@ this lineage. That framing was retracted (<>) for a concrete and verifiable reason: `EchoGradedComonad.agda` exhibits no nested family `GEcho (GEcho …)` and no structure map of shape `D_{g₁ ⊔ g₂} ⇒ D_{g₁} D_{g₂}`. What is mechanised is the strictly -smaller thin-poset reindexing modality described next; this is the +smaller thin-poset indexed diagram described next; this is the lineage Echo is *motivated by* and not the structure Echo *instantiates*. -=== Thin-poset reindexing modalities +=== Indexed diagrams over the concrete grade order The structure Echo actually carries is a monotone family `GEcho` over a join-semilattice `(Grade, ⊔, keep)` of loss grades, together @@ -255,8 +231,7 @@ with a functorial reindexing action `degrade : g₁ ≤g g₂ → GEcho g₁ * The order `_≤g_` is *propositional* (`≤g-prop`): there is at most one inhabitant of `g₁ ≤g g₂` for any given pair. This is the - paper's single load-bearing hypothesis (§5 measures content - *exactly* at this hypothesis). + hypothesis making arbitrary parallel order proofs equal. It is used together with the action laws; §5 separates arbitrary-arrow independence from ordinary composition. * `degrade` is *functorial* (`degrade-compose`): composing two degradations through a common intermediate agrees with degrading directly. @@ -440,7 +415,7 @@ curated `EchoCanonicalIdentitySuite.agda` re-exports the F5 headlines under the suite-side index. ==== -== The loss-graded reindexing modality +== The loss-indexed diagram === Structure @@ -458,7 +433,7 @@ they are: * `gduplicate g₁ g₂ : GEcho g₁ → GEcho (g₁ ⊔ g₂)` is the join-left reindex `degrade (≤-⊔-left g₁ g₂)`. It is a *single* grade application. There is no nested `GEcho (GEcho …)` and no - `D_{r·s} ⇒ D_r D_s` anywhere in the development, so this is not a + `D_{r·s} ⇒ D_r D_s` in this single-index interface, so this is not a graded comultiplication; it is monotone reindexing into the join. [#h2-verdict] @@ -471,40 +446,13 @@ to exactly two ingredients: the path-independence lemma `degrade-compose` and propositionality of the loss order `≤g-prop`. There is no path algebra, no `subst`, no transport. -The honest reading of this collapse is the opposite of a strength -claim. The equations reduce to thinness because *there is no -comonadic coherence to discharge*: a thin poset with a functorial -monotone action satisfies these equations definitionally. The -separating model (§5) confirms this precisely — delete `≤g-prop` and -the characteristic equation breaks, while generic Σ-functoriality is -untouched. So the entire content of this modality over and above -generic Σ is exactly: *the grade order is thin*. We report this as a -calibration result, not as evidence of a cheap coherence tower. The -project's own Gate-2 audit (`docs/characteristic.adoc`) reaches the -same conclusion for the wider "characteristic theorem family" (all -instances of one `X-compose = X-prop + X-comp` recipe). +These equations follow from the selected action laws and propositionality of homs. They are indexed-diagram equations, not the counit and comultiplication equations of a graded comonad. The countermodel below locates the stronger arbitrary-parallel-arrow requirement. Thinness alone does not supply an action, and the example establishes neither necessity of thinness for every action nor a distinction from general Σ-types. == The separating model -The separating model is the modality with its *single* hypothesis -`≤g-prop` deleted: a loss order with two distinct arrows `lo→hi` and -a reindexing that distinguishes them. Generic Σ-functoriality -(`map-over` id/comp) and the functorial unit still hold verbatim — it -is a bona-fide Echo setting. The characteristic composition equation -is *refuted* at a concrete decidable witness, discharged by a checked -`true ≢ false`. - -We state the conclusion precisely, without spin. The separating model -does not show the modality is "genuine structure, not bookkeeping" in -the reviewer's sense; it *quantifies* the gap. The characteristic -equation is not a generic Σ-consequence — but the *only* thing it -adds over generic Σ-functoriality is `≤g-prop`, i.e. that the grade -order is thin. A reader who regards "the grade preorder is thin" as -sufficient structure may keep the framing; a reader who does not will -correctly read this as Σ-functoriality over a thin poset. The -countermodel is a real, citable calibration object; it does not -neutralise the "Σ over a poset" objection so much as locate it -exactly. +The index has two distinct arrows `s₀ , s₁ : lo → hi`. The action sends them to identity and Boolean negation. Its identities and composition respect a chosen `sep-compose`; generic `Echo.map-over-id` and `map-over-comp` also hold. + +`SepDegradeCompose` quantifies over an arbitrary direct arrow `p₁₃`, rather than requiring it to be the composite of `p₁₂` and `p₂₃`. Choosing `p₁₂ = rfl-lo`, `p₂₃ = s₀`, and `p₁₃ = s₁` forces `true ≡ false`. Thus `sep-degrade-compose-fails` refutes independence from arbitrary parallel arrows. `sep-deg-comp` witnesses ordinary chosen-composite action laws. This calibrates a specific stronger axiom; it does not refute functoriality or separate Echo from dependent pairs. == Carrier-parametricity, and the limits of the conservativity claim @@ -558,19 +506,7 @@ retraction follow-up F-2026-05-18a. === The conservativity claim, narrowed -Because `Echo = Σ` definitionally and the whole development is -postulate-free under `--safe --without-K`, with zero escape pragmas -and CI greps enforcing it, the artefact is *evidence* that the loss -modality adds no proof-theoretic strength over MLTT+Σ. We state only -that. We do *not* claim a mechanised conservativity metatheorem: a -green `--safe` build is necessary but not sufficient for proof-theoretic -conservativity (a statement quantifying over all base propositions), -and no such meta-argument is mechanised. `conservativity.adoc` has -been narrowed accordingly: clause 1 (`EchoFiberBridge`) is the -definitional Σ-identity it is; clause 2 is restated as the -postulate-free build property; the "modality not axiom" clause is -retained only in the weak, true form — the reindexing modality is -*derived*, not postulated. +`Echo` is a definable dependent pair, and its basic operations use standard elimination rules. Successful safe-profile checks are evidence about those checked sources under Agda's trust base. They do not prove a theorem quantifying over all propositions of a base theory. The repository contains explicit postulated/exploratory exceptions and a distinct Cubical profile. No repository-wide postulate-free or mechanized conservativity theorem is claimed. == Methodology: falsifiable gates and retraction @@ -633,7 +569,7 @@ inserted to make a proof go through. | 1 / 0 (the lone `subst` is in `IsMediator.coherent`'s *shape*, not in a proof body) | 0 -| B (graded comonad) +| B (legacy comonad-named diagram laws) | `EchoGradedComonad.agda` | 159 | `gextract`, `gduplicate`, `gcomonad-counit-l`, `gcomonad-counit-r`, `gcomonad-coassoc` @@ -718,16 +654,7 @@ mechanisation would look like the literature's graded-comonad mechanisations rather than like ours. The separating model (`EchoSeparating.agda`) is the operational -witness for this reading. It is `EchoGraded` minus `≤g-prop`; every -generic Σ-functoriality law (`sep-map-over-id`, `sep-map-over-comp`, -the functorial-unit triad) still holds by the same definitional -collapse, and `sep-degrade-compose-fails` exhibits a checked -`true ≢ false` refutation of `SepDegradeCompose`. The single -two-line refutation `sep-degrade-compose-fails law = true≢false (law -rfl-lo s₀ s₁ true)` measures exactly the cost of removing -propositionality of the order: one degenerate composition pair -disagrees. That is the only content there is to remove `subst` from -in the first place. +witness for the arbitrary-parallel-arrow distinction. `SepDegradeCompose` compares a chosen two-step path with a potentially different direct arrow. Its Boolean refutation preserves the ordinary action laws for the chosen composite. This is a limitation of that stronger axiom, not an obstruction to functor composition. === Where the construction does *not* extend @@ -758,19 +685,9 @@ parameter* — never a postulate, and never silently — and is exactly as strong as that conditional form. The retraction stands for the unconditional claim. -==== The content is thinness of the order, full stop +==== Scope of the index abstraction -The coherence equations collapse to `degrade-compose` + `≤g-prop`; -the separating model shows that over generic Σ-functoriality, the -only load-bearing hypothesis is `≤g-prop`. The `GradedLossModel` -interface bakes `⊑-prop` in as a field, and both `set-model` and -`rel-model` fix the *same* grade poset (the second is the first -`× ⊤`, agreeing by `refl`). This is carrier-parametricity over a -fixed thin poset, not semantic model-independence — and was -retracted under that earlier framing. A category theorist reading -this paper should expect the strength of a thin Grothendieck -fibration with a propositional order, not the strength of a graded -comonad in a non-thin lattice. +`GradedLossModel` fixes propositionality of its order proofs and assumes a compatible action. This is carrier-parametricity over the selected index, not semantic model-independence. A diagram with nontrivial parallel arrows can also have a functorial action; it need not satisfy independence from every parallel arrow. The counterexample does not establish a classification of all diagrams, modalities, or graded comonads. === Threats to validity @@ -872,30 +789,9 @@ neighbour in the entire literature, and we own the coincidence loudly (see <> and §1). A category theorist or HoTT user should recognise the construction on first sight. -What Echo adds *over the bare fibre* is not a new object but an -organising vocabulary plus four verified deliverables that HoTT users -typically do not unify: - -* a funext-relative pointwise mediator property - (`echo-pullback-univ` in `EchoPullback.agda`; conditionally - strengthened to genuine terminality under an explicit `funext` - module parameter in `EchoPullbackUnivF4.agda`); -* a thin-poset reindexing action on a loss-grade lattice - (`EchoGradedComonad.agda`'s three coherence equations, each - collapsing to `degrade-compose` + `≤g-prop`); -* a separating model that *measures* the modality's content over - generic Σ at exactly `≤g-prop` (`EchoSeparating.agda`); -* a postulate-free build (`--safe --without-K`, no escape pragmas, - CI-enforced) so that the whole package is evidence for - conservativity over MLTT+Σ. - -What Echo does *not* add over HoTT: anything foundational. A -cubical-Agda user has access to univalence and HITs and can express -every construction here natively, frequently more cleanly. The -contribution is at the *exposition* and *packaging* level — naming -the thin-poset reindexing modality, isolating its load-bearing -hypothesis, and shipping it under a retraction discipline — not at -the foundations level. +The presentation collects standard fibre facts, a pointwise pullback mediator, an indexed diagram, and a parallel-arrow countermodel. These are expressible using ordinary dependent pairs and equality. Conditional function-level results take funext explicitly. The local `EchoDependentPushforward` extension instead uses pointwise hom-setoid equality; its Agda 2.7.0.1 check passes as recorded separately in the evidence ledger. Its composition comparison is a natural isomorphism, not a complete base-indexed coherence package. + +This paper claims neither a foundational extension nor priority for the packaging. The novelty and usefulness of the presentation need independent comparison. Safe-root verification is scoped by the actual workflow and exceptions in `docs/foundation.adoc`. What we explicitly do *not* claim is distinctness from the homotopy fibre. The win lives one step to the side: against @@ -926,8 +822,7 @@ of this lineage and was retracted from that framing in adversarial review (see <>). Stating the corrected position plainly: `EchoGradedComonad.agda` does *not* exhibit a graded comonad. There is no nested family `GEcho (GEcho …)` and no -structure map of shape `D_{g₁ ⊔ g₂} ⇒ D_{g₁} D_{g₂}` anywhere in the -codebase. What is mechanised is a *single* grade application +structure map of shape `D_{g₁ ⊔ g₂} ⇒ D_{g₁} D_{g₂}` in that module. Separate writer carriers must be judged on their own interfaces and laws. What is mechanised is a *single* grade application `gduplicate g₁ g₂ : GEcho g₁ → GEcho (g₁ ⊔ g₂)` — the join-left reindex `degrade (≤-⊔-left g₁ g₂)`. The three coherence equations (`gcomonad-counit-{l,r}`, `gcomonad-coassoc`) hold for one reason: @@ -936,32 +831,9 @@ the grade order is thin (`≤g-prop`) and `degrade` is functorial `gduplicate` for module-continuity reasons, with §4 stating plainly what they are. -What Echo *is*, against this lineage, is a *loss-graded reindexing -modality* — a thin-poset action with a functorial monotone -reindex. This sits one rung *below* a graded comonad in the -ladder of structure: every graded comonad over a thin grade poset -collapses to one of these, but not conversely. Against QTT -specifically, the `LinearErasure` example in -`proofs/agda/examples/LinearErasure.agda` and the linearity-side -analogue in `EchoLinear.agda` (two-mode `linear ⊑ affine` -decoration, `degradeMode`, `degradeMode-compose`, -`degradeMode-via-join`) exhibit the recipe at the same shape that -QTT's `0 ≤ 1 ≤ ω` quantity ordering carries. On *bare echo*, QTT -and Echo coincide: the inverse problem "given erased term at -quantity ν, what was the source annotation?" is natively -`Σ (q : Quantity) (erase q ≡ y)`, which is `Echo erase y`. - -What Echo adds over the graded-comonad lineage: nothing -load-bearing on judgmental grounds — Echo introduces no new -formation rule, context structure, or substructural discipline (§1 -"Why not 'linear or dependent'"). What is added is a verified -*calibration result*: the separating model (§5) pins down the -single load-bearing hypothesis (`≤g-prop`) and confirms that -generic Σ-functoriality survives without it. This is the kind of -result the graded-modality literature typically does not ship at -this granularity, but the result *is itself* about how little -content the modality adds over generic Σ. We report it as -calibration, not as evidence of a rich coherence tower (§4.2). +`EchoModality` is an indexed diagram. There is no general theorem that every graded comonad collapses to this record, nor does this record alone specify graded-comonad structure. The `EchoLinear` example supplies two modes and associated weakening equations; it does not impose a linear context discipline on Agda clients. Fibre witnesses and Holding cells remain duplicable. + +The comparison with QTT or Granule concerns the selected encoding only. Those languages can express the fibre in a dependent setting and have additional quantity-sensitive rules. The parallel-arrow counterexample calibrates one coherence formulation and establishes no priority claim against that literature. What Echo does *not* add over QTT / Granule: any judgmental extension, any quantity-sensitive elimination rule, any syntactic @@ -994,10 +866,7 @@ What Echo adds over lenses (catalogued more fully in The witness `(true , false) : Echo visible true` is a retained state, not the machinery for overwriting one. * *Honest asymmetry on the put side.* `no-section-visible` in - `EchoCharacteristic.agda` proves there is no section - `Bool → Bool × Bool` of `visible`; the echo framing is honest - about one-argument impossibility and captures what is - nevertheless retained. + `EchoCharacteristic.agda` proves that `visible` has no left inverse recovering both source bits from one visible bit. It does have right inverses, for example by choosing the hidden bit constantly. The historical identifier is retained. * *Sequential composition as an isomorphism theorem.* `Echo-comp-iso : Echo (g ∘ f) y ↔ Σ B (λ b → Echo f b × g b ≡ y)` (Echo.agda) ships sequential composition as a verified @@ -1007,8 +876,7 @@ What Echo adds over lenses (catalogued more fully in analogues ship as definitions. * *Residue as first-class lowering.* `EchoResidue.echo-to-residue` lowers a full echo to a certificate; `no-section-collapse-to-residue` - witnesses strict non-recoverability. Optics do not typically - ship a quotient-of-witness with a non-recoverability proof. + rules out a left inverse for that collapse. This is an ordinary non-injectivity result, not a general separation from optic or dependent-pair representations. What Echo does *not* add over lenses: no update / `put`, no round-trip laws, no profunctor or van Laarhoven encoding, no @@ -1126,7 +994,7 @@ Against modal type theories with sufficient ambient mode structure, *Echo coincides with the native modal Σ-construction on bare echo*; whether the coincidence extends to the characterisation package — and specifically whether QTT -expresses the thin-poset reindexing modality natively without +expresses the thin-poset indexed diagram natively without echo machinery — is a recipe-level open question (`docs/adjacency/modal-type-theories.adoc`, retraction condition 1). Stating the coincidence plainly is more honest @@ -1134,94 +1002,10 @@ than overstating distinctness. === Synthesis: a characterisation package, not a new object -The cross-cutting claim is not that Echo is a new construction. -It is the homotopy fibre. What this paper contributes is a -*fully mechanised characterisation package* for that construction -together with the smallest interesting modality over it: - -. a definitional Σ-identity bridge to the HoTT fibre (Pillar A); -. a funext-relative pointwise mediator property at the pullback - presentation, with strict terminality earned back under an - explicit `funext` module parameter (Pillar B-1, §3); -. a loss-graded reindexing modality whose three coherence - equations provably reduce to thinness of the grade order - (Pillar B-2, §4); -. a separating model that locates that reduction exactly - (Pillar C, §5); -. a carrier-parametric abstraction over a fixed grade poset - (Pillar D, §6); -. a postulate-free `--safe --without-K` build with zero escape - pragmas (§6.2); -. a falsifiable-gate methodology with a public retraction log - (`docs/retractions.adoc`, §7), of which the 2026-05-18 - reframing is itself the working example. - -The novelty is in the *packaging discipline*, not in the -underlying object. Against each adjacent framework we are -honest about what Echo *does not* add: foundations vs HoTT, -judgmental extensions vs the graded-modality lineage, update -machinery vs lenses, surface algebra vs provenance semirings, -quotient types vs setoid quotients, recipe-level distinctness -against modal type theories with sufficient ambient structure. -The standing we claim is exactly that of a characterisation -package whose load-bearing hypothesis (`≤g-prop`) is isolated, -whose models are pinned, and whose bounds are stated rather -than spun. - -NOTE: *Bib TODO.* Inline (Name Year) references in this -section that require formal bibliography entries when a venue -template is chosen: -HoTT Book (Univalent Foundations Program 2013, §§3.7, 4.2); -Vezzosi–Mörtberg–Abel "Cubical Agda" (ICFP 2019); -Uustalu–Vene "Comonadic notions of computation" (ENTCS 2008); -Petriček–Orchard–Mycroft "Coeffects: a calculus of context-dependent -computation" (ICFP 2014); -Brunel–Gaboardi–Mazza–Zdancewic "A core quantitative coeffect -calculus" (ESOP 2014); -Katsumata "Parametric effect monads and semantics of effect -systems" (POPL 2014); -Atkey "Syntax and semantics of quantitative type theory" -(LICS 2018); -Orchard–Liepelt–Eades "Quantitative program reasoning with graded -modal types" (ICFP 2019, Granule); -Reed "A judgmental deconstruction of modal logic" (CMU TR 2009); -Pfenning–Davies "A judgmental reconstruction of modal logic" -(MSCS 2001); -Birkedal–Møgelberg–Schwinghammer–Støvring "First steps in -synthetic guarded domain theory" (LICS 2011); -Shulman "Brouwer's fixed-point theorem in real-cohesive homotopy -type theory" (2017); -Foster–Greenwald–Moore–Pierce–Schmitt "Combinators for -bidirectional tree transformations: a linguistic approach to the -view-update problem" (POPL 2005, lenses); -Pickering–Gibbons–Wu "Profunctor optics: modular data -accessors" (Art Sci. Eng. Program. 2017); -Cousot–Cousot "Abstract interpretation: a unified lattice -model" (POPL 1977); -Goguen–Meseguer "Security policies and security models" -(IEEE S\&P 1982); -Green–Karvounarakis–Tannen "Provenance semirings" (PODS 2007); -Swamy et al. "Dependent types and multi-monadic effects in F\*" -(POPL 2016); -Vazou–Seidel–Jhala–Vytiniotis–Peyton Jones "Refinement types for -Haskell" (ICFP 2014, Liquid Haskell). - -NOTE: *Related-work `[EXPAND]` cleared 2026-05-26.* The original -`[EXPAND]` TODO requested detailed positioning against Granule / QTT -graded modalities, Uustalu–Vene comonads, Petriček–Orchard–Mycroft -coeffects, HoTT fibrewise constructions, and the lens / optic -literature with the 1-lens-vs-2-cell-optic clarification. That work -has been delivered above in §"HoTT homotopy fibres", §"Graded comonads, -coeffects, and QTT", and §"Lenses and optics (the witness-transport -leg)" — including the explicit 2-categorical rule-out at the end of -the lens/optic subsection (`docs/echo-types/decisions/no-2-cat.adoc` -is the load-bearing closure note). A companion single-page comparator -table at `docs/echo-types/comparators.adoc` (Echo vs Granule / QTT / -choreographic / Linear Haskell) ships the axis-by-axis summary form -for reviewers who want the at-a-glance positioning rather than the -prose narrative above. - -[#reframing-note] +The cross-cutting claim is a presentation of the standard fibre with indexed diagrams, examples, and bounded negative results. The definitional fibre bridge, source-retaining total completion, supplied-factorisation composition equivalence, and pointwise mediator are standard constructions. Function-level strengthenings retain their explicit funext parameters. + +The parallel-arrow example refutes a stronger independence law, and selected entropy/resource/linear-encoding examples show information loss in those observations. None establishes separation from general Σ-types, all modalities, or all resource encodings. Novelty and priority remain unresolved. Verification is limited to the stated root closures and profiles; it does not certify all repository files or local edits. + == Reframing note (2026-05-18) This draft was reframed after an adversarial three-reviewer review @@ -1235,7 +1019,7 @@ following claims were retracted, not weakened cosmetically: | Retracted claim | Replaced by | "graded comonad" (counit/comultiplication, three comonad laws) -| loss-graded *reindexing modality*; no nested `D_r D_s` is formed; +| loss-graded *indexed diagram*; no nested `D_r D_s` is formed; the equations hold by thinness of the grade order | "terminal-cone universal property"; "a category theorist accepts @@ -1270,27 +1054,9 @@ via a genuine non-graph `StepND` model (§6 NOTE, `EchoStepNDModelF2.agda`). The graded-comonad, modality-level model-independence, and conservativity rows remain fully retracted. -*Variance resolved (follow-up F-2026-06-19, 2026-06-19).* The -graded-comonad row is now *positively resolved*, not merely retracted. -The sharpened understanding of an echo-type — a tropically-graded -modality of structured loss over the min-plus semiring, recoverable -*exact on a homotopy fibre rather than complement-storing* — left a -precise live question: the combining direction of loss is monadic -(accumulation is `μ : D_r (D_s A) → D_{r+s} A`), so is the right word -graded comonad, graded monad, or graded adjunction? `EchoVariance.agda` -settles it in `--safe` Agda (`docs/echo-types/variance-resolution.adoc`): -(i) accumulation is the graded-MONAD multiplication, total and canonical -(`accumulate = Echo-comp-iso-from`); (ii) recoverability is exact on the -grade-0 fibre, the section/retraction *adjunction* -(`recoverable-fibre = A↔ΣEcho`); (iii) the graded-COMONAD direction fails -for genuine loss — bare-residue recovery is the no-section obstruction -(`no-bare-recovery`); and (iv) the "graded comonad" reading is the -LOSSLESS complement-storing writer (`EchoGradedComonadF1`'s `δ` is `coe` -along a type equality, inverted by `μ-writer`), i.e. the resource -neighbour, not the loss modality. Net: echo is a graded *monad* of -accumulation with a fibre-exact section/retraction *adjunction*; it is -*not* a graded comonad. This sharpens the retracted row from "withdrawn" -to "decided against", and does not resurrect any retracted prose. +*Variance correction (2026-11-06).* The earlier 2026-06-19 “resolved” description exceeded `EchoVariance.agda`. The module gives inverse maps for fibres of a supplied composite. It does not supply tropical endofunctors, natural transformations, grading coherence, and all monad laws. `A↔ΣEcho` retains the original source and has no grade parameter; it is not recovery from a bare output or a minimal complement theorem. + +`no-bare-recovery` rules out a left inverse for the specified Boolean collapse. A counit recovering arbitrary content from an erasing carrier is obstructed under its exact assumptions. This does not prohibit every graded comonad involving loss. Writer carriers retain their source content; the baseline `GradedComonadStructure` nevertheless omits naturality. The `NaturalGradedComonad` companion, its witnesses, and the local family pushforward/reindexing development pass Agda 2.7.0.1 checks for their explicit categorical obligations. A natural erasing graded-comonad counterexample also passes, with the documented Cubical transport warnings on two ordered compatibility equations. See `variance-resolution.adoc`. == Post-establishment structural extensions (2026-05-27) @@ -1318,7 +1084,7 @@ Three layers: + echo↔fib bridge). `EchoImageFactorization.Image` is the proof-relevant image (= total Echo space) with both triangle legs named. `EchoNoSectionGeneric.no-section-of-collapsing-map` - lifts the long-standing single-instance no-section result to a + lifts the long-standing single-instance no-left-inverse result to a structural theorem about any collapsing map with distinguishable collapsing pair. @@ -1379,17 +1145,9 @@ it — governs this layer as it did Pillars A–D. == Conclusion -Echo is the homotopy fibre equipped with a loss-grade lattice, -carrying a loss-graded reindexing modality. What survives adversarial -review is narrower than first claimed but exactly stated: a -definitional Σ-identity; a funext-relative pointwise mediator -property; a reindexing modality whose coherence equations reduce, -demonstrably, to thinness of the grade order; a separating model that -locates that reduction precisely; a carrier-parametric abstraction; -and a postulate-free `--safe --without-K` build. Its standing comes -from being *exactly characterised and honestly bounded* under a -falsifiable retraction discipline — of which this reframing is an -instance. External validation is the remaining step. +Echo is the standard dependent fibre. The library adds presentations, indexed diagrams, and scoped examples. Total completion retains the source; selected collapse maps lack left inverses; parallel-arrow independence can fail while ordinary functor composition holds. These statements are all expressible with dependent pairs. + +The work does not establish a general separation from Σ-types, a reflective modality, a full tropical graded monad, linear runtime enforcement, or physical thermodynamic laws. Novelty and priority remain research obligations. The dated evidence ledger distinguishes the successful baseline remote workflow from source inspection and fresh local verification. [appendix] [#ordinal-appendix] diff --git a/docs/echo-types/sigma-distinctness-map.adoc b/docs/echo-types/sigma-distinctness-map.adoc index 58e3ac77..da8b9406 100644 --- a/docs/echo-types/sigma-distinctness-map.adoc +++ b/docs/echo-types/sigma-distinctness-map.adoc @@ -1,18 +1,22 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= Echo vs. Sigma: distinctness evidence map += Echo and Sigma: scoped evidence map :toc: macro :toclevels: 2 :sectnums: :sectnumlevels: 2 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] This file is the reviewer-facing companion to `core/skepticisms/is-this-just-sigma-types.md`. Its job is one thing: -collect, in one place, the in-repo evidence that `Echo f y` is not -"renamed `Σ A (λ x → f x ≡ y)`" and to organise that evidence under the -five demands a sceptic typically makes. +collect the in-repo constructions around `Echo f y`, which is definitionally `Σ A (λ x → f x ≡ y)`. None of the rows separates Echo from general dependent pairs. Selected lossy representations can forget information; that is a statement about those representations. [IMPORTANT] ==== @@ -36,7 +40,7 @@ sceptic might want. [cols="1,3", options="header"] |=== -| Claim | Echo proves that no section of the loss-map exists, across multiple decoration layers. Raw `Σ` gives `proj₁` trivially. +| Claim | Non-injectivity rules out a left inverse for the specified loss map. This is standard mathematics expressible with raw `Σ`; the historical no-section theorem identifiers retain their names. | Agda | `EchoCharacteristic.no-section-collapse`, @@ -51,7 +55,7 @@ sceptic might want. `docs/proof-obligations.md` §"No-section" entries, `README.md` §"Characteristic family". -| Narrowing | None. The family lemmas are clean negative results under +| Narrowing | These are no-left-inverse results, not a general absence of categorical sections or a separation from dependent pairs. The family lemmas are negative results under `--safe --without-K`. |=== @@ -59,8 +63,7 @@ sceptic might want. [cols="1,3", options="header"] |=== -| Claim | The fibre carries a loss-grade lattice with a monotone -reindexing modality. Down-step is admissible; up-step is provably not. +| Claim | The chosen family has an indexed action over the concrete loss order. Selected non-injective down-steps have no left inverse; no statement about every possible up-map is made. | Down-step (Agda) | `EchoGraded.degrade-compose` and `EchoGraded.degrade-via-join` are the @@ -73,14 +76,11 @@ per-decoration composition laws. The same recipe lands at `EchoResidue.no-section-collapse-to-residue`). | Separating model | `EchoSeparating.sep-degrade-compose-fails` — -removing `≤g-prop` (the only load-bearing hypothesis) breaks -`degrade-compose` at a checked `true ≢ false`. This locates the -reduction. +the distinct parallel actions refute equality with an arbitrary direct arrow. Chosen-composite action laws remain valid. Thinness is sufficient for identifying parallel arrows, not necessary for every functorial action. | Prose | `docs/characteristic.adoc` (Gate 2 audit), N1–N4 nominees. -| Narrowing | Per R-2026-05-18, this is a *thin-poset reindexing -modality*, not a graded comonad. No nested `D_r D_s` is formed. +| Narrowing | This interface is a preorder-indexed diagram, not a reflective modality or a graded-comonad interface. Separate writer-carrier constructions have their own laws and naturality obligations. |=== === Demand 3 — Categorical identity and bridges @@ -108,17 +108,14 @@ Landauer / Bennett). | Narrowing | The bridges are independent witnesses, not a single "every loss-tracker maps uniquely into Echo" theorem. Such a uniqueness -result would require either funext or an axiom and is therefore *not* -in scope under the no-postulate invariant. +result needs a specified category and equality on homs. Pointwise hom-setoid equality avoids a global funext axiom; no universal property follows merely from the word “bridge”. |=== === Demand 4 — Abstraction barrier (consumer-side) [cols="1,3", options="header"] |=== -| Claim | The Echo interface at the affine mode forbids the consumer -from distinguishing two preimages of the same output. Raw `Σ` does -not, via `proj₁`. +| Claim | Consumers of the selected contractible affine residue cannot distinguish its erased sources. Retaining the source in a raw Σ would permit `proj₁`; a Σ encoding of the same erased interface has the same restriction. This is a comparison of chosen carriers. | In-tree precursor (Agda) | `EchoLinear.affine-canonical`, `EchoLinear.affine-all-equal` — the affine residue carrier is @@ -157,8 +154,7 @@ just decorative wrapping. | Planned matched-negative (Agda) | `proofs/agda/examples/EchoVsSigma.agda` — Track C in the work plan. -Pairs each headline example with the small raw-`Σ` counter-program -that would let the corresponding bug through. +Contrasts the chosen API with a deliberately lossy or insufficiently constrained representation. Raw `Σ` can express the same invariants as Echo; a universal raw-`Σ` leakage claim is false. | Prose | `docs/echo-types/examples.md`, `roadmap-gates.adoc` Gate 3. diff --git a/docs/echo-types/types-abstract.adoc b/docs/echo-types/types-abstract.adoc index e6413345..15a22851 100644 --- a/docs/echo-types/types-abstract.adoc +++ b/docs/echo-types/types-abstract.adoc @@ -1,250 +1,50 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= Echo: a definitionally-grounded, loss-graded reindexing modality += Echo: dependent fibres and indexed structured-loss models :toc: macro :toclevels: 2 -:sectnums: -:icons: font - -[.lead] -Pillar E, artefact 1 of `establishment-plan.adoc`: a TYPES-style -extended abstract (≈2 pp). [IMPORTANT] ==== -*NOT submission-ready (status withdrawn 2026-05-18).* This abstract -previously claimed a graded comonad, two independent models, a -conservativity metatheorem and a terminal-cone universal property. -All four were retracted after adversarial review — see -`docs/retractions.adoc` (R-2026-05-18) and `paper.adoc` §"Reframing -note". The text below has been corrected to what is actually -mechanised; it must be re-reviewed before any submission. Every claim -below is mechanised in the accompanying `--safe --without-K` Agda -artefact and pinned in `Smoke.agda`, and is stated at its true -strength — no claim exceeds the artefact. +*Withdrawn draft; re-review required.* This abstract supersedes its earlier graded-modality and distinctness formulations. It is not submission-ready. Verification is scoped by link:../foundation.adoc[the foundation record] and link:../audit/2026-11-06-evidence.adoc[the dated evidence ledger]. The new local modules and existing seven roots pass the recorded Agda 2.7.0.1 checks; the separate fresh `--ignore-interfaces` AuditSmoke check also passes with exit 0 on unchanged proof sources. ==== -toc::[] - -== Context and the honest verdict - -Define, for `f : A → B` and `y : B`, -`Echo f y := Σ (x : A) , (f x ≡ y)`. This is *definitionally* the -homotopy fibre `fib f y` (HoTT book Def. 4.2.4); the bridge -`echo↔fib` is mechanised with `refl` round-trips. - -We do **not** claim echo as a new judgmental type strength. Dependent -types are a formation discipline; linear / substructural types are a -structural-rule discipline; both alter the judgmental apparatus. -`Echo` introduces no new judgement, context structure, or formation -rule — it is a derived Σ-type. Comparing it to "linear or dependent" -strength is a category error, and we own that loudly: it pre-empts a -reviewer's first objection and is the foundation of the result, not a -hedge. - -The strength that *does* befit echo is a **loss-graded reindexing -modality**: a monotone family over a join-semilattice of loss grades -with a functorial reindexing action. It is *motivated by* the -coeffect / quantitative lineage (Petriček–Orchard–Mycroft; -Brunel–Gaboardi–Mazza–Zdancewic; Atkey's QTT; -Orchard–Liepelt–Eades / Granule) but is explicitly *not* a graded -comonad in that sense: no nested `D_{r·s} ⇒ D_r D_s` is formed. The -contribution is to *bound* echo there exactly: a definitional -identity, a funext-relative pointwise mediator property, a -reindexing modality whose coherence equations reduce demonstrably to -thinness of the grade order, a separating model that locates that -reduction, a carrier-parametric abstraction, and a postulate-free -build — all mechanised, under a falsifiable retraction discipline of -which this abstract's own correction is an instance. - -== Contributions - -. *Pinned identity (Pillar A).* `echo↔fib : Echo f y ↔ fiber f y`, - definitional, `refl` round-trips, where `fiber` is a same-module - restatement of the Σ. A deflationary triviality (a type bijective - with itself), made a machine-checked artefact and owned as such — - not a grounding metatheorem. -. *Pointwise mediator property (Pillar B-1).* `Echo f y` presented as - the pullback of `f` along the point `y : ⊤ → B`. A - `SliceHom (λ _ → y) f` *is* a cone (round-trips `refl`); - `echo-pullback-univ` gives existence and *pointwise* uniqueness - `∀ v → m' v ≡ m v`. This is *not* a universal property: full - terminality (`m' ≡ m`) is neither stated nor provable here without - funext. The honest claim is a funext-relative mediator property. - *Earned back conditionally (F4, F-2026-05-18a):* strict terminality - is mechanised as a function of an explicit `funext` parameter - (`EchoPullbackUnivF4.agda`, not a postulate); the unconditional - claim stays retracted, the pointwise corollary is kept. -. *Loss-graded reindexing modality (Pillar B-2).* Over the loss-grade - join-semilattice `(Grade, ⊔, keep)`: `gextract` is the identity - coercion (`keep` is the definitional bottom), `gduplicate` is the - join-left *single-grade* reindex. No nested `D_r D_s`; this is a - thin-poset action, not a graded comonad. -+ -[#h2] -*The H2 verdict, stated honestly.* In the common-upper-bound idiom -the three coherence equations collapse to `degrade-compose` plus -propositionality of the loss order (`≤g-prop`), with no `subst`/ -transport. This collapse is not a strength: the equations reduce to -thinness *because there is no comonadic coherence to discharge*. A -thin poset with a functorial monotone action satisfies them -definitionally. -. *Separating model (Pillar C).* The model with its single hypothesis - `≤g-prop` removed (two distinct `lo→hi` arrows; a reindexing - distinguishing them). Generic Σ-functoriality and the functorial - unit still hold; the characteristic composition equation is - *refuted* at a concrete decidable witness (checked `true ≢ false`). - This *quantifies* the modality's content over generic Σ: it is - exactly thinness of the grade order, and no more. A real - calibration object, not a refutation of the "Σ over a poset" reading. -. *Carrier-parametric abstraction; conservativity, narrowed - (Pillar D).* `GradedLossModel`'s `⊑-prop` field *fixes* the only - load-bearing hypothesis; `GCLaws` proves the equations once, - parametric in the carrier, over a *fixed* grade poset. The "second - model" is the first with a `⊤` component, agreeing by `refl` — not - model-independence. Separately: `Echo = Σ` plus a postulate-free - `--safe --without-K` build is *evidence for* conservativity over - MLTT+Σ; it is not a mechanised conservativity metatheorem and is no - longer claimed as one. - *Earned back, scoped (F2, F-2026-05-18a):* a genuine second model of - the *bare Echo functor* (not the modality) exists on the non-graph - relation `StepND` (`EchoStepNDModelF2.agda`; `nd-not-graph` checked), - with content-bearing agreement — not Σ-η on `× ⊤`. Modality-level - model-independence and the conservativity narrowing are unchanged. - -== The artefact and its discipline - -The Agda development is `--safe --without-K` throughout, with **zero -postulates and zero escape pragmas**, CI-enforced — a build property -that is *evidence for*, not a proof of, conservativity. Every -headline theorem is pinned in a `Smoke.agda` manifest so a silent -rename fails CI fast. Development is governed by *falsifiable gates* -with explicit retraction actions and a public retraction log -(`docs/retractions.adoc`): one identity claim (EI-2) was settled -negatively, and this development's own graded-comonad / -model-independence / conservativity framing was retracted on -2026-05-18 (R-2026-05-18) — both recorded as such. There is no funext -anywhere; the genuine funext-relativity is the pointwise-only -mediator property, disclosed as a bound rather than presented as a -"funext-free" feature. - -== Related work and position - -Echo sits beside, not within, the linear/dependent ladder. The -nearest neighbours are graded / coeffect modalities (Granule, QTT) -and the HoTT treatment of fibres. The novelty is not a new object, -and explicitly not a graded comonad — it is an *exactly-bounded -package*: a definitional Σ-identity, a funext-relative pointwise -mediator property, a reindexing modality whose coherence equations -provably reduce to thinness of the grade order, a separating model -that locates that reduction, a carrier-parametric abstraction, and a -postulate-free build, all under a falsifiable-gate methodology that -has been exercised on this development's own claims. - -Positioning by neighbour (full per-neighbour analysis in `paper.adoc` -§"Related work"): - -* *HoTT fibres.* Echo *is* the fibre (`echo↔fib`, `refl` round-trips). - The win is not against HoTT but one step to the side: against - *propositionally-truncated* fibres, where `‖ Echo f y ‖` discards - witness identity, the un-truncated form retains it - (`echo-not-prop` certificates). -* *Graded comonads / coeffects / QTT* (Uustalu–Vene; Petriček et al.; - Brunel et al.; Atkey; Granule). Echo is *motivated by* this lineage - but explicitly *not* an instance — `EchoGradedComonad.agda` exhibits - no nested `D_r D_s`. What we provide is a *calibration*: the - separating model isolates the single load-bearing hypothesis - (`≤g-prop`) at which generic Σ-functoriality stops being enough. -* *Lenses / optics.* The witness-transport leg of `map-over` / - `map-square` is in the optic neighbourhood; Echo adds explicit - source-retention and honest one-sided non-recoverability (`no-section-*`), - but ships no `put`, no van Laarhoven encoding. -* *Refinement types.* Σ-relevant refinement (Agda/Coq) coincides with - Echo definitionally; propositional-predicate refinement (F\*, Liquid - Haskell) loses what Echo retains (truncation argument). -* *Setoid quotients / provenance semirings.* Echo's kernel is implicit - (named through `f`) and proof-relevant; it ships no quotient - elimination and no semiring. Provenance researchers can read the - residue hierarchy (`keep`/`residue`/`forget`) as K-provenance for an - impoverished `K`. -* *Modal type theories.* The recipe-level question — whether QTT or - Reed–Pfenning S4 expresses the thin-poset reindexing modality - natively without echo machinery — is genuinely open and explicitly - not closed here. - -== Author / artefact statement - -Mechanised in Agda (stdlib 2.3), `--safe --without-K`, no postulates. -Source: `hyperpolymath/echo-types`; headline manifest `Smoke.agda`; -plan and gates in `docs/echo-types/establishment-plan.adoc` / -`roadmap-gates.adoc`; narrowed conservativity properties in -`docs/echo-types/conservativity.adoc`; retraction log in -`docs/retractions.adoc`. - -NOTE: This abstract is *not* submission-ready (status withdrawn -2026-05-18, pending re-review against the reframed `paper.adoc`). -Submission logistics (venue deadline, TYPES-template formatting, -author metadata, Zenodo DOI, arXiv cross-post) remain offline and -author-driven; they are downstream of, not a substitute for, the -re-review. - -NOTE: *In-repo Pillar E status (2026-05-26).* The full `paper.adoc` -has cleared all `[EXPAND]` tags except the ordinal consumer-evidence -appendix (gated on Bachmann–Howard per `roadmap.adoc` §Lane 3). Any -further re-review of this abstract should treat the full paper as -the canonical reference for narrowed claims; this abstract is the -2-page condensation of it. The single-page reviewer companion -`docs/echo-types/comparators.adoc` carries the axis-by-axis -comparison against Granule, QTT, choreographic types, and Linear -Haskell. See `roadmap.adoc` §"Pillar status" for the lane-level -view. - -NOTE: *Post-abstract advances (2026-05-27).* Three layers of -structural work landed after this abstract was drafted and are NOT -reflected in the prose above; they are documented in -`docs/echo-types/MAP.adoc` §"Canonical identity layer" and in -`CLAUDE.md`. Briefly: - -* *Canonical identity layer (Tier 1).* The slogan-unlock theorem - `A ≃ Σ B (Echo f)` (`EchoTotalCompletion.A↔ΣEcho`); the - (equivalence, projection) orthogonal factorisation system witness - `ofs-witness` at the K-free level - (`EchoOrthogonalFactorizationSystem.agda`); image factorisation - `Image f := Σ B (Echo f)` (`EchoImageFactorization.agda`); the - generalised structural no-section theorem - `no-section-of-collapsing-map` (`EchoNoSectionGeneric.agda`). - -* *Classification grid (Tier 2).* Function-side, residue-side, - decoration-recipe, and observational-equality axes are now named - abstractions instead of comments - (`EchoLossTaxonomy.agda` / `EchoResidueTaxonomy.agda` / - `EchoDecorationStructure.agda` / - `EchoObservationalEquivalence.agda`). - -* *Qualified OFS earned back (Tier 3, Pillar F Gate F5 FULL PASS, - 2026-05-27).* All three F5 slices in the F4 template (funext as - explicit module parameter, never a postulate; unconditional - pointwise corollaries kept funext-free): F5-1 strict factorisation - triangle (`EchoOFSUnivF5.agda`), F5-2 diagonal lifting property - (`EchoOFSUnivF5Diag.agda`), F5-3 factorisation uniqueness up to iso - (`EchoOFSUnivF5Iso.agda`). Retraction follow-up F-2026-05-27a in - `docs/retractions.adoc`. The qualified OFS claim is now licensed - in the abstract's claim-text — if the abstract is re-issued, the - Pillar B-1 paragraph should mention "Earned back, qualified - conditionally (F5, F-2026-05-27a): the full OFS earns back at the - funext-qualified level with all three clauses; unconditional - pointwise content remains the funext-free part." - -* *Audience-facing modules + curated suite.* Four audience-move - modules (`EchoProvenance`, `EchoSecurity`, - `EchoProbabilisticSupport`, `EchoDifferential`) expose the - structural content under domain-specific framings; the curated - `EchoCanonicalIdentitySuite.agda` is the single-file entry - point. Each audience module ships an honest-bound matched- - negative block. - -Any re-review of this abstract should treat the post-abstract -layers as additional load-bearing content; a forward-looking -revision should reorganise the Pillar A–D narrative into a -Tier-1+2+3 narrative anchored by the Canonical Identity Suite as -the curated reading order. +== Object and scope + +For `f : A → B`, define `Echo f y := Σ (x : A) , (f x ≡ y)`. This is the standard dependent fibre. It introduces no new judgment, formation rule, or substructural discipline. An inhabitant retains a specific source and its equality witness. The total-space equivalence `A ↔ Σ B (Echo f)` is standard; it contains the source and proves neither recovery from the bare output nor minimal residue storage. + +The additional `EchoModality` interface is a diagram of types over an index preorder. The compatibility name `ThinPoset` denotes a record with reflexivity, transitivity, and propositional homs, but no antisymmetry field. The concrete three-grade instance is an order. This interface has no reflector, reflective-subuniverse predicate, idempotence, or modal elimination principle. + +== Mechanized presentations + +. *Fibre calibration.* `EchoFiberBridge.echo↔fib` is a definitional comparison with a restatement of the fibre. `EchoFiberTriangulation` compares standard-library surjection witnesses and opposite equality orientations. Neither is a soundness metatheorem. +. *Pullback presentation.* `EchoPullback` supplies a pointwise mediator. Function-level strengthenings in F4/F5 take funext explicitly. Pointwise equality can instead serve as hom-setoid equality; its use does not require a global funext axiom. +. *Indexed action.* `EchoGraded` and the public interface supply identity and composition equations for degradation over the selected index. The legacy `gextract`, `gduplicate`, and `gcomonad-*` names in `EchoGradedComonad` describe single-index coercions and their equations, not nested graded-comonad structure. +. *Parallel-arrow counterexample.* `EchoSeparating` acts differently on two parallel arrows. It refutes independence from an arbitrary direct arrow while preserving identity and composition with the chosen composite. This is no general separation from Σ-types or a failure of functor composition. +. *Source-retaining completion and classification.* `EchoTotalCompletion`, `EchoLossTaxonomy`, `EchoResidueTaxonomy`, `EchoDecorationStructure`, and `EchoObservationalEquivalence` organize standard constructions and selected examples. +. *Exact recovery obstruction.* The historical `no-section-of-collapsing-map` identifier rules out a left inverse of a non-injective map. Boolean collapse to unit has two right inverses. Positive section/retraction laws for equivalences retain their actual direction. +. *Conditional factorization results.* F5 supplies a strict triangle, diagonal lifting, and factorization uniqueness up to isomorphism with its explicit parameters. These statements alone do not establish unique diagonal fillers; no unqualified orthogonal-factorization-system theorem follows from those names. + +`EchoVariance` supplies inverse maps between a composite fibre and an iterated fibre for a chosen factorization. This does not assemble a tropical graded monad: endofunctors, naturality, grading coherence, and all monad laws require a separate specification. An erasing-carrier recovery obstruction is carrier-specific, and does not prohibit every loss-related graded comonad. The baseline `GradedComonadStructure` omits naturality; record inhabitants prove only the declared fields. The local `NaturalGradedComonad` companion strengthens that contract, and it and its F1/natural/list witnesses pass the recorded local checks. A natural erasing graded-comonad counterexample also passes; its ordered compatibility proofs carry the documented Cubical transport warnings. + +== Selected comparisons + +`EchoEntropy`, `EchoLLEncoding`, and resource-measure examples show information loss in particular chosen observations or encodings. They do not distinguish Echo from general dependent pairs, all linear-logic representations, or all resource algebras. A dependent-pair encoding can express exactly the same fibre invariant. Novelty and priority of the presentation remain unresolved research obligations. + +The relevant literature includes the HoTT treatment of fibres; graded monads and coeffects (Katsumata; Fujii, Katsumata and Melliès; Petriček, Orchard and Mycroft; Orchard, Liepelt and Eades); comonadic computation (Uustalu and Vene); quantitative type theory (Atkey); and lenses/optics, refinement types, provenance, and modal type theories. These are comparisons to established structures, not evidence that this library implements all their interfaces or rules. + +The linear/affine examples model weakening equations. They do not prevent duplication of an Agda witness. `ResidueCell.once-only` proves reading the returned consumed cell yields `nothing`; the original value remains reusable. No Rust/Idris runtime refinement has been established here. Thermodynamic equations concern the defined arithmetic cost model, not physical energy measurements. + +== CNO and categorical follow-up + +Unrestricted equivalence between `Echo p s` and `Echo id s` characterizes invertible fibre shape, not pointwise identity: Boolean negation is the counterexample. A source-preserving comparison supplies the missing constraint. The baseline constant `Program → ⊤` bridge ignored its program index and CNO certificate. + +Local follow-ups `EchoSourcePreserving`, `EchoCNOSemantics`, and `EchoDependentPushforward` address source preservation, native `CNO.state-eq`, and dependent pushforward/reindexing with pointwise hom-setoids. Their local Agda 2.7.0.1 checks pass. The ordinary fibre-isomorphism characterization includes inverse laws; the native CNO criterion instead uses a source-preserving map of `state-eq`-valued fibres. The CNO characterization is scoped to the pinned dependency's total, zero-energy execution model. The pushforward composition natural isomorphism does not establish full base-indexed coherence. No new linear runtime or ordered tropical programme is implied. + +== Artefact status + +The successful remote baseline Agda run is `41687674126` at `cd85288dcce55191ad477c0fa7d1d2421514a0d3`. The seven workflow roots include ordinary, Cubical, experimental, and narrowing entrypoints. Guard exceptions and files outside their import closures prevent a repository-wide “safe and postulate-free” claim. A green baseline receipt does not validate new local modules. The evidence ledger records successful local checks of all 15 direct/audit entrypoints and all seven existing roots separately, including profile and warning boundaries. + +The negative EI-2 result concerns its attempted simultaneous integration criterion; it remains recorded. The project retains its public retraction log and bounded gate protocol. Historical module names are compatibility labels, not licenses for stronger categorical or distinctness claims. Ordinal mathematics is outside this foundation audit. + +The source is `hyperpolymath/echo-types`; `Smoke.agda` pins selected declarations. The companion `paper.adoc` needs the same scoped review. Venue, DOI, and submission logistics remain author-driven and do not substitute for mathematical review. diff --git a/docs/echo-types/variance-resolution.adoc b/docs/echo-types/variance-resolution.adoc index f3494485..2b37c89a 100644 --- a/docs/echo-types/variance-resolution.adoc +++ b/docs/echo-types/variance-resolution.adoc @@ -1,235 +1,26 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= Echo Types — Variance Resolution (monad / comonad / adjunction) -:date: 2026-06-19 += Echo variance — bounded findings :toc: macro -:toclevels: 3 -:sectnums: -:sectnumlevels: 3 -[.lead] -This note resolves, *in `--safe` Agda rather than by assertion*, the -precise variance of the loss-graded echo modality: is it a graded -comonad, a graded monad, or a graded adjunction? The resolution is -mechanised in `proofs/agda/EchoVariance.agda` and its headlines are -pinned in `Smoke.agda`. It is written to *inform the redesign* of the -repository's modality/measure architecture. +== Status, 2026-11-06 -toc::[] +The earlier title “resolution” overstated the result. `EchoVariance.agda` proves fibre-composition maps and their two pointwise inverse equations for a fixed supplied factorisation. The same source proves a concrete impossibility of exact bare recovery after Boolean collapse and inverse maps for the experimental writer carrier. -== The live question +These statements do not assemble a tropical graded monad. That requires specified endofunctors, action on maps, unit and multiplication naturality, coherent grading, and the monad equations. The total completion `A ↔ Σ B (Echo f)` retains an `A` witness and has no grade parameter. It does not designate a grade-zero recoverable subobject or a minimal complement. -The current, sharpened understanding of an echo-type: +== Recovery directions -[quote] -____ -An echo-type is a tropically-graded modality of structured information -loss — an instance of graded-(co)monad machinery over the min-plus -semiring (ℕ ∪ {∞}, min, +), with a section/retraction pair whose -round-trip is *exact on a homotopy fibre* rather than over-approximating -or complement-storing — whose monad/comonad/adjunction status is being -pinned down formally. -____ +`no-bare-recovery` uses the historically named `no-section-of-collapsing-map`: its equation is `raise (collapse b) ≡ b`, a *left inverse*. The map `collapse : Bool → ⊤` does have categorical sections, namely the two constant maps choosing a Boolean. Positive section/retraction equations for the fibre equivalence and writer maps retain their stated directions and must not be renamed indiscriminately. -The variance was genuinely unsettled, and for a concrete reason. The -*combining* direction of loss is monadic: accumulation has the shape -`μ : D_r (D_s A) → D_{r+s} A`. So the right word — "graded comonad", -"graded monad", or "graded adjunction (with the section as -unit/counit)" — was a live question to be *resolved in Agda, not -asserted*. +== Comonadic claims -Two pre-existing facts framed the question: +A counit that recovers arbitrary content from an erasing carrier is obstructed under the specified assumptions. This is a carrier-specific claim. It does not establish a blanket impossibility of graded comonads involving loss. The experimental writer carrier stores the original content and therefore evades that erasure premise; the `A × ⊤` carrier is also content-preserving. -* *R-2026-05-18* (`docs/retractions.adoc`) already RETRACTED the - unqualified "graded comonad" claim on `EchoGradedComonad`, reframing - it as a loss-graded *reindexing* modality with **no nested - `D_r D_s`**. So the structure the question is actually about — the - nested comultiplication/multiplication — had not been built where the - retraction left things. -* *Gate F1* (`EchoGradedComonadF1`) DID build a genuine nested graded - comonad with `δ : D (m+n) ⇒ D m (D n)`. But — see §4 — its model - stores its residue, which turns out to be the crux. +The baseline `GradedComonadStructure` interface omits naturality. A record inhabitant proves its declared fields only. The local `NaturalGradedComonad` companion and explicit F1/natural/list witnesses now pass Agda 2.7.0.1 checks. `EchoErasingGradedComonad` supplies an accepted natural graded-comonad counterexample with genuine positive-grade erasure; its two ordered compatibility proofs carry the documented Cubical transport computation warnings. Neither an experimental record nor fibre-composition inverses alone settle all variance or tropical-law questions. -== How the tropical semiring already splits across two axes +== Index action -The repository architecture (the `Echo.Modality.*` / `Echo.Measure.*` -foundation surface) already decomposes the min-plus semiring along -exactly the two axes the variance question lives on: +`ThinPoset` is abstractly a thin preorder because its fields omit antisymmetry. `EchoModality` is a preorder-indexed diagram, with a stronger formulation of composition that identifies any direct parallel arrow with the chosen composite. `EchoSeparating` refutes that arbitrary-arrow identification when parallel arrows act differently; ordinary functor composition is not refuted. -[cols="1,3,3a",options="header"] -|=== -| Tropical op | Role | Where it lives - -| `min` (⊕, the order / lattice) -| The thin echo *index*. `degrade` reindexes along it. This is the - proof-relevant modality *core* — deliberately semiring-free - (the *measure-independence invariant*). -| `Echo.Index.ThinPoset`, `Echo.Modality.{Interface,Core}` - -| `+` (⊗, accumulation) -| The residue *measure*: a lossy, monotone *observation* - (`measure x ≤ measure (degrade p x)`). The accumulation - `μ : D_r D_s → D_{r+s}` the live question names lives on *this* axis. -| `Echo.Measure.{Interface,Examples}` (incl. `tropical-cost-measure`) -|=== - -So "is loss a comonad or a monad?" is really two questions on two axes: -what is the variance of the `min`-graded reindexing (the modality core), -and what is the variance of the `+`-graded accumulation (the measure / -nesting)? - -== The verdict - -Each clause below is a *pinned theorem* in `EchoVariance.agda`, not a -slogan. `--safe --without-K`, zero postulates; every artefact reuses an -existing kernel theorem. - -=== (1) Accumulation is monadic - -`accumulate : Σ B (λ b → Echo f b × (g b ≡ y)) → Echo (g ∘ f) y` -(`= Echo-comp-iso-from`) is the combining map: a nested loss (an -`f`-echo sitting under a `g`-step) collapses to a single -`(g ∘ f)`-echo. It is *total* and *canonical*: it is definable from the -layered data alone — the factoring `(f, g)` is exactly its input, so no -choice is made. This is the graded-MONAD multiplication shape -`μ : D_r (D_s A) → D_{r+s} A`; the loss magnitudes add. - -=== (2) Recoverability is exact on the fibre - -For a *fixed factoring*, `accumulate` and `split-with-factoring` -(`= Echo-comp-iso-to`) are mutually inverse — both round-trips are -`refl` (`accumulate-split-id`, `split-accumulate-id`). The fibre stores -the loss *precisely*: no over-approximation, no stored complement. - -At grade 0 this is the totality isomorphism -`recoverable-fibre : A ↔ Σ B (Echo f)` (`= A↔ΣEcho`). Its `encode` -(unit) and `decode` (counit) ARE the section/retraction pair — the -unit/counit of the *adjunction* reading. So the "graded adjunction" -candidate is correct, and it is *exact on a homotopy fibre*, precisely as -the sharpened understanding requires. - -=== (3) The comonad direction fails for genuine loss - -A graded *comonad* would supply a *natural* `δ` on the BARE residual -functor: recover the intermediate/layered data from a residue *without -being handed a factoring*. For genuine loss that is exactly the -irreversibility obstruction. The canonical collapse -`collapse : Bool → ⊤` has *no section*: `no-bare-recovery` (via -`no-section-of-collapsing-map`) refutes any `raise : ⊤ → Bool` with -`raise ∘ collapse ≡ id`. - -The forgotten bit is retained on the *fibre* -(`fibre-retains-lost-bit : echo-true ≢ echo-false`, two distinct echoes -over the same residue `tt`) but is *not* a recoverable complement of the -residue — which is exactly why `no-bare-recovery` holds while -`accumulate-split-id` is `refl`. - -=== (4) The "graded comonad" reading is the complement-storing neighbour - -`EchoGradedComonadF1` is a genuine nested graded comonad — but its model -`D r A = A × Boolʳ` (`R X = X × Bool`) *retains* its residue layers. Its -comultiplication is `δ = coe (D-+ m n A)` along the *type equality* -`D (m+n) A ≡ D m (D n A)`, hence INVERTIBLE. `EchoVariance` exhibits the -inverse `μ-writer = coe (sym (D-+ m n A))` and proves both round-trips -(`writer-μ-section`, `writer-δ-section`): the writer is *simultaneously* -a graded comonad and a graded monad. - -That bi-directionality is the signature of a COMPLEMENT-STORING -(resource / coeffect) modality — the loss is not actually lost, it is -filed in the `Bool` layer. This is precisely what the sharpened -understanding says echo-types is *not*: "exact on a homotopy fibre rather -than ... complement-storing". So the graded-comonad reading does not -contradict the verdict; it silently *changes the modality* to the -lossless resource neighbour. - -=== One-line resolution - -[.lead] -Echo-types (fibre-based loss) is a *graded monad* of accumulation (the -`+` axis) together with a section/retraction *adjunction* that is exact on -the grade-0 fibre; it is *not* a graded comonad. The `min` axis (order / -`degrade`) carries the reindexing modality; the `+` axis (accumulation) -carries the monad. The graded-comonad reading is available only on the -complement-storing writer, which is lossless and hence a different -(resource-flavoured) modality. - -This sits the echo modality exactly where the landscape places it: at the -intersection of the grading axis (Katsumata; Fujii–Katsumata–Melliès; -Orchard–Petricek coeffects) and the modal axis, with the modality's -content being *information loss* rather than resource usage, distinguished -from its neighbours by the tropical (worst-case, non-probabilistic) grade -and by carrying recoverability as *fibre-level* rather than -*complement-level* structure. - -== Consequences for the redesign - -. *Keep the modality/measure split; it IS the variance answer.* The - `min` axis (`Echo.Modality.*`, thin-poset `degrade`) and the `+` axis - (`Echo.Measure.*`, accumulation) should remain separate surfaces. The - variance question dissolves once they are not conflated: reindexing - (order) and accumulation (measure) have different variances. - -. *Name the accumulation monad on the measure axis.* The `+`-graded - accumulation `μ : D_r D_s → D_{r+s}` is the graded-monad multiplication. - A future `Echo.Measure.Accumulation` (or similar) can package - `accumulate` + the grade-0 unit as the graded monad of loss, with the - tropical `+` (and `∞` as the absorbing "fully unrecoverable" grade) as - the grade monoid. `EchoVariance.accumulate` is the kernel-level witness - it would build on. - -. *Read `EchoGradedComonad` / F1 / F3 as the complement-storing - neighbour, on the record.* They are correct Agda and a useful - contrast object (the resource sibling), but they are *not* the echo - modality of genuine loss. Any downstream prose that calls echo "a - graded comonad of loss" without the complement-storing caveat is - re-introducing the R-2026-05-18 overclaim. `EchoVariance` is the pin - that fails CI if that slide recurs. - -. *The adjunction is the honest headline for recoverability.* "Exact on - a homotopy fibre" = the grade-0 `A ↔ Σ B (Echo f)` section/retraction. - Recoverability should be stated as this adjunction unit/counit, never as - an all-grade comonadic `extract`/`duplicate` (which would falsely imply - recovery off the fibre). - -== Honest scope - -The verdict is about the *shape* of the canonical structure maps and the -*locus* of recoverability — not a universal categorical impossibility -theorem. Matched-negatives are pinned in `EchoVariance` as `NotProved-*` -⊤-aliases: - -* *Not claimed:* that no graded comonad of any kind touches Echo — F1 is - one, on the complement-storing writer. The claim is that *genuine* - (fibre-based, non-complement-storing) loss is not a graded comonad. -* *Not claimed:* a numeric realisation of the full min-plus grade semiring - (with `∞`) carrying the entire graded-monad law triangle. The measure - seam (`tropical-cost-measure`) supplies the tropical carrier; this work - pins only the variance *shape*. Completing the law triangle over - `ℕ ∪ {∞}` is the natural next rung (consequence 2 above). -* *Not claimed:* that `split-with-factoring` is non-canonical. Given the - factoring it is the unique inverse (clause 2). The obstruction (clause - 3) is strictly about recovery from a *bare* residue with no factoring - supplied. - -== Provenance - -* Mechanisation: `proofs/agda/EchoVariance.agda` (`--safe --without-K`, - zero postulates); pinned in `proofs/agda/Smoke.agda`; wired into - `proofs/agda/All.agda`; classified in - `docs/echo-types/echo-kernel-note.adoc` and `docs/echo-types/MAP.adoc`. -* Reused kernel theorems: `Echo.Echo-comp-iso-{to,from,to-from,from-to}`, - `EchoNoSectionGeneric.no-section-of-collapsing-map`, - `EchoTotalCompletion.A↔ΣEcho`, and `EchoGradedComonadF1.{δ,D-+,coe}`. -* Relationship to the ledger: this *resolves* the variance left open by - R-2026-05-18; it does not resurrect any retracted prose. - -== Revision history - -[cols="1,3",options="header"] -|=== -| Date | Change - -| 2026-06-19 -| Initial resolution. `EchoVariance.agda` lands the five-clause verdict; - this note records it and the redesign consequences. -|=== +See link:what-echo-is.adoc[the current contribution boundary] and link:../audit/2026-11-06-evidence.adoc[the evidence ledger]. The evidence ledger records successful local checks of the new witnesses and all seven existing roots under Agda 2.7.0.1. The successful baseline remote run is separate evidence; the fresh `--ignore-interfaces` AuditSmoke check also passes with exit 0 on unchanged proof sources. diff --git a/docs/echo-types/what-echo-is.adoc b/docs/echo-types/what-echo-is.adoc index 19815dde..a4a6b9e9 100644 --- a/docs/echo-types/what-echo-is.adoc +++ b/docs/echo-types/what-echo-is.adoc @@ -1,183 +1,32 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Echo types — what it is, and what we did not invent +// SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell += Echo types — object and contribution boundary :toc: macro -:toclevels: 2 -_An upfront, scholarly statement of the object: the established mathematics it -instantiates, the boundary of our own contribution, and the relations it is -NOT. Written to be read alongside (and never to contradict) this repo's -`AFFIRMATION.adoc` ground truth._ +== The object -toc::[] +For `f : A → B`, `Echo f y := Σ (x : A) , (f x ≡ y)` is the standard dependent fibre. It is a derived Σ-type with no new type former, judgment, or general separation from dependent pairs. `Echo.agda` supplies the definition and ordinary fibre laws; `EchoFiberTriangulation.agda` relates it to standard-library surjection witnesses and reverses the equality orientation. -== What it is (as we use it) +An inhabitant contains an actual source `x`, together with evidence that `f x ≡ y`. The total-space equivalence `A ↔ Σ B (Echo f)` in `EchoTotalCompletion.agda` retains that source. It has no loss-grade parameter and proves neither recovery from `y` alone nor minimal storage of a complement. -In this repository, an *echo type* is a *min-plus-graded modality of structured -information loss*: a way to talk about a value that has crossed a non-injective -map — a degradation, projection, observation, compression, or translation — and -survived not as the original guarantee, and not as nothing, but as a *retained, -proof-relevant constraint on what its origin could have been*. +== Additional interfaces -Operationally, in the actual Agda kernel, the object is exact and small. Given -`f : A → B`, the echo at `y : B` is the *preimage / homotopy fibre* +`Echo.Index.ThinPoset.ThinPoset` has reflexivity, transitivity, and propositional homs. Its abstract fields omit antisymmetry: mathematically it is a thin preorder, despite its compatibility name. The concrete three-element `keep ≤ residue ≤ forget` instance is an order. ----- -Echo f y := Σ (x : A) , (f x ≡ y) ----- +`Echo.Modality.Interface.EchoModality` specifies a family of types and an identity/composition-preserving action over that index. It is a preorder-indexed diagram. The record supplies no reflector, reflective-subuniverse predicate, idempotence, or modal elimination principle. The word “modality” is project vocabulary rather than a proved reflective modality. -defined in `proofs/agda/Echo.agda` and used throughout the verified closure -(`proofs/agda/All.agda`). It adds *no new judgment*: `Echo f y` is definitionally -the fibre, pinned by the bridge `echo↔fib : Echo f y ↔ fiber f y` -(`EchoFiberBridge.agda`). On top of this single definition the repo builds the -modal reading used in practice: +`EchoSeparating` distinguishes parallel arrows acting by identity and Boolean negation. The refuted law identifies a chosen composite with an arbitrary parallel arrow. Ordinary composition with the chosen composite is compatible with these different actions; the example does not refute functor composition. -* a *graded modality* `D_r` indexed by a *loss grade* `r`, where the grade lives - in the *tropical (min-plus) semiring* `(ℕ ∪ {∞}, min, +)` read as *structural - irrecoverability* — `0` = nothing lost, `∞` = total irrecoverable loss. The - grade carrier and its operations (`_+g_` = additive accumulation, `_⊓g_` = - min/join) are mechanised in `proofs/agda/experimental/echo-additive/Grade.agda`; -* a *section/retraction* discipline whose round-trip is *exact on a homotopy - fibre* (the recoverable subobject) rather than over-approximating or - storing a complement — this is the canonical *total-completion equivalence* - `A ≃ Σ B (Echo f)` (`EchoTotalCompletion.agda`), one leg of an - (equivalence, projection) orthogonal factorisation system - (`EchoOrthogonalFactorizationSystem.agda`); -* a *residue-measure observation seam* (`Echo.Measure.Interface`): a resource - algebra (cost / tropical / confidence) may *measure* an echo residue, but the - measure is a lossy observation of the modality, not the modality itself. +== Recovery and variance -So "echo type" as we use it = *the fibre, read as a tropically-graded loss -modality with an exact-on-a-fibre recoverable core*. The variance of that -modality is *monadic*: loss *accumulates* (the composite of two losses is the -sum of grades), and there is no general way back from total loss. +The historical identifier `no-section-of-collapsing-map` negates a *left inverse*: no `raise` satisfies `raise (lower x) ≡ x` when `lower` collapses two distinct inputs. It does not negate a categorical section (a right inverse). `Bool → ⊤` has the two constant right inverses selecting `true` and `false`. -== The established structure it instantiates (and where it is from) +`EchoVariance.agda` gives inverse maps between a composite fibre and the corresponding iterated fibre for a supplied factorisation. Those maps do not provide a full tropical graded monad: the endofunctors, grading coherence, naturality, and all monad laws require a separate construction. An erasing grade cannot generally recover arbitrary source values; the exact obstruction must name its carrier and counit. This does not imply that every loss-related graded comonad is impossible. Experimental writer carriers retain content and can support both structures. The baseline `GradedComonadStructure` record omits naturality. The local `NaturalGradedComonad` companion and its witnesses pass Agda 2.7.0.1 checks. An erasing graded-comonad counterexample also passes; its ordered compatibility equations have the Cubical transport warning boundary recorded in the evidence ledger. -Echo types are an *assembly of established structures*. None of the underlying -mathematics is ours. +== Contribution and outstanding evidence -*Graded (parametric) monads / graded modal types.* The "grade an effect/modality -by an element of an ordered algebraic structure, with a composition law on -grades" pattern is the theory of *graded monads* and *graded/coeffectful modal -types*. Canonical references: Katsumata, _Parametric effect monads and -semantics of effect systems_ (POPL 2014); Fujii, Katsumata and Melliès, -_Towards a formal theory of graded monads_ (FoSSaCS 2016); the coeffect / -quantitative-modality line of Petricek, Orchard and Mycroft (the coeffect -calculus papers), realised in the Granule language by Orchard, Liepelt and Eades, -_Quantitative program reasoning with graded modal types_ (ICFP 2019). The dual -comonadic reading of context-dependent computation is Uustalu and Vene, -_Comonadic notions of computation_ (ENTCS, 2008). Our grade index instantiates -this machinery at the *tropical / min-plus dioid* — itself standard idempotent / -tropical semiring theory. +The contribution under review is a collection of Agda presentations, examples, taxonomy, and scoped counterexamples. Entropy summaries, the selected shallow linear-logic encoding, and particular resource measures can discard fibre information. These examples establish limits of those encodings, not separation from Σ-types or all possible neighbouring formalisms. Novelty and priority remain unresolved research obligations. -*The homotopy fibre.* `Echo f y := Σ (x : A), (f x ≡ y)` is exactly the -*homotopy fibre* of `f` at `y`, and the equivalence `A ≃ Σ_{y} fib f y` with -the (equivalence, projection) factorisation are standard univalent-foundations -constructions. Canonical reference: The Univalent Foundations Program, -_Homotopy Type Theory: Univalent Foundations of Mathematics_ (2013) — the -HoTT Book — for fibres, the total-space equivalence, and orthogonal -factorisation systems. +`ResidueCell.once-only` is a read-after-consume equation on the returned spent value; ordinary Agda values remain duplicable. It does not enforce single use of an original holding value. No refinement theorem connecting these Agda models to the Rust or Idris runtimes has been established here. Thermodynamic zero-cost results concern the defined arithmetic cost model, not measured physical energy or a derivation of physical thermodynamics. -In short: the *grade* is graded-monad / coeffect theory over a tropical dioid; -the *carrier* is the homotopy fibre. Both are decades-established; we cite them -as the load-bearing prior art, not as background colour. - -== What is ours, and what is not (the contribution boundary) - -What is *borrowed* is the mathematics named above: graded monads / graded modal -types, the tropical (min-plus) dioid, and the homotopy fibre with its -total-space factorisation. We claim none of it. - -What is *ours* is the *modelling and assembly*: the decision to read the fibre -*as* a tropically-graded loss modality whose grade is *irrecoverability*, whose -round-trip is *exact on the fibre* (not over-approximating), and whose variance -is settled *monadically* by mechanised proof rather than asserted; and the -fitting of that model to concrete domains (database provenance, region-exit / -capability security, sampling support, sensitivity tracking, BEAM/typed-wasm -boundaries). The usefulness is reported only where it has already produced -*checkable artefacts*, grounded in this repo's `AFFIRMATION.adoc`: - -* a *green `--safe --without-K` verified closure* — `agda --safe --without-K -i - proofs/agda proofs/agda/All.agda` exits 0 over 151 forced modules, with *zero - postulates* and a *funext-free kernel certificate* (`scripts/kernel-guard.sh` - exits 0); -* the *deniability / no-section* proofs — `EchoDeniability.agda`, - `EchoNoSectionGeneric.no-section-of-collapsing-map` — that make "you cannot - reconstruct the source from the residue" a checked theorem, not a slogan; -* the *anti-collapse separation* theorems `equal-measure-does-not-imply-equal-echo` - and `measure-not-injective` (`Echo.Separation.NotResourceInstance`, pinned in - `Smoke.agda`), which mechanise the boundary "a residue measure does not define - Echo"; -* the executable *`EchoTypes.jl`* falsifier (finite-domain shadow, - falsifies-by-counterexample), and the *typed-wasm L-Echo axis* as a consuming - application. - -**On contribution (the same stance in every sibling repo).** We did not invent the -mathematics this work rests on. Graded monads, tropical / idempotent dioids, -multiparty session types and choreographies, and epistemic / justification logic -are established structures authored by others, cited above. What is ours is the -*modelling*: we apply these structures as instruments fitted to specific domains — -verifiable WebAssembly, federated identity, BEAM sandboxing, structured -information loss — in places the established corpus had not been instantiated this -way, and we report only where the fit has already produced *checkable artefacts*. -The contribution is the model and its demonstrated usefulness, not the underlying -mathematics. This is deliberate, and it is a strength: a claim that concedes its own -foundations is survivable; one that claims invention dies at the first citation. (Cf. the -estate discipline — echo-types' own distinctness claim was permitted to terminate -negatively, EI-2.) - -== Is-not, and what is still open - -*IS-NOT relations (kept crisp so the boundaries do not erode).* - -* *Echo IS-NOT a graded comonad.* The "graded comonad of structured loss" - reading was *retracted* (R-2026-05-18) and stands retracted. The variance is - *monadic*: the composition `μ : D_r (D_s A) → D_{r+s} A` exists (loss - accumulates), but the would-be comonad counit `D_∞ A → A` is *mechanically - absurd* — you cannot recover a value from total irrecoverable loss. A graded - *comonad* structure survives *only* on restricted *content-faithful* carriers - (Gate F1, the iterated-residue line); on the inert ⊤-padded carrier its laws - pass only *vacuously* (the discharge is by contractibility, not by content), - and that vacuity is itself recorded as the variance finding. This whole - variance settlement lives in the *gated experimental tree* - (`proofs/agda/experimental/echo-additive/`), *not* in the main verified - closure. -* *Echo IS-NOT a tropical / resource instance.* A resource algebra may *measure* - an echo residue (cost, tropical, confidence), but it does not *define* Echo: - *equal residue measure does not imply equal Echo* (mechanised, above). Echo is - an orthogonal indexed/residual modality; do not model it as a resource-algebra - `Soundness(S)` instance. Vocabulary discipline: *resource grade* ≠ *echo index* - ≠ *residue measure*; avoid "echo-grade". -* *Echo IS-NOT a new judgment or a replacement for exact-preservation systems.* - It adds no judgment to the type theory (it is definitionally the fibre), and it - is not a substitute for ordinary type checking, ABI/FFI proofs, typed-wasm, or - any boundary system that *can* preserve exact guarantees. When exact - preservation is available, use it; echo types are for the case where the value - that crossed is no longer the guarantee but is also not meaningless. -* *Echo's distinctness claim was NOT assumed.* It was put to a falsifier and - *terminated negatively* (EI-2, via PATH B): the cross-axis simultaneous- - integration distinctness was not established, and the Gate-1 claim was narrowed - accordingly. We keep that negative on the record rather than spin it. - -*Honestly open.* - -* The *variance settlement* (graded monad in general; graded comonad only on - content-faithful carriers) is proved *only in the gated experimental tree* and - is *not wired into* the shipped `--safe` closure (`Grade.agda` and the - `echo-additive/` modules are absent from `All.agda`). Treat the variance result - as a real-but-unwired artefact, exactly as `AFFIRMATION.adoc` records it. -* *Bachmann–Howard order-type fidelity is POSTULATED*, in - `Ordinal/Buchholz/Fidelity.agda`, *outside* the `--safe` kernel cone. (Since - 2026-10-20 that file and the whole ordinal tower live in - https://github.com/hyperpolymath/ordinal-notation[hyperpolymath/ordinal-notation], not here.) The - ordinal-notation tower's sound-carrier well-foundedness is proved and in the - closure; the bridge from that notation to the Bachmann–Howard ordinal is an - explicit, auditable trust boundary, not a closed theorem. "Mechanized - Bachmann–Howard" is a milestone-in-progress, read as "a notation system aimed - at BH", not "BH proved". -* The *truncated (epi, mono) image factorisation* needs propositional truncation - and lives in a separate, unwired postulated module; the safe core proves only - the K-free `injective-fibres-proj-unique` fragment. Several "full" universal- - property clauses are honestly *funext-/UIP-qualified* (Gates F4/F5), stated as - conditional, not unconditional. +See link:../foundation.adoc[the build and trust boundary] and link:../audit/2026-11-06-evidence.adoc[the dated evidence ledger]. Baseline CI evidence and fresh local checks are separate claims. diff --git a/docs/foundation.adoc b/docs/foundation.adoc index 6fa4b517..e53743ac 100644 --- a/docs/foundation.adoc +++ b/docs/foundation.adoc @@ -1,158 +1,55 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= Echo Types — Foundation & Trusted Base += Echo Types — Foundation and Trusted Base :toc: macro -:toclevels: 2 -:sectnums: -:sectnumlevels: 2 -:icons: font - -[.lead] -What the foundation actually is, exactly what is trusted, and how -each part is mechanically enforced. Created 2026-05-18 after a -foundation provenance audit. This document makes no proof claims; it -states the trust surface so there is no doubt about its boundary. - -toc::[] - -== The foundational object (deliberately trivial) - -`Echo f y := Σ (x : A) , (f x ≡ y)` is *definitionally* the homotopy -fibre. There is no new type former, no axiom, no postulate. The -soundness of the foundation is the soundness of Agda's `Σ` and `≡` -under `--safe --without-K` — nothing more is claimed, and that -triviality is the point, not a weakness. The self-referential -`echo↔fib` bridge (`fiber` is a same-module restatement) was the one -mathematical place worth hardening — that is now **done**: -`proofs/agda/EchoFiberTriangulation.agda` triangulates `Echo` against -the standard library's *own* independently-authored notions -(`Function.Definitions.StrictlySurjective`, `Function.Bundles._↔_` / -`mk↠ₛ`), so the bridge is no longer self↔self. See R-2026-05-18 and -the *Known limitations* item below for the exact (modest) strength -claimed. - -== Trust surface and its enforcement - -[cols="2,3,2", options="header"] -|=== -| Trusted claim | How it is enforced (post-2026-05-18) | Residual - -| Every module is `--safe --without-K` -| `tools/check-guardrails.sh` scans *every* `proofs/agda/**/*.agda` - (comment-stripped) and asserts the OPTIONS line carries both flags; - wired as a fail-fast CI step in both jobs. Independent of any - `All.agda` closure. -| none - -| Zero postulates / zero escape pragmas -| Same script: complete deny-list of escape pragmas + soundness flags - + `postulate`/`primTrustMe` in code. `--safe` in the typecheck - lanes is the primary guarantee; the script covers files outside - every closure. -| nested `{- -}` not modelled (codebase uses `--` banners); lanes are - the backstop - -| The whole development typechecks -| Four CI roots — `All.agda`, `Smoke.agda`, `characteristic/All.agda`, - `examples/All.agda` — now cover *all* registered modules (the two - 2026-05-18 closure holes, `examples.Transport` and the - N5 exclusion, are resolved/disclosed below). -| `N5Falsifier` is *known-broken*, see below - -| A green build is not a stale-cache artefact -| `cold-check` CI job: no interface cache, `agda --ignore-interfaces` - on all four roots. Runs in parallel with the cached `check` job; - both must pass. -| none - -| Dependencies are pinned -| `standard-library` pinned to branch `v2.3`; `absolute-zero` pinned - to commit `f486c299…` (was floating `--depth 1`). Asserted in CI. -| Agda version itself — see *Known limitations* -|=== - -== Known-broken, disclosed (not hidden) - -`proofs/agda/characteristic/N5Falsifier.agda` does **not** typecheck -(`UnsolvedConstraints` / `UnsolvedMetaVariables`, lines ~150–200). It -was historically excluded from `characteristic/All.agda` with no -disclosure — a silent hole found by the 2026-05-18 audit. It is now: - -* banner-marked in-file as known-broken, with the "VERDICT … SURVIVES" - line explicitly flagged *not mechanised*; -* explicitly noted as a deliberate exclusion in - `characteristic/All.agda`; -* monitored by an *expected-failure* CI gate — if it ever typechecks, - CI fails loudly and instructs to register it and drop the gate. - -It must not be cited as an established Gate-2 nominee until it is -green `--safe --without-K`, zero unsolved metas. Triage, not a partial -hack: left explicit and failing, never forced green. - -== Known limitations (tracked, not silent) - -. *CI Agda exact pin* — *reproducible pin IMPLEMENTED 2026-05-18; - first-green verification delegated to CI.* `flake.guix` now pins, as - flake inputs: Agda via `nixpkgs nixos-24.11` (2.7.0.1), standard - library at tag `v2.3`, and `absolute-zero` at commit `3ff5cee…` - (previously nixpkgs-bundled stdlib + a local `absolute-zero` - checkout — neither reproducible). A hermetic `checks.suite` - (guardrail + four roots + N5 xfail) runs under that pinned - toolchain; an *additive* `flake-check` CI job (`guix flake check`) - exercises it. This is honest about its boundary: the dev - environment has no `guix`, so the flake was authored designed-correct - but its build is *first verified by CI*, not claimed green here. It - is `continue-on-error` until first green so a version delta - (2.7.0.1 vs the verified-green 2.8.0 / apt) is *surfaced*, not a - regression; the apt `check` + `cold-check` jobs remain the gate. - Open sub-item: on first green, flip `continue-on-error` to `false` - and retire the apt job; if red, the logged delta says which - nixpkgs/Agda to bump. (Cross-stack: a devShell-only `flake.guix` - also exists on the reframe stack PR #47; this one strictly - supersedes it.) -. *External-fibre triangulation* — *DONE 2026-05-18*, - `proofs/agda/EchoFiberTriangulation.agda` (wired into `All.agda`, - pinned in `Smoke.agda`, `--safe --without-K`, zero postulates). - Three results, each at its true strength, no overclaim: -+ --- -* *T1 (calibration coincidence — not a deep theorem):* - `echo-is-stdlib-witness` — the per-point witness of stdlib's - `StrictlySurjective _≡_ f` is *definitionally* `Echo f y`. Value: - `Echo` is the community's fibre, not a bespoke construction. -* *T2 (genuine content):* `echo↔coecho` — `Echo f y ↔ ∃ x. y ≡ f x` - via stdlib's independent `_↔_` bundle; the round-trips carry - `sym`/`sym-sym` transport and are *not* `refl`. This is the - substantive cross-definition coherence. -* *T3 (surjection tie):* `all-echo→stdlib-surjection` — all - echo-fibres inhabited yields a bona fide stdlib `A ↠ B` (`mk↠ₛ`). --- -+ -The same-module self-reference R-2026-05-18 flagged is removed: the -anchors are authored in the standard library, not here. The honest -strength is "agreement with the community construction + one genuine -orientation coherence", *not* a grounding metatheorem. -. *Cross-assistant kernel check* (P2): confirm the 3-line core in an - independent type-checker (e.g. Cubical Agda's native `fiber`). Now - the single remaining foundational hardening item. - -== Reproducing the trusted build - -[source,sh] ----- -# Guardrail (no Agda needed): -bash tools/check-guardrails.sh proofs/agda - -# Cold, cache-free typecheck of every root: -agda --ignore-interfaces -i proofs/agda proofs/agda/All.agda -agda --ignore-interfaces -i proofs/agda proofs/agda/Smoke.agda -agda --ignore-interfaces -i proofs/agda proofs/agda/characteristic/All.agda -agda --ignore-interfaces -i proofs/agda proofs/agda/examples/All.agda ----- - -Pinned inputs: `standard-library` `v2.3`; `absolute-zero` -`f486c29903434589117fa0662c6f29b0f17d1d5f`. Agda: see `flake.guix` -(reproducible) — CI parity is the P1 item above. + +== Foundation + +`Echo f y := Σ (x : A) , (f x ≡ y)` is the standard dependent fibre. The ordinary kernel uses Agda dependent pairs and propositional equality. `EchoFiberTriangulation.agda` compares this definition with standard-library surjection witnesses; it is calibration and orientation coherence, not an independent soundness metatheorem. + +== Audited baseline: 2026-11-06 + +The baseline is main commit `cd85288dcce55191ad477c0fa7d1d2421514a0d3`, tree `74db6f3b4f4907ca02fb45903a161e1546b9ff6e`. Its recorded successful remote Agda run is `41687674126`. This is evidence for that revision and workflow, not certification of subsequent local edits. + +The baseline inventory is 382 tracked files and 147 Agda files. Excluding three residual ordinal files leaves 144 in scope. The union of the seven workflow-root import closures contains 127 in-scope files, leaving 17 outside: ten tutorial files plus `EchoDecorationBridge`, `EchoExampleSignAnalysis`, `EchoFidelity`, `EchoImageFactorizationPropPostulated`, `MinimalCNO`, `SimpleTest`, and `WorkingCNO`. These are dated baseline counts; adding local modules changes them. + +== Baseline workflow and profiles + +At the audited baseline, the owning source was `.github/workflows/agda.yml`. Its seven roots were: + +* `All.agda` +* `Smoke.agda` +* `characteristic/All.agda` +* `examples/All.agda` +* `EchoImageFactorizationPropCubical.agda` +* `experimental/echo-additive/All.agda` +* `NarrowingSmoke.agda` + +The ordinary roots use `--safe --without-K --cubical-compatible`. The Cubical root is checked separately with `--safe --cubical`. The cold lane adds `--ignore-interfaces`; the warm lane uses interfaces. A green collection of roots is not a typecheck of every tracked Agda file. + +`characteristic/N5Falsifier.agda` is imported by `characteristic/All.agda`; there is no current expected-failure gate. Earlier reports of a deliberately broken excluded N5 describe an earlier state. + +`tools/check-guardrails.sh` scans beyond the root closures, but explicitly exempts `EchoImageFactorizationPropPostulated`, `EchoImageFactorizationPropCubical`, and `EchoDecorationBridge`. Thus “every module is safe and postulate-free” is false as a repository-wide claim. The exemptions do not all have the same reason: the Cubical file is safe in its own profile; the postulated and exploratory files carry different trust obligations. + +The Cubical file constructs truncation in a separate, self-contained restatement. It does not import the ordinary Echo interface literally. Relating those presentations is a separate boundary obligation. + +== Baseline toolchain + +The audited baseline CI installs Agda from apt on `ubuntu-latest` and only asserts a 2.x version. Agda and the runner were therefore not exactly pinned in that revision. The standard library checkout at tag `v2.3` is verified against commit `8326c7475af1fa456ca04a0203c168d5d7ff842b`; absolute-zero is checked out and verified at `f486c29903434589117fa0662c6f29b0f17d1d5f`. + +The audited baseline contains no reproducible flake-style toolchain pin after the Nix-to-Guix removal (#275), and its workflow contains no corresponding check job. Its echo messages refer to absent facilities. Those were stale workflow prose, not evidence of a reproducible toolchain. Baseline library pins live in `.github/workflows/agda.yml`; its Agda executable is apt-selected. Earlier revision-history entries below record historical claims and do not establish the current files or checks. + +== Current local workflow changes (2026-11-06 source inspection) + +The local replacement workflow uses `ubuntu-24.04` and calls `scripts/setup-agda.sh`. That script declares Agda `2.7.0.1`, verifies its Linux x86-64 release archive against SHA256 `975b515a14877ab6bce5bfc641e16c4a3ee52ca5d7f846577dee80aa2145db8a`, and verifies standard-library commit `8326c7475af1fa456ca04a0203c168d5d7ff842b` and absolute-zero commit `f486c29903434589117fa0662c6f29b0f17d1d5f`. The executable and library pins now live in that setup script; workflow calls and profiles remain in `.github/workflows/agda.yml`. This is source inspection of the local configuration, not a new successful remote workflow receipt. + +The draft workflow adds `AuditSmoke.agda` to the ordinary checks and separates experimental/narrowing/Cubical work into their own jobs. The baseline seven-root counts above and the completed local compiler receipts remain evidence about their stated checks, not evidence that the changed GitHub configuration has executed successfully. + +Current static entrypoints include `sh scripts/check-agda-invocations.sh` and `bun tools/audit-inventory.mjs`. The latter replaces the historical Python inventory command; conversion equivalence is checked separately from proof typechecking. `mise.toml` lists Bun and just; Agda setup is handled by the dedicated script. + +== Reproducing and interpreting evidence + +Register the pinned standard-library and absolute-zero libraries, then run the seven commands in the workflow using their respective profiles. Run `scripts/kernel-guard.sh`, `tools/check-guardrails.sh`, `scripts/check-experimental-aggregate.sh`, and `scripts/check-agda-invocations.sh` for the separate static checks. A source scan is not a typecheck; a successful remote baseline run is not a fresh local run. The local audit now passes all 15 direct/audit entrypoints and all seven existing roots under Agda 2.7.0.1, plus a fresh `--ignore-interfaces` AuditSmoke check with exit 0. Consult link:audit/2026-11-06-evidence.adoc[the evidence ledger] for receipts, warnings, source identity, current inventory, and the limits of these checks. Ordinal mathematics is excluded from the audit; residual imports may still affect builds. == Revision history @@ -188,3 +85,9 @@ Pinned inputs: `standard-library` `v2.3`; `absolute-zero` (run 36864369380). The claims table and "Pinned inputs" above now read `f486c299`; the two 2026-05-18 entries keep `3ff5cee` because they record what was pinned then. Verified by `check` + `cold-check` green on #334. + +* *2026-11-06 — baseline re-audit.* Corrected root coverage, N5 status, guard exemptions, exact dependency commits, and absent flake facilities. Historical entries above are retained as records of earlier assertions. + +* *2026-11-06 — #335 historical-entry acceptance.* The original 2026-05-18 history entries above remain unchanged, including their then-written `flake.guix` claim. Since #275 there is no reproducible flake-style pin in this checkout. The live `absolute-zero` and standard-library commit assertions are in `.github/workflows/agda.yml`, while Agda is installed through apt. The correction is appended rather than rewriting those historical entries. + +* *2026-11-06 — current draft toolchain correction.* The #335 acceptance entry immediately above records the audited baseline. The current local workflow instead calls `scripts/setup-agda.sh`, which owns the compiler checksum and library commit declarations. The baseline dated entries remain unchanged; the new draft has no remote success receipt in this document. diff --git a/docs/gate-1-distinct-phenomenon.adoc b/docs/gate-1-distinct-phenomenon.adoc index cf1e8993..d3395c2d 100644 --- a/docs/gate-1-distinct-phenomenon.adoc +++ b/docs/gate-1-distinct-phenomenon.adoc @@ -12,9 +12,7 @@ ____ Distinct phenomenon: structured loss under non-injective computation. ____ -The gate is treated as established only if the argument here survives -the falsification tests in <>. It is retracted in -writing if any test succeeds. +The comparisons in <> are scoped to the named encodings and statements. A successful T1–T3 correspondence changes the relevant neighbour comparison; it does not automatically pass, fail, retract, or weaken the narrowed Gate 1 claim. No overall positive identity or priority claim follows from these tests. toc::[] @@ -79,12 +77,7 @@ The per-neighbour files: | `docs/adjacency/hott-fibers.adoc` | HoTT homotopy fibers |=== -The honest summary: gate #1 has a strong consolidated argument -plus formalised obstructions against the two strongest neighbours -(quotients, Galois) plus formalised truncation wins on three -domains (tropical, epistemic, linear). The remaining neighbours -have framed but only-partially-formalised distinctness claims; -see each file for what's done and what's open. +The scoped evidence concerns the information retained by selected neighbours and the shape of selected comparison constructions. It does not establish a general separation from dependent fibres or all encodings. Read the historical attempt descriptions below separately from the current checked sources and the foundation evidence ledger. == Integration evidence after EI-2 @@ -192,7 +185,9 @@ removed the five-axis integration argument from the distinctness load. This test is currently unstubbed; see <>. -== Status of attempts +== Status of attempts (historical references) + +The attempt descriptions below name `proofs/agda/EchoVsGalois.agda` and `proofs/agda/EchoVsQuotient.agda`, which are absent from the current tracked checkout. Those named results are not current checked evidence in this audit. The current `characteristic.RoleGraded.choreo-grade-commute` is a scoped commutation lemma; `characteristic/IntegrationAudit.agda` and the EI-2 record do not license a universal encoding obstruction. Any revived T1/T2 attempt needs an actual source revision and its own check receipt. T1 (Galois):: Scaffolded in `proofs/agda/EchoVsGalois.agda`. The basic reduction @@ -212,8 +207,7 @@ coincide. + The combined T1+T2 conclusion: the obstruction is AXIS-PAIR- SPECIFIC, not an artifact of any one neighbour theory's framework. -A reviewer who wants to falsify gate #1 must find a 2-cell -construction that lives outside both lattice traditions. +A further construction would refine these selected neighbour comparisons. Its success would not independently falsify Gate 1 or reopen EI-2. T2 (Quotient):: Scaffolded in `proofs/agda/EchoVsQuotient.agda`. Foundation reduces @@ -254,17 +248,15 @@ should appear there. Q1.1:: Does there exist a Galois-theoretic construction that expresses `RoleGraded.choreo-grade-commute` without importing graded or -choreographic primitives? If yes, Gate #1 is falsified by T1. +choreographic primitives? If yes, record the scoped T1 correspondence, its assumptions, and the specific Galois comparison it changes; this does not independently falsify Gate 1. Q1.2:: Does quotient stacking commute with role projection in enough cases -to express the choreographic-graded composition? If yes, Gate #1 is -falsified by T2. +to express the choreographic-graded composition? If yes, record the scoped T2 correspondence and revise only the affected quotient comparison; this does not independently falsify Gate 1. Q1.3:: Is `EchoEpistemic.knowledge-preservation` derivable from -`EchoLinear.weakening` plus a forgetful functor? If yes, Gate #1 is -weakened by T3. +`EchoLinear.weakening` plus a forgetful functor? If yes, identify the exact signatures and assumptions and record the scoped T3 derivation; this does not independently weaken Gate 1. The named `knowledge-preservation`/`weakening` signatures here are historical proposal names, not declarations established by this audit. Q1.4:: Are there axes beyond the current five (choreo, epistemic, linear, @@ -290,8 +282,7 @@ requires survey*. (C3) Every sophisticated quotient construction either fails on the characteristic-family commutation theorem (currently `RoleGraded.choreo-grade-commute`), or imports machinery equivalent to echo types (Σ over preimages with cross-axis transport) — *open*. -This is the real claim of gate #1; (C1) is necessary but not -sufficient evidence. Partial closure: the 2-categorical encoding +This is a proposed scope for the historical T2 comparison, not the current Gate 1 claim. A concrete failure in (C1) does not establish the universal assertion in (C3). Historical partial closure: the 2-categorical encoding case is attacked in `Sophisticated`, with the structural argument running through the equalizer characterisation. Remaining sub-cases listed in Q1.6. @@ -333,14 +324,11 @@ least concerning: cells natively, but at the cost of importing the entire HoTT framework. By the conservative reading of "pure quotient theory", this counts as importing machinery far in excess of - echo types. Gate #1 supported by reductio: any sufficiently - expressive sophisticated encoding either uses Σ-over-preimages - directly or imports HoTT, which subsumes Σ-over-preimages. + echo types. This describes one framework comparison, not a reductio establishing Gate 1. Echo itself is a standard Σ-over-preimages construction; its expressibility in a richer framework does not independently establish or refute identity. If any of (S-1)–(S-4) admits a faithful encoding of the characteristic-family commutation theorem (currently `RoleGraded.choreo-grade-commute`) without importing echo machinery, -gate #1 is falsified by that sub-case. Each requires its own -focused attempt. +record the correspondence and revise the affected T2 sub-case. No automatic Gate 1 verdict follows. Each requires its own focused attempt and concrete source evidence. -- Q1.7 [partial answer]:: @@ -369,11 +357,12 @@ families case (S-2). Both omitted to avoid duplication; arguments sketched in `EchoVsGalois.Sophisticated`'s status block. -- -== Distinctness commitment +== Scoped comparison commitment + +If T1, T2, T3, or a listed sub-case succeeds, record the exact construction, assumptions, source revision, and completed checks. Revise the specific neighbour claim that the result supports or contradicts. A failed attempt alone does not establish non-encodability; a successful correspondence alone does not retract or weaken the narrowed Gate 1 claim. The EI-2 integration route remains closed negatively. + +This outcome rule applies consistently to the test definitions, Q1.1–Q1.3, C1–C3 and S1–S4, and this summary. Novelty and priority remain independent research obligations, as recorded in link:audit/2026-11-06-foundation-decisions.adoc[the foundation decisions]. -If T1, T2, or T3 succeeds, the README's identity claim is retracted -or weakened correspondingly, and this document is updated to record -the result. The commitment is not "we will explain why the test -doesn't really apply"; it is "we will retract". +== Review correction record — 2026-11-06 -The repo's identity is gated. That is the point of having gates. +CodeRabbit PR #359 comment https://github.com/hyperpolymath/echo-types/pull/359#discussion_r4436689541[4436689541] identified the conflicting T1–T3 outcome rules. The local correction reconciles the opening rule, downstream questions, sub-case outcomes, and closing commitment with the scoped test definitions. The historical attempt paths were checked against the tracked tree and are explicitly distinguished from current proof evidence. The GitHub thread has not been resolved by this local edit. diff --git a/docs/proof-debt.adoc b/docs/proof-debt.adoc index 69169974..bc7a9317 100644 --- a/docs/proof-debt.adoc +++ b/docs/proof-debt.adoc @@ -144,3 +144,8 @@ config. Correct invocation points `+--library-file+` at the v2.3 stdlib worktree (`+/home/hyperpolymath/developer/worktrees/agda-stdlib-tweak+`). A config artefact, NOT a proof defect. + +[NOTE] +==== +2026-11-06 context: entries above retain their historical dates. For current fibre, inverse-direction, categorical-interface and verification boundaries, consult link:audit/2026-11-06-evidence.adoc[the foundation evidence ledger]. Historical “no-section” negatives concern left inverses; a scoped erasure obstruction does not prohibit every graded comonad. +==== diff --git a/docs/proof-log/2026-04-28.adoc b/docs/proof-log/2026-04-28.adoc index ebe2c58b..20068072 100644 --- a/docs/proof-log/2026-04-28.adoc +++ b/docs/proof-log/2026-04-28.adoc @@ -199,3 +199,8 @@ structural-decrease checker). * *Verify build with `+find -name '*.agdai' -delete+` before each task switch.* Cached `+.agdai+` files masked a broken `+WellFounded.agda+` for several tool-invocations until I forced a clean rebuild. + +[NOTE] +==== +2026-11-06 context: entries above retain their historical dates. For current fibre, inverse-direction, categorical-interface and verification boundaries, consult link:../audit/2026-11-06-evidence.adoc[the foundation evidence ledger]. Historical “no-section” negatives concern left inverses; a scoped erasure obstruction does not prohibit every graded comonad. +==== diff --git a/docs/retractions.adoc b/docs/retractions.adoc index 03170a51..2ba344cf 100644 --- a/docs/retractions.adoc +++ b/docs/retractions.adoc @@ -189,3 +189,8 @@ Append-only. New retractions get the next `R-YYYY-MM-DD` id. An entry is never edited after creation except to add a dated "follow-up" sub-section. Reframing of artefacts pursuant to an entry is logged in that entry's "Action taken". + +[NOTE] +==== +2026-11-06 context: entries above retain their historical dates. For current fibre, inverse-direction, categorical-interface and verification boundaries, consult link:audit/2026-11-06-evidence.adoc[the foundation evidence ledger]. Historical “no-section” negatives concern left inverses; a scoped erasure obstruction does not prohibit every graded comonad. +==== diff --git a/docs/roadmap-gates.adoc b/docs/roadmap-gates.adoc index f639957f..aacce5b0 100644 --- a/docs/roadmap-gates.adoc +++ b/docs/roadmap-gates.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 2 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] The canonical gates protocol. Created 2026-05-18 to resolve a long-standing dangling reference: ~15 documents (including @@ -22,14 +28,7 @@ toc::[] == The identity claim, made falsifiable -The repository asserts that "echo" (loss-with-residue, -`Echo f y := Σ (x:A),(f x ≡ y)`) is a *distinct, characterisable -type-theoretic phenomenon*. That assertion is held **falsifiable**: -each gate below has an explicit pass condition *and an explicit -retraction condition*. A gate whose retraction condition is met -*retracts* the corresponding claim — it does not weaken into a hedge. -Retraction is the mechanism by which the identity claim is made -falsifiable, not a failure of the repository. +The repository studies standard dependent fibres as structured-loss witnesses. It does not assert a new type former or a general separation from Sigma. The gates below are research and evaluation criteria for the presentation and selected encodings; novelty and priority remain unresolved. Historical identity claims and their retractions remain in the dated logs. == The three gates @@ -49,12 +48,11 @@ standalone pass/fail test for these remaining arguments. Living scope: [#gate-2] === Gate 2 — Characteristic theorems -There exist theorems true of echo that *measure* its content rather -than restate generic Σ-functoriality. *Pass:* a nominee that survives +The selected examples may make source information and loss clearer than the specified competing representation. This does not require, or establish, a theorem inexpressible using Sigma types. *Pass:* a nominee that survives a sharpened falsifier of the shape that struck down earlier nominees (collapsing a pseudo-theorem to `proj₂` / a product of independent restatements). *Retract:* the nominee is shown to be such a product, -or to reduce to thinness of the loss order alone (cf. +or if its claimed comparison exceeds the actual chosen-arrow/action assumptions (cf. `EchoSeparating`, `docs/characteristic.adoc` §"Honest qualifications"). @@ -76,9 +74,7 @@ qualifications"). | N5 | `characteristic.RoleGraded.choreo-grade-commute` | *NOT adopted.* The falsifier attempt - `characteristic/N5Falsifier.agda` is **known-broken** (unsolved - metas; disclosed in `docs/foundation.adoc`). The "survives" verdict - is *not mechanised*; N5 must not be cited as established. + `characteristic/N5Falsifier.agda` is now imported by `characteristic/All.agda` and checked in the baseline workflow. Its “survives” commentary concerns the specified falsifier, not an independent proof of novelty or general characteristic distinctness. There is no current expected-failure gate. |=== [#gate-3] diff --git a/echo-types_chora.deed b/echo-types_chora.deed new file mode 100644 index 00000000..f395c485 --- /dev/null +++ b/echo-types_chora.deed @@ -0,0 +1,42 @@ +;; SPDX-License-Identifier: CC-BY-SA-4.0 +;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +;; Identity source: gv-clade-index 2cfabd15d6cb966ed369ee13aa7174b960f45abd, +;; worker/data/repos.json. Assignment date is not recorded; none is invented. +(repo-deed + :schema-version "1.0.0" + :canonical-name "echo-types" + :repo-uuid #u8"gv-clade-index:github.com/hyperpolymath/echo-types" + :beholding-chora #u5"estate/chora" + (identity :primary-forge github :owner "hyperpolymath" :prefixed-name "fv-echo-types") + (clade :primary fv :primary-name "Formal Verification & Proofs" :secondary ()) + (forges :github "hyperpolymath/echo-types") + (lineage :type standalone :parent "") + (status :phase active :present #t) + (ecosystem + :project "echo-types" + :ecosystem "hyperpolymath" + :position-type "constructive-agda-library" + :purpose "Fiber-based structured loss, with explicitly scoped proof profiles and checked counterexamples." + :not ("a new judgmental type theory" "the extracted ordinal-notation project") + (related :name "absolute-zero" :relationship proof-dependency :notes "CNO definitions used by the CNO boundary proofs.") + (related :name "EchoTypes.jl" :relationship executable-companion :notes "Finite-domain executable examples; Agda remains the proof source.")) + (meta :languages (Agda) :license MPL-2.0 :documentation-license "Per-file notices; see docs/audit/2026-11-06-license-inventory.adoc" + :author "Jonathan D.A. Jewell" :build-tool just + :proof-policy "https://github.com/metadatastician/standards/blob/ba640e9a57f22608710ffecdca282074eac55a0b/3-practice/PROOF-POLICY.adoc") + (agentic + :scope "Local repository changes authorized by the current task." + :proof-profile "--safe --without-K --cubical-compatible for ordinary roots; separate full-Cubical and quarantined postulated roots." + :external-mutations "Require explicit user authorization; declarations grant no publication authority." + :ordinal-work "Excluded: the ordinal-notation lane is maintained in its own repository.") + (anchor :date "2026-11-06" + :event "Local standards reconciliation against current owning sources." + :supersedes "Retired 6a2 records; historical tree 39a7a99cbe19a918843e9624010510b5fc3b8366." + :preserves "Proof-profile boundaries, source provenance, and the distinction between declarations and verification receipts." + :evidence "Local working tree; not a published release or certification.") + (standards-sources + (source :name "standards" :revision "ba640e9a57f22608710ffecdca282074eac55a0b") + (source :name "rsr-template-repo" :revision "acdc0ebd1d69f3f70995f4eec078e342078dd885") + (source :name "gv-clade-index" :revision "2cfabd15d6cb966ed369ee13aa7174b960f45abd")) + (validation :metadata-command "bash tools/check-metadata.sh" :proof-command "just test" + :guard-command "just guard" :status declared + :note "No assurance grade, signature or certification is asserted.")) diff --git a/experimental/echo-additive/STATE.adoc b/experimental/echo-additive/STATE.adoc index 994cbdd8..4a0e5871 100644 --- a/experimental/echo-additive/STATE.adoc +++ b/experimental/echo-additive/STATE.adoc @@ -1,4 +1,36 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 += Additive Echo experiments — current scope and historical journal +:toc: macro +:status: 2026-11-06 local Agda 2.7.0.1 checks passed; fresh cold AuditSmoke passed + +== Current interpretation + +The shipped ordinary Echo definition is the standard dependent fibre. The public `EchoModality` contract is a preorder-indexed diagram. Its legacy comonad-named single-index operations do not provide a nested graded comonad, and their equations do not establish a reflective modality. + +`EchoVariance` supplies inverse maps for fibres of a chosen composite. These maps do not assemble a tropical graded monad: one must specify endofunctors, naturality, grading coherence, and all laws. `A↔ΣEcho` retains the original source and has no grade parameter. Neither source recovery from a bare output nor minimum storage follows. + +The experimental additive carrier, faithful stack carrier, and writer carrier are different constructions. Their assumptions and maps must not be combined into one blanket variance verdict. A carrier `A × ⊤` retains `A` and is not contractible for arbitrary `A`; the contractibility of a tower at `A = ⊤` does not make its action at arbitrary `A` vacuous. + +A map `Dc inf A → A` for every `A`, when `Dc inf A = ⊤`, would imply `⊤ → ⊥` at `A = ⊥`. This obstructs that all-grade recovery map. The usual graded-comonad counit is at the monoidal unit grade; it does not require a counit at every grade. The obstruction therefore does not rule out all graded comonads involving loss. A specific proposed splitting map or triangle can fail under its own assumptions without implying that no other carrier or categorical structure can work. + +The baseline `GradedComonadStructure` packages selected functor and comonad equations but omits naturality. The local companion `EchoGradedComonadNaturality.NaturalGradedComonad` adds the explicit pointwise congruence and naturality obligations. Existing identifiers remain compatible. Natural/list grade UIP used for grade transports is not a global UIP or funext principle. The companion and its F1/natural/list witnesses pass local Agda 2.7.0.1 checks, as recorded in the evidence ledger. + +The dependent pushforward/reindexing extension `EchoDependentPushforward` uses pointwise hom-setoid equality, specifies its action laws and hom correspondence, and supplies unit/counit triangles. It is separate from a tropical grading programme. Its local Agda 2.7.0.1 check passes; the composition natural isomorphism is not a complete base-indexed coherence package. The successful baseline remote workflow is separate evidence. + +== Evidence and research boundary + +The experimental aggregate is invoked directly by the current Agda workflow and remains separate from the shipped `All.agda` closure. See link:../../docs/foundation.adoc[the root/profile inventory] and link:../../docs/audit/2026-11-06-evidence.adoc[the evidence ledger]. Exact current compiler outcomes, dependency commits, and source coverage are required for a checked claim. + +No new ordered tropical algebra or linear runtime implementation is authorized by these repairs. Such work needs a concrete target and specification. A physical thermodynamic interpretation, runtime refinement, and novelty/priority assessment are independent obligations. + +The locally checked `EchoErasingGradedComonad` is a concrete natural graded comonad with `D 0 A = A` and `D (suc n) A = ⊤`, so positive grades erase content. Its natural-order degradation equations are accepted as well. `grade-change-compose` and `grade-change-δ` produce `UnsupportedIndexedMatch` warnings about Cubical transport computation; this is a limitation of the recorded acceptance, not a rejected proof. Standard-library warnings are also retained in the local receipts. The separate fresh `--ignore-interfaces` AuditSmoke check also passes with exit 0 on unchanged proof sources. + +== Historical experimental journal (retained verbatim) + +The following is the baseline journal of the 2026-06 experiments, including its then-current conjectures, authorization notes, and claimed checks. It is quoted historical material. In particular its “VARIANCE QUESTION SETTLED”, “inert carrier”, and blanket “not a comonad/adjunction” conclusions are superseded by the specific carrier and interface distinctions above. It is not a fresh verification receipt. + +........ +// SPDX-License-Identifier: CC-BY-SA-4.0 // Copyright (c) Jonathan D.A. Jewell = Echo-Additive Experimental — Session State :revdate: 2026-06-14 @@ -460,3 +492,5 @@ one-directional seam, never the modality's defining structure. Firewall intact (GradedAdjunction imports only Grade + GradedCarrierFaithful + stdlib; neither inert R3 line imported). Not wired into All.agda/Smoke.agda; not merged to main. Independent adversary re-verified on the real repo + fresh tree. + +........ diff --git a/mise.toml b/mise.toml index 6dd983f6..7664b8d7 100644 --- a/mise.toml +++ b/mise.toml @@ -1,57 +1,6 @@ +# SPDX-License-Identifier: MPL-2.0 +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +# Only tools used here. scripts/setup-agda.sh pins Agda and its dependencies. [tools] -# Language runtimes -node = "latest" -python = "latest" -rust = "latest" -go = "latest" -zig = "latest" -java = "latest" -bun = "latest" -denojs = "latest" - -# Package managers -npm = "latest" -yarn = "latest" -pnpm = "latest" -pip = "latest" -cargo = "latest" -go-task = "latest" - -# Formatting & Linting -gofmt = "latest" -black = "latest" -isort = "latest" -ruff = "latest" -prettier = "latest" -shfmt = "latest" -stylua = "latest" - -# Build tools -cmake = "latest" -make = "latest" -ninja = "latest" - -# Shell tools -git = "latest" -gnu-sed = "latest" -gnu-tar = "latest" -gnu-grep = "latest" - -# Testing -vitest = "latest" -pytest = "latest" -jest = "latest" - -[env] -# Common environment variables -NODE_ENV = "development" -PYTHONDONTWRITEBYTECODE = "1" -PYTHONUNBUFFERED = "1" - -# Task runner alias -[alias] -task = "go-task" -build = "cargo build --release || npm run build || go build" -test = "cargo test || npm test || go test ./..." -lint = "ruff check . || prettier --check . || black --check ." -fmt = "ruff format . || prettier --write . || black ." +bun = "1.4.4" +just = "1.40.0" diff --git a/proofs/agda/All.agda b/proofs/agda/All.agda index 1149fe26..afc06452 100644 --- a/proofs/agda/All.agda +++ b/proofs/agda/All.agda @@ -108,7 +108,7 @@ open import EchoGradedComonadF1 -- Gate F1 PASSED (graded comonad on iterated-re open import EchoGradedComonadInterface -- Gate F3 abstract record open import EchoGradedComonadInstance1 -- Gate F3 instance 1 (F1 at (ℕ, +, 0)) open import EchoGradedComonadInstance2 -- Gate F3 PASSED — instance 2 at (List Tag, ++, []) -open import EchoVariance -- variance verdict: monad (accumulation) + fibre adjunction, NOT comonad +open import EchoVariance -- fibre composition/recovery; no universal categorical verdict -- Foundation P1: external-fibre triangulation. Echo agrees with the -- standard library's OWN independently-authored notions @@ -122,8 +122,9 @@ open import Ordinal.Buchholz.Syntax -- Foundation contract surface (FOUNDATION_CONTRACT.md): the curated, -- stable `Echo.*` public interface exported to downstream languages. -- Index + modality are measure-independent; the measure seam may --- observe residues but never defines Echo (Echo IS-NOT a resource --- instance). See docs/echo-types/echo-kernel-note.adoc. +-- observe residues without defining the fibre carrier. This is an API +-- separation, not universal non-encodability in resource semantics. +-- See docs/echo-types/echo-kernel-note.adoc. open import Echo.Index.ThinPoset open import Echo.Modality.Interface open import Echo.Modality.Core @@ -132,3 +133,6 @@ open import Echo.Measure.Interface open import Echo.Measure.Examples open import Smoke + +-- Foundational corrections and their explicit counterexamples. +import AuditSmoke diff --git a/proofs/agda/AuditSmoke.agda b/proofs/agda/AuditSmoke.agda new file mode 100644 index 00000000..72030558 --- /dev/null +++ b/proofs/agda/AuditSmoke.agda @@ -0,0 +1,20 @@ +{-# OPTIONS --safe --without-K --cubical-compatible #-} +-- SPDX-License-Identifier: MPL-2.0 +-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell + +-- Aggregate for the 2026-11-06 foundational corrections. No ordinal imports. +module AuditSmoke where + +import EchoSourcePreserving +import EchoCNOSemantics +import EchoDependentPushforward +import EchoErasingGradedComonad +import EchoNaturalityIndependence +import EchoThinPreorderExample +import EchoGradedComonadNaturality +import EchoGradedComonadInstance1 +import EchoGradedComonadInstance2 +import EchoSeparating +import EchoCharacteristic +import EchoResidue +import EchoNoSectionGeneric diff --git a/proofs/agda/Echo/Index/ThinPoset.agda b/proofs/agda/Echo/Index/ThinPoset.agda index c6c579a9..24db9332 100644 --- a/proofs/agda/Echo/Index/ThinPoset.agda +++ b/proofs/agda/Echo/Index/ThinPoset.agda @@ -2,37 +2,14 @@ -- SPDX-License-Identifier: MPL-2.0 -- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell --- Echo.Index.ThinPoset — the stable exported interface for the *echo --- index*: the thin poset/order of retention-vs-degradation that the --- Echo modality is indexed by. --- --- This is one of the four curated public-surface modules of the Echo --- foundation (see `FOUNDATION_CONTRACT.md`). It names, under a stable --- API, the *index axis* of the residual modality — and ONLY the index --- axis. It carries: --- --- * the abstract `ThinPoset` record (carrier `Ix`, order `_≤_`, --- reflexivity, transitivity, and *thinness* — propositionality of --- order proofs) that downstream languages (e.g. my-lang) --- instantiate; --- --- * the canonical concrete instance `grade-thinPoset` over the --- three-point loss order `keep ≤ residue ≤ forget`, re-exported --- verbatim from the proven `EchoGraded` module so there is a --- SINGLE source of truth for the order — the same order that --- `Echo.Modality.Core.degrade` acts over. --- --- VOCABULARY (see `FOUNDATION_CONTRACT.md`). The inhabitants of `Ix` --- are *echo indices*, NOT *resource grades*. An echo index lives on --- the thin-poset retention axis of the Echo modality; a resource --- grade lives on the semiring/resource-algebra axis. They are --- orthogonal. This module touches only the echo-index axis. --- --- MEASURE-INDEPENDENCE INVARIANT. This module imports NO semiring / --- resource-algebra machinery (it imports `EchoGraded`, whose own cone --- is stdlib-only). The echo index is defined without reference to any --- residue *measure*; measures are a downstream observation seam --- (`Echo.Measure.Interface`), never part of the index. +-- Public echo-index interface. The legacy name ThinPoset is retained for +-- compatibility; its fields express a thin preorder, without antisymmetry. +-- EchoThinPreorderExample exhibits distinct mutually reachable indices. +-- Thinness proves independence from the choice of arrows. Ordinary action +-- composition only requires chosen composition and its functor law. +-- Echo indices describe retention/degradation, independently of resource +-- measures and semiring grades. The concrete grade-thinPoset is exported +-- below; Echo.Modality.Core supplies the modality action. module Echo.Index.ThinPoset where @@ -40,18 +17,8 @@ open import Level using (Level; suc; _⊔_; 0ℓ) open import Relation.Binary.PropositionalEquality using (_≡_; refl) ---------------------------------------------------------------------- --- The abstract echo-index interface. --- --- A `ThinPoset` is a poset whose order is *thin* (a.k.a. --- propositional / a preorder that is moreover a poset-of-truth- --- values on each hom): any two proofs of `i ≤ j` are equal. Thinness --- is the load-bearing hypothesis behind `degrade-compose` --- (path-independence of degradation); the separating model in --- `Echo.Separation.NotResourceInstance` shows that dropping thinness --- breaks composition, so the field is not cosmetic. --- --- Downstream consumers instantiate this record at their own index --- type. The canonical inhabitant `grade-thinPoset` is provided below. +-- Legacy interface for a thin preorder: reflexive, transitive, and with +-- proposition-valued homs. No antisymmetry or object equality is asserted. ---------------------------------------------------------------------- record ThinPoset (ℓi ℓr : Level) : Set (suc (ℓi ⊔ ℓr)) where diff --git a/proofs/agda/EchoCNOBridge.agda b/proofs/agda/EchoCNOBridge.agda index 1daa1b4e..0e063460 100644 --- a/proofs/agda/EchoCNOBridge.agda +++ b/proofs/agda/EchoCNOBridge.agda @@ -2,31 +2,16 @@ -- SPDX-License-Identifier: MPL-2.0 -- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell --- Echo↔CNO Content Bridge. +-- Legacy program-provenance bridge into the constant Program-to-unit fibre. +-- ProgramEcho ignores its parameter, and cno-program-echo ignores the +-- supplied certificate. Thus this API stores program syntax but does not +-- enforce that the stored witness is the indexed program or prove a state +-- identity correspondence. Names are retained for compatibility. -- --- Resolves issue #21. The previous EchoCNOBridge.agda was a --- *name-bridge*: it defined a local 4-constructor `CNOOp` enum --- (`Read`/`Write`/`Execute`/`NullOp`) entirely independent of --- absolute-zero's CNO formalisation, so its names happened to use --- "CNO" without sharing a single type-level fact with the sister --- repository. This module replaces that with a *content-bridge*: --- it imports `Program`, `IsCNO`, `empty-is-cno`, `halt-is-cno`, --- `cno-composition`, `absolute-zero`, and `absolute-zero-is-cno` --- directly from absolute-zero's `CNO.agda`, and exhibits a --- constructive Echo witness for every `IsCNO p` Program. --- --- Pre-requisites (cross-repo plumbing): --- * `absolute-zero/absolute-zero.agda-lib` registered in --- `~/.agda/libraries`. --- * `depend: absolute-zero` listed in `echo-types.agda-lib`. --- * absolute-zero's `proofs/agda/CNO.agda` typechecks under --- `--safe --without-K` (was blocked at HEAD by two parse --- errors at lines 316 and 323 in `ternary-add` / `crazy-op`'s --- `using (_Data.Nat.%_)` clauses, plus two unfilled holes in --- `cno-composition`'s `cno-identity` / `cno-pure` fields). --- A patch addressing both is filed alongside this commit at --- `docs/echo-types/issue-21-absolute-zero.patch`. - +-- EchoCNOSemantics adds CertifiedProgramEcho (same-program equality plus +-- IsCNO certificate) and a semantic bridge using CNO.state-eq. The pinned +-- external evaluator is total and its energy function is constant zero; +-- these model definitions are not independent physical guarantees. module EchoCNOBridge where open import Echo @@ -62,18 +47,7 @@ ProgramEcho : Program → Set ProgramEcho _ = Echo program-to-unit tt ---------------------------------------------------------------------- --- Headline bridge theorem: every certified-null program has a --- constructive Echo witness. --- --- The IsCNO certificate is consumed but not destructed: any program --- has an echo at `tt` via `echo-intro`, and the bridge's content is --- that this echo is naturally indexed by the program itself. --- Read against absolute-zero's CNO.agda, this depends on the --- *existence* of an `IsCNO`, not on its contents — which is the --- right level for a content-bridge: we are exhibiting that any --- `IsCNO`-classified program inhabits the echo type, not --- retrofitting a separate proof of CNO-ness. ----------------------------------------------------------------------- +-- Any program admits this provenance witness. The certificate is unused. cno-program-echo : (p : Program) → IsCNO p → ProgramEcho p cno-program-echo p _ = echo-intro program-to-unit p @@ -97,11 +71,8 @@ absolute-zero-echo = cno-program-echo absolute-zero absolute-zero-is-cno ---------------------------------------------------------------------- --- Composition: chained CNO certificates extend the bridge to the --- sequenced program. This is the single fact that distinguishes a --- content-bridge from a name-bridge: composition here uses --- `CNO.cno-composition` from absolute-zero, not a local substitute. ----------------------------------------------------------------------- +-- This legacy construction accepts external composition evidence, then +-- discards it when constructing the provenance witness. cno-compose-echo : ∀ {p₁ p₂} → IsCNO p₁ → IsCNO p₂ → diff --git a/proofs/agda/EchoCNOSemantics.agda b/proofs/agda/EchoCNOSemantics.agda new file mode 100644 index 00000000..7ac50f48 --- /dev/null +++ b/proofs/agda/EchoCNOSemantics.agda @@ -0,0 +1,120 @@ +{-# OPTIONS --safe --without-K #-} +-- SPDX-License-Identifier: MPL-2.0 +-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell + +module EchoCNOSemantics where + +open import Data.Product.Base using (Σ; _×_; _,_; proj₁; proj₂) +open import Data.List.Base using ([]; _∷_) +open import Data.Empty using (⊥) +open import Relation.Binary.PropositionalEquality using (_≡_; refl; sym; trans; subst) +open import Echo using (echo-intro) +open import EchoCNOBridge using (ProgramEcho; program-to-unit) +open import CNO using + ( Program; ProgramState; mk-state; empty-memory; IsCNO; eval; state-eq + ; terminates-always; Nop; Halt; empty-is-cno; halt-is-cno; seq-comp; cno-composition ) + +-- Unlike the legacy ProgramEcho alias, this record ties the stored witness +-- and certificate to precisely the program in the index. +record CertifiedProgramEcho (p : Program) : Set where + field + provenance : ProgramEcho p + same-program : proj₁ provenance ≡ p + certificate : IsCNO p + +certify-program-echo : ∀ p → IsCNO p → CertifiedProgramEcho p +certify-program-echo p c = record + { provenance = echo-intro program-to-unit p + ; same-program = refl + ; certificate = c + } + +NativeNull : Program → Set +NativeNull p = ∀ s → state-eq (eval p s) s + +certified-echo-native-null : ∀ {p} → CertifiedProgramEcho p → NativeNull p +certified-echo-native-null e = IsCNO.cno-identity (CertifiedProgramEcho.certificate e) + +state-refl : ∀ s → state-eq s s +state-refl s = (λ addr → refl) , refl , refl , refl + +state-sym : ∀ {s t} → state-eq s t → state-eq t s +state-sym (m , r , i , p) = (λ addr → sym (m addr)) , sym r , sym i , sym p + +state-trans : ∀ {s t u} → state-eq s t → state-eq t u → state-eq s u +state-trans (m , r , i , p) (n , q , j , z) = + (λ addr → trans (m addr) (n addr)) , trans r q , trans i j , trans p z + +-- At this pinned external model, all other IsCNO fields follow from +-- native state identity: evaluation is total and its energy function is zero. +-- This is a statement about that model, not physical thermodynamics. +native-null-to-cno : ∀ {p} → NativeNull p → IsCNO p +native-null-to-cno {p} h = record + { cno-terminates = terminates-always p + ; cno-identity = h + ; cno-pure = λ s → sym (proj₁ (proj₂ (proj₂ (h s)))) , + (λ addr → sym (proj₁ (h s) addr)) + ; cno-reversible = λ s → refl + } + +-- Relation-valued fibres use CNO's native state-eq. They do not assert +-- propositional equality between states (whose memories are functions). +StateEcho : Program → ProgramState → Set +StateEcho p target = Σ ProgramState (λ source → state-eq (eval p source) target) + +IdentityStateEcho : ProgramState → Set +IdentityStateEcho target = Σ ProgramState (λ source → state-eq source target) + +native-null-to-fibre-map : ∀ {p} → NativeNull p → + ∀ {target} → StateEcho p target → IdentityStateEcho target +native-null-to-fibre-map h (s , e) = s , state-trans (state-sym (h s)) e + +native-null-from-fibre-map : ∀ {p} → NativeNull p → + ∀ {target} → IdentityStateEcho target → StateEcho p target +native-null-from-fibre-map h (s , e) = s , state-trans (h s) e + +record SourcePreservingStateMap (p : Program) : Set where + field + map : ∀ {target} → StateEcho p target → IdentityStateEcho target + source-preserved : ∀ {target} (e : StateEcho p target) → proj₁ (map e) ≡ proj₁ e + +native-null-source-map : ∀ {p} → NativeNull p → SourcePreservingStateMap p +native-null-source-map {p} h = record + { map = native-null-to-fibre-map {p} h + ; source-preserved = λ e → refl + } + +source-map-native-null : ∀ {p} → SourcePreservingStateMap p → NativeNull p +source-map-native-null {p} m s = state-sym + (subst (λ x → state-eq x (eval p s)) + (SourcePreservingStateMap.source-preserved m (s , state-refl (eval p s))) + (proj₂ (SourcePreservingStateMap.map m (s , state-refl (eval p s))))) + +certified-state-echo : ∀ {p} → CertifiedProgramEcho p → ∀ s → StateEcho p s +certified-state-echo e s = s , certified-echo-native-null e s + +certified-state-echo-source : ∀ {p} (e : CertifiedProgramEcho p) s → + proj₁ (certified-state-echo e s) ≡ s +certified-state-echo-source e s = refl + +certified-compose : ∀ {p q} → CertifiedProgramEcho p → CertifiedProgramEcho q → + CertifiedProgramEcho (seq-comp p q) +certified-compose {p} {q} e d = certify-program-echo (seq-comp p q) + (cno-composition (CertifiedProgramEcho.certificate e) (CertifiedProgramEcho.certificate d)) + +empty-certified : CertifiedProgramEcho [] +empty-certified = certify-program-echo [] empty-is-cno + +halt-certified : CertifiedProgramEcho (Halt ∷ []) +halt-certified = certify-program-echo (Halt ∷ []) halt-is-cno + +-- A meaningful negative control: this semantics increments PC on Nop. +initial-state : ProgramState +initial-state = mk-state empty-memory [] [] 0 + +nop-not-native-null : NativeNull (Nop ∷ []) → ⊥ +nop-not-native-null h with proj₂ (proj₂ (proj₂ (h initial-state))) +... | () + +nop-not-certified : CertifiedProgramEcho (Nop ∷ []) → ⊥ +nop-not-certified e = nop-not-native-null (certified-echo-native-null e) diff --git a/proofs/agda/EchoCharacteristic.agda b/proofs/agda/EchoCharacteristic.agda index 4f18d64e..87dabebd 100644 --- a/proofs/agda/EchoCharacteristic.agda +++ b/proofs/agda/EchoCharacteristic.agda @@ -31,6 +31,22 @@ no-section-collapse : ¬ (Σ (⊤ → Bool) (λ g → ∀ b → g (collapse b) ≡ b)) no-section-collapse (g , sec) = true≢false (trans (sym (sec true)) (sec false)) +-- The theorem above rules out a LEFT inverse of collapse. A section +-- of collapse in the usual categorical sense is a RIGHT inverse; +-- both Boolean choices below provide one. +collapse-raise-true collapse-raise-false : ⊤ → Bool +collapse-raise-true _ = true +collapse-raise-false _ = false + +collapse-right-inverse-true : ∀ u → collapse (collapse-raise-true u) ≡ u +collapse-right-inverse-true tt = refl + +collapse-right-inverse-false : ∀ u → collapse (collapse-raise-false u) ≡ u +collapse-right-inverse-false tt = refl + +collapse-right-inverses-distinct : collapse-raise-true ≢ collapse-raise-false +collapse-right-inverses-distinct p = true≢false (cong (λ s → s tt) p) + -- Yet echoes retain proof-relevant distinctions for the same visible output. echo-true : Echo collapse tt echo-true = echo-intro collapse true diff --git a/proofs/agda/EchoDependentPushforward.agda b/proofs/agda/EchoDependentPushforward.agda new file mode 100644 index 00000000..71a6c980 --- /dev/null +++ b/proofs/agda/EchoDependentPushforward.agda @@ -0,0 +1,182 @@ +{-# OPTIONS --safe --without-K --cubical-compatible #-} +-- SPDX-License-Identifier: MPL-2.0 +-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell + +module EchoDependentPushforward where + +open import Level using (Level) +open import Data.Product.Base using (Σ; _×_; _,_; proj₁; proj₂) +open import Data.Unit.Polymorphic.Base using (⊤; tt) +open import Relation.Binary.PropositionalEquality using (_≡_; refl; sym; trans; cong) +open import Echo using (Echo) + +-- Fam(A), with families at one common universe and pointwise hom equality. +-- This is explicit hom-setoid mathematics; no function extensionality, +-- resizing, global UIP, or claim that all Agda types are h-sets is used. +Hom : ∀ {ℓ} {A : Set ℓ} → (A → Set ℓ) → (A → Set ℓ) → Set ℓ +Hom {A = A} P Q = ∀ a → P a → Q a + +HomEq : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} → Hom P Q → Hom P Q → Set ℓ +HomEq u v = ∀ a x → u a x ≡ v a x + +idH : ∀ {ℓ} {A : Set ℓ} {P : A → Set ℓ} → Hom P P +idH a x = x + +composeH : ∀ {ℓ} {A : Set ℓ} {P Q R : A → Set ℓ} → Hom Q R → Hom P Q → Hom P R +composeH v u a x = v a (u a x) + +hom-refl : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} (u : Hom P Q) → HomEq u u +hom-refl u a x = refl + +hom-sym : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} {u v : Hom P Q} → HomEq u v → HomEq v u +hom-sym e a x = sym (e a x) + +hom-trans : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} {u v w : Hom P Q} → + HomEq u v → HomEq v w → HomEq u w +hom-trans e d a x = trans (e a x) (d a x) + +compose-cong : ∀ {ℓ} {A : Set ℓ} {P Q R : A → Set ℓ} + {u u' : Hom P Q} {v v' : Hom Q R} → HomEq u u' → HomEq v v' → + HomEq (composeH v u) (composeH v' u') +compose-cong {v = v} e d a x = trans (cong (v a) (e a x)) (d a _) + +identity-left : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} (u : Hom P Q) → HomEq (composeH idH u) u +identity-left u a x = refl + +identity-right : ∀ {ℓ} {A : Set ℓ} {P Q : A → Set ℓ} (u : Hom P Q) → HomEq (composeH u idH) u +identity-right u a x = refl + +compose-assoc : ∀ {ℓ} {A : Set ℓ} {P Q R S : A → Set ℓ} + (w : Hom R S) (v : Hom Q R) (u : Hom P Q) → + HomEq (composeH (composeH w v) u) (composeH w (composeH v u)) +compose-assoc w v u a x = refl + +Push : ∀ {ℓ} {A B : Set ℓ} → (A → B) → (A → Set ℓ) → B → Set ℓ +Push {A = A} f P b = Σ A (λ a → (f a ≡ b) × P a) + +Reindex : ∀ {ℓ} {A B : Set ℓ} → (A → B) → (B → Set ℓ) → A → Set ℓ +Reindex f Q a = Q (f a) + +push-map : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P P' : A → Set ℓ} → Hom P P' → Hom (Push f P) (Push f P') +push-map f u b (a , e , x) = a , e , u a x + +reindex-map : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {Q Q' : B → Set ℓ} → Hom Q Q' → Hom (Reindex f Q) (Reindex f Q') +reindex-map f v a x = v (f a) x + +push-cong : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P P' : A → Set ℓ} {u v : Hom P P'} → + HomEq u v → HomEq (push-map f u) (push-map f v) +push-cong f h b (a , e , x) = cong (λ z → a , e , z) (h a x) + +push-id : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} → HomEq (push-map f (idH {P = P})) idH +push-id f b (a , e , x) = refl + +push-compose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P Q R : A → Set ℓ} (v : Hom Q R) (u : Hom P Q) → + HomEq (push-map f (composeH v u)) (composeH (push-map f v) (push-map f u)) +push-compose f v u b (a , e , x) = refl + +reindex-cong : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {Q Q' : B → Set ℓ} {u v : Hom Q Q'} → + HomEq u v → HomEq (reindex-map f u) (reindex-map f v) +reindex-cong f e a x = e (f a) x + +reindex-id : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {Q : B → Set ℓ} → HomEq (reindex-map f (idH {P = Q})) idH +reindex-id f a x = refl + +reindex-compose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P Q R : B → Set ℓ} (v : Hom Q R) (u : Hom P Q) → + HomEq (reindex-map f (composeH v u)) (composeH (reindex-map f v) (reindex-map f u)) +reindex-compose f v u a x = refl + +-- Natural hom correspondence: Hom(Push f P,Q) ≅ Hom(P,Reindex f Q). +transpose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} → + Hom (Push f P) Q → Hom P (Reindex f Q) +transpose f h a x = h (f a) (a , refl , x) + +untranspose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} → + Hom P (Reindex f Q) → Hom (Push f P) Q +untranspose f k b (a , refl , x) = k a x + +transpose-cong : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} + {h h' : Hom (Push f P) Q} → HomEq h h' → HomEq (transpose f h) (transpose f h') +transpose-cong f e a x = e (f a) (a , refl , x) + +untranspose-cong : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} + {k k' : Hom P (Reindex f Q)} → HomEq k k' → + HomEq (untranspose f {P = P} {Q = Q} k) (untranspose f {P = P} {Q = Q} k') +untranspose-cong f e b (a , refl , x) = e a x + +transpose-untranspose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} + (k : Hom P (Reindex f Q)) → + HomEq (transpose f {P = P} {Q = Q} (untranspose f {P = P} {Q = Q} k)) k +transpose-untranspose f k a x = refl + +untranspose-transpose : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P : A → Set ℓ} {Q : B → Set ℓ} + (h : Hom (Push f P) Q) → HomEq (untranspose f (transpose f h)) h +untranspose-transpose f h b (a , refl , x) = refl + +transpose-natural-source : ∀ {ℓ} {A B : Set ℓ} (f : A → B) + {P P' : A → Set ℓ} {Q : B → Set ℓ} (u : Hom P' P) (h : Hom (Push f P) Q) → + HomEq (transpose f (composeH h (push-map f u))) (composeH (transpose f h) u) +transpose-natural-source f u h a x = refl + +transpose-natural-target : ∀ {ℓ} {A B : Set ℓ} (f : A → B) + {P : A → Set ℓ} {Q Q' : B → Set ℓ} (v : Hom Q Q') (h : Hom (Push f P) Q) → + HomEq (transpose f (composeH v h)) (composeH (reindex-map f v) (transpose f h)) +transpose-natural-target f v h a x = refl + +unit : ∀ {ℓ} {A B : Set ℓ} (f : A → B) (P : A → Set ℓ) → Hom P (Reindex f (Push f P)) +unit f P a x = a , refl , x + +counit : ∀ {ℓ} {A B : Set ℓ} (f : A → B) (Q : B → Set ℓ) → Hom (Push f (Reindex f Q)) Q +counit f Q = untranspose f idH + +unit-natural : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {P P' : A → Set ℓ} (u : Hom P P') → + HomEq (composeH (reindex-map f (push-map f u)) (unit f P)) (composeH (unit f P') u) +unit-natural f u a x = refl + +counit-natural : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {Q Q' : B → Set ℓ} (v : Hom Q Q') → + HomEq (composeH v (counit f Q)) (composeH (counit f Q') (push-map f (reindex-map f v))) +counit-natural f v b (a , refl , x) = refl + +triangle-push : ∀ {ℓ} {A B : Set ℓ} (f : A → B) (P : A → Set ℓ) → + HomEq (composeH (counit f (Push f P)) (push-map f (unit f P))) idH +triangle-push f P b (a , refl , x) = refl + +triangle-reindex : ∀ {ℓ} {A B : Set ℓ} (f : A → B) (Q : B → Set ℓ) → + HomEq (composeH (reindex-map f (counit f Q)) (unit f (Reindex f Q))) idH +triangle-reindex f Q a x = refl + +-- Echo is the pushforward of the terminal family, with explicit inverse maps. +echo-to-push : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {b} → Echo f b → Push f (λ _ → ⊤ {ℓ}) b +echo-to-push f (a , e) = a , e , tt + +push-to-echo : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {b} → Push f (λ _ → ⊤ {ℓ}) b → Echo f b +push-to-echo f (a , e , tt) = a , e + +echo-roundtrip : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {b} (e : Echo f b) → push-to-echo f (echo-to-push f e) ≡ e +echo-roundtrip f (a , e) = refl + +terminal-push-roundtrip : ∀ {ℓ} {A B : Set ℓ} (f : A → B) {b} (e : Push f (λ _ → ⊤ {ℓ}) b) → + echo-to-push f (push-to-echo f e) ≡ e +terminal-push-roundtrip f (a , e , tt) = refl + +-- Dependent pushforward composition, natural in the input family. +push-composite-to : ∀ {ℓ} {A B C : Set ℓ} (f : A → B) (g : B → C) {P : A → Set ℓ} → + Hom (Push g (Push f P)) (Push (λ a → g (f a)) P) +push-composite-to f g c (b , q , a , refl , x) = a , q , x + +push-composite-from : ∀ {ℓ} {A B C : Set ℓ} (f : A → B) (g : B → C) {P : A → Set ℓ} → + Hom (Push (λ a → g (f a)) P) (Push g (Push f P)) +push-composite-from f g c (a , q , x) = f a , q , a , refl , x + +push-composite-from-to : ∀ {ℓ} {A B C : Set ℓ} (f : A → B) (g : B → C) {P : A → Set ℓ} → + HomEq (composeH (push-composite-from f g {P}) (push-composite-to f g)) idH +push-composite-from-to f g c (b , q , a , refl , x) = refl + +push-composite-to-from : ∀ {ℓ} {A B C : Set ℓ} (f : A → B) (g : B → C) {P : A → Set ℓ} → + HomEq (composeH (push-composite-to f g {P}) (push-composite-from f g)) idH +push-composite-to-from f g c (a , q , x) = refl + +push-composite-natural : ∀ {ℓ} {A B C : Set ℓ} (f : A → B) (g : B → C) + {P P' : A → Set ℓ} (u : Hom P P') → + HomEq (composeH (push-map (λ a → g (f a)) u) (push-composite-to f g)) + (composeH (push-composite-to f g) (push-map g (push-map f u))) +push-composite-natural f g u c (b , q , a , refl , x) = refl diff --git a/proofs/agda/EchoErasingGradedComonad.agda b/proofs/agda/EchoErasingGradedComonad.agda new file mode 100644 index 00000000..13f817c5 --- /dev/null +++ b/proofs/agda/EchoErasingGradedComonad.agda @@ -0,0 +1,185 @@ +{-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} +-- SPDX-License-Identifier: MPL-2.0 +-- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell + +-- A bounded counterexample to the universal claim that information loss +-- excludes graded comonads. Grades form the discrete monoid (ℕ, +, 0): +-- grade zero preserves a value and every positive grade erases it. +-- This does not identify the construction with Echo's proposed ordered +-- or tropical model, or claim that its intended erasure map has a section. +module EchoErasingGradedComonad where + +open import Data.Nat.Base using (ℕ; zero; suc; _+_; _≤_; z≤n; s≤s) +open import Data.Nat.Properties + using (+-identityˡ; +-identityʳ; +-assoc; ≡-irrelevant; ≤-refl; ≤-trans; +-mono-≤) +open import Data.Unit.Base using (⊤; tt) +open import Data.Bool.Base using (Bool; false; true) +open import Data.Empty using (⊥) +open import Relation.Binary.PropositionalEquality + using (_≡_; refl; subst; cong; sym; trans) + +open import EchoGradedComonadInterface using (GradedComonadStructure) +open import EchoGradedComonadNaturality using (NaturalGradedComonad) + +D : ℕ → Set → Set +D zero A = A +D (suc n) A = ⊤ + +mapD : ∀ n {A B} → (A → B) → D n A → D n B +mapD zero f x = f x +mapD (suc n) f x = tt + +mapD-id : ∀ n {A} (x : D n A) → mapD n (λ a → a) x ≡ x +mapD-id zero x = refl +mapD-id (suc n) x = refl + +mapD-∘ : ∀ n {A B C} (f : B → C) (h : A → B) (x : D n A) → + mapD n (λ a → f (h a)) x ≡ mapD n f (mapD n h x) +mapD-∘ zero f h x = refl +mapD-∘ (suc n) f h x = refl + +ε : ∀ {A} → D zero A → A +ε x = x + +δ : ∀ g h {A} → D (g + h) A → D g (D h A) +δ zero h x = x +δ (suc g) h x = tt + +gc-counit-r : ∀ g {A} (x : D (zero + g) A) → + ε (δ zero g x) ≡ subst (λ k → D k A) (+-identityˡ g) x +gc-counit-r g x = refl + +gc-counit-l : ∀ g {A} (x : D (g + zero) A) → + mapD g ε (δ g zero x) ≡ subst (λ k → D k A) (+-identityʳ g) x +gc-counit-l zero x = refl +gc-counit-l (suc g) x = refl + +gc-coassoc : ∀ g h k {A} (x : D ((g + h) + k) A) → + δ g h (δ (g + h) k x) ≡ + mapD g (δ h k) + (δ g (h + k) (subst (λ j → D j A) (+-assoc g h k) x)) +gc-coassoc zero zero k x = refl +gc-coassoc zero (suc h) k x = refl +gc-coassoc (suc g) h k x = refl + +erasing-instance : GradedComonadStructure +erasing-instance = record + { G = ℕ + ; 1G = zero + ; _·G_ = _+_ + ; ·G-identityˡ = +-identityˡ + ; ·G-identityʳ = +-identityʳ + ; ·G-assoc = +-assoc + ; D = D + ; mapD = mapD + ; mapD-id = mapD-id + ; mapD-∘ = mapD-∘ + ; ε = ε + ; δ = δ + ; gc-counit-r = gc-counit-r + ; gc-counit-l = gc-counit-l + ; gc-coassoc = gc-coassoc + } + +mapD-cong : ∀ g {A B} {f h : A → B} → + (∀ a → f a ≡ h a) → ∀ (x : D g A) → mapD g f x ≡ mapD g h x +mapD-cong zero p x = p x +mapD-cong (suc g) p x = refl + +ε-natural : ∀ {A B} (f : A → B) (x : D zero A) → + ε (mapD zero f x) ≡ f (ε x) +ε-natural f x = refl + +δ-natural : ∀ g h {A B} (f : A → B) (x : D (g + h) A) → + δ g h (mapD (g + h) f x) ≡ mapD g (mapD h f) (δ g h x) +δ-natural zero h f x = refl +δ-natural (suc g) h f x = refl + +-- This is Nat-specific equality proof uniqueness, obtained in the standard +-- library from decidable Nat equality; it is not a global UIP assumption. +nat-grade-isSet : ∀ {g h : ℕ} (p q : g ≡ h) → p ≡ q +nat-grade-isSet = ≡-irrelevant + +erasing-natural : NaturalGradedComonad erasing-instance +erasing-natural = record + { mapD-cong = mapD-cong + ; ε-natural = ε-natural + ; δ-natural = δ-natural + ; grade-isSet = nat-grade-isSet + } + +erase : ∀ n {A} → A → D (suc n) A +erase n x = tt + +bool-input-collision : ∀ n → erase n false ≡ erase n true +bool-input-collision n = refl + +false≢true : false ≡ true → ⊥ +false≢true () + +-- No left inverse: no recovery function can recover BOTH original inputs. +-- This is deliberately the orientation recover ∘ erase = id, which is +-- the one refuted by a collision (erase ∘ recover = id does hold on ⊤). +positive-erasure-no-left-inverse : ∀ n (recover : D (suc n) Bool → Bool) → + (∀ b → recover (erase n b) ≡ b) → ⊥ +positive-erasure-no-left-inverse n recover left-inverse = + false≢true (trans (sym (left-inverse false)) + (trans (cong recover (bool-input-collision n)) (left-inverse true))) + +---------------------------------------------------------------------- +-- A monotone degradation extension for the usual Nat order. +-- Increasing the grade preserves zero-grade data until the first positive +-- grade, then erases it. The following equations verify naturality, +-- identity/composition, and compatibility with graded comultiplication. +-- They do not assert equivalence with any proposed Echo ordering/model. + +grade-change : ∀ {m n A} → m ≤ n → D m A → D n A +grade-change {zero} {zero} p x = x +grade-change {zero} {suc n} p x = tt +grade-change {suc m} {suc n} p x = tt + +grade-change-natural : ∀ {m n A B} (p : m ≤ n) (f : A → B) + (x : D m A) → mapD n f (grade-change p x) ≡ + grade-change p (mapD m f x) +grade-change-natural {zero} {zero} p f x = refl +grade-change-natural {zero} {suc n} p f x = refl +grade-change-natural {suc m} {suc n} p f x = refl + +grade-change-id : ∀ n {A} (x : D n A) → + grade-change {n} {n} {A} ≤-refl x ≡ x +grade-change-id zero x = refl +grade-change-id (suc n) x = refl + +grade-change-compose : ∀ {m n k A} (p : m ≤ n) (q : n ≤ k) + (x : D m A) → grade-change q (grade-change p x) ≡ + grade-change (≤-trans p q) x +grade-change-compose {zero} {zero} {zero} z≤n z≤n x = refl +grade-change-compose {zero} {zero} {suc k} z≤n z≤n x = refl +grade-change-compose {zero} {suc n} {suc k} z≤n (s≤s q) x = refl +grade-change-compose {suc m} {suc n} {suc k} (s≤s p) (s≤s q) x = refl + +-- The construction does not depend on the chosen witness of an inequality. +grade-change-proof-independent : ∀ {m n A} (p q : m ≤ n) + (x : D m A) → grade-change p x ≡ grade-change q x +grade-change-proof-independent {zero} {zero} p q x = refl +grade-change-proof-independent {zero} {suc n} p q x = refl +grade-change-proof-independent {suc m} {suc n} p q x = refl + +grade-change-ε : ∀ {A} (x : D zero A) → + ε (grade-change {zero} {zero} {A} ≤-refl x) ≡ ε x +grade-change-ε x = refl + +grade-change-δ : ∀ {g g′ h h′ A} (p : g ≤ g′) (q : h ≤ h′) + (x : D (g + h) A) → + δ g′ h′ (grade-change (+-mono-≤ p q) x) ≡ + grade-change p (mapD g (grade-change q) (δ g h x)) +grade-change-δ {zero} {zero} {zero} {zero} z≤n z≤n x = refl +grade-change-δ {zero} {zero} {zero} {suc h′} z≤n z≤n x = refl +grade-change-δ {zero} {zero} {suc h} {suc h′} z≤n (s≤s q) x = refl +grade-change-δ {zero} {suc g′} z≤n q x = refl +grade-change-δ {suc g} {suc g′} (s≤s p) q x = refl + +-- The explicit loss map is itself a grade-change map out of grade zero. +erase-is-grade-change : ∀ n {A} (x : A) → + erase n x ≡ grade-change {zero} {suc n} {A} z≤n x +erase-is-grade-change n x = refl diff --git a/proofs/agda/EchoGradedComonadF1.agda b/proofs/agda/EchoGradedComonadF1.agda index b69fc00f..00cc8b7a 100644 --- a/proofs/agda/EchoGradedComonadF1.agda +++ b/proofs/agda/EchoGradedComonadF1.agda @@ -59,6 +59,11 @@ mapD : ∀ r {A B} → (A → B) → D r A → D r B mapD zero f x = f x mapD (suc r) f (d , b) = mapD r f d , b +mapD-cong : ∀ r {A B} {f h : A → B} → + (∀ a → f a ≡ h a) → ∀ (x : D r A) → mapD r f x ≡ mapD r h x +mapD-cong zero eq x = eq x +mapD-cong (suc r) eq (d , b) = cong (_, b) (mapD-cong r eq d) + mapD-id : ∀ r {A} (x : D r A) → mapD r id x ≡ x mapD-id zero x = refl mapD-id (suc r) (d , b) = cong (_, b) (mapD-id r d) @@ -124,6 +129,26 @@ coe-D-irr p .p x e refl = refl δ (suc m) n {A} (x , b) ≡ (δ m n x , b) δ-suc m n {A} x b = coe-cong-R (D-+ m n A) x b +-- Naturality with respect to the explicitly defined functorial action. +-- These are structural proofs, not an appeal to polymorphism. +ε-natural : ∀ {A B} (f : A → B) (x : D 0 A) → + ε (mapD 0 f x) ≡ f (ε x) +ε-natural f x = refl + +δ-natural : ∀ m n {A B} (f : A → B) (x : D (m + n) A) → + δ m n (mapD (m + n) f x) ≡ mapD m (mapD n f) (δ m n x) +δ-natural zero n f x = refl +δ-natural (suc m) n f (d , b) = begin + δ (suc m) n (mapD (suc m + n) f (d , b)) + ≡⟨ δ-suc m n (mapD (m + n) f d) b ⟩ + (δ m n (mapD (m + n) f d) , b) + ≡⟨ cong (_, b) (δ-natural m n f d) ⟩ + (mapD m (mapD n f) (δ m n d) , b) + ≡⟨ sym (cong (mapD (suc m) (mapD n f)) (δ-suc m n d b)) ⟩ + mapD (suc m) (mapD n f) (δ (suc m) n (d , b)) + ∎ + where open ≡-Reasoning + ---------------------------------------------------------------------- -- LAW 1 — counit-right. e · r = 0 + r = r definitionally, so -- δ 0 r = coe refl = id and ε is id: the law is definitional. diff --git a/proofs/agda/EchoGradedComonadInstance1.agda b/proofs/agda/EchoGradedComonadInstance1.agda index fe7ad623..4ba63605 100644 --- a/proofs/agda/EchoGradedComonadInstance1.agda +++ b/proofs/agda/EchoGradedComonadInstance1.agda @@ -31,6 +31,9 @@ open import Data.Nat.Base using (ℕ; zero; suc; _+_) open import Data.Nat.Properties using (+-identityˡ; +-identityʳ; +-assoc) open import EchoGradedComonadInterface using (GradedComonadStructure) +import EchoGradedComonadF1 as F1 +open import EchoGradedComonadNaturality using (NaturalGradedComonad) +open import Relation.Binary.PropositionalEquality using (_≡_) open import EchoGradedComonadF1 using ( D ; mapD ; mapD-id ; mapD-∘ @@ -65,3 +68,29 @@ nat-instance = record ; gc-counit-l = gc-counit-l ; gc-coassoc = gc-coassoc } + +-- Explicit naturality witnesses for the packaged instance. The public +-- interface's choice of naturality fields is a separate design decision. +nat-ε-natural : ∀ {A B} (f : A → B) + (x : GradedComonadStructure.D nat-instance 0 A) → + GradedComonadStructure.ε nat-instance + (GradedComonadStructure.mapD nat-instance 0 f x) + ≡ f (GradedComonadStructure.ε nat-instance x) +nat-ε-natural = F1.ε-natural + +nat-δ-natural : ∀ m n {A B} (f : A → B) + (x : GradedComonadStructure.D nat-instance (m + n) A) → + GradedComonadStructure.δ nat-instance m n + (GradedComonadStructure.mapD nat-instance (m + n) f x) + ≡ GradedComonadStructure.mapD nat-instance m + (GradedComonadStructure.mapD nat-instance n f) + (GradedComonadStructure.δ nat-instance m n x) +nat-δ-natural = F1.δ-natural + +nat-natural-instance : NaturalGradedComonad nat-instance +nat-natural-instance = record + { mapD-cong = F1.mapD-cong + ; ε-natural = F1.ε-natural + ; δ-natural = F1.δ-natural + ; grade-isSet = F1.ℕ-uip + } diff --git a/proofs/agda/EchoGradedComonadInstance2.agda b/proofs/agda/EchoGradedComonadInstance2.agda index 815e81fa..94d67fac 100644 --- a/proofs/agda/EchoGradedComonadInstance2.agda +++ b/proofs/agda/EchoGradedComonadInstance2.agda @@ -46,6 +46,11 @@ open import Relation.Binary.PropositionalEquality using (_≡_; refl; sym; cong; subst; module ≡-Reasoning) open import EchoGradedComonadInterface using (GradedComonadStructure) +open import EchoGradedComonadNaturality using (NaturalGradedComonad) +open import Relation.Binary.Definitions using (DecidableEquality) +open import Relation.Nullary.Decidable using (yes; no) +import Data.List.Properties as ListP +import Axiom.UniquenessOfIdentityProofs as UIP ---------------------------------------------------------------------- -- Two-element grade index. @@ -84,6 +89,12 @@ mapD (big ∷ xs) f (d , n) = mapD xs f d , n ---------------------------------------------------------------------- -- Functor laws. +mapD-cong : ∀ xs {A B} {f h : A → B} → + (∀ a → f a ≡ h a) → ∀ (x : D xs A) → mapD xs f x ≡ mapD xs h x +mapD-cong [] eq x = eq x +mapD-cong (smol ∷ xs) eq (d , b) = cong (_, b) (mapD-cong xs eq d) +mapD-cong (big ∷ xs) eq (d , n) = cong (_, n) (mapD-cong xs eq d) + mapD-id : ∀ xs {A} (x : D xs A) → mapD xs id x ≡ x mapD-id [] x = refl mapD-id (smol ∷ xs) (d , b) = cong (_, b) (mapD-id xs d) @@ -149,6 +160,36 @@ coe-cong-R-big refl d n = refl δ (big ∷ xs) ys {A} (d , n) ≡ (δ xs ys d , n) δ-cons-big xs ys {A} d n = coe-cong-R-big (D-++ xs ys A) d n +-- Naturality follows by induction on the outer grade, preserving the +-- residue at each constructor; no free theorem is assumed. +ε-natural : ∀ {A B} (f : A → B) (x : D [] A) → + ε (mapD [] f x) ≡ f (ε x) +ε-natural f x = refl + +δ-natural : ∀ xs ys {A B} (f : A → B) (x : D (xs ++ ys) A) → + δ xs ys (mapD (xs ++ ys) f x) ≡ mapD xs (mapD ys f) (δ xs ys x) +δ-natural [] ys f x = refl +δ-natural (smol ∷ xs) ys f (d , b) = begin + δ (smol ∷ xs) ys (mapD ((smol ∷ xs) ++ ys) f (d , b)) + ≡⟨ δ-cons-smol xs ys (mapD (xs ++ ys) f d) b ⟩ + (δ xs ys (mapD (xs ++ ys) f d) , b) + ≡⟨ cong (_, b) (δ-natural xs ys f d) ⟩ + (mapD xs (mapD ys f) (δ xs ys d) , b) + ≡⟨ sym (cong (mapD (smol ∷ xs) (mapD ys f)) (δ-cons-smol xs ys d b)) ⟩ + mapD (smol ∷ xs) (mapD ys f) (δ (smol ∷ xs) ys (d , b)) + ∎ + where open ≡-Reasoning +δ-natural (big ∷ xs) ys f (d , n) = begin + δ (big ∷ xs) ys (mapD ((big ∷ xs) ++ ys) f (d , n)) + ≡⟨ δ-cons-big xs ys (mapD (xs ++ ys) f d) n ⟩ + (δ xs ys (mapD (xs ++ ys) f d) , n) + ≡⟨ cong (_, n) (δ-natural xs ys f d) ⟩ + (mapD xs (mapD ys f) (δ xs ys d) , n) + ≡⟨ sym (cong (mapD (big ∷ xs) (mapD ys f)) (δ-cons-big xs ys d n)) ⟩ + mapD (big ∷ xs) (mapD ys f) (δ (big ∷ xs) ys (d , n)) + ∎ + where open ≡-Reasoning + subst-D-cons-smol : ∀ {A} {js ks : List Tag} (p : js ≡ ks) (d : D js A) (b : Bool) → subst (λ ts → D ts A) (cong (smol ∷_) p) (d , b) @@ -293,3 +334,37 @@ list-instance = record ; gc-counit-l = gc-counit-l ; gc-coassoc = gc-coassoc } + +-- These witnesses refer directly to the packaged record's projections. +list-ε-natural : ∀ {A B} (f : A → B) + (x : GradedComonadStructure.D list-instance [] A) → + GradedComonadStructure.ε list-instance + (GradedComonadStructure.mapD list-instance [] f x) + ≡ f (GradedComonadStructure.ε list-instance x) +list-ε-natural = ε-natural + +list-δ-natural : ∀ xs ys {A B} (f : A → B) + (x : GradedComonadStructure.D list-instance (xs ++ ys) A) → + GradedComonadStructure.δ list-instance xs ys + (GradedComonadStructure.mapD list-instance (xs ++ ys) f x) + ≡ GradedComonadStructure.mapD list-instance xs + (GradedComonadStructure.mapD list-instance ys f) + (GradedComonadStructure.δ list-instance xs ys x) +list-δ-natural = δ-natural + +tag-equality : DecidableEquality Tag +tag-equality smol smol = yes refl +tag-equality smol big = no (λ ()) +tag-equality big smol = no (λ ()) +tag-equality big big = yes refl + +list-grade-isSet : ∀ {xs ys : List Tag} (p q : xs ≡ ys) → p ≡ q +list-grade-isSet = UIP.Decidable⇒UIP.≡-irrelevant (ListP.≡-dec tag-equality) + +list-natural-instance : NaturalGradedComonad list-instance +list-natural-instance = record + { mapD-cong = mapD-cong + ; ε-natural = ε-natural + ; δ-natural = δ-natural + ; grade-isSet = list-grade-isSet + } diff --git a/proofs/agda/EchoGradedComonadInterface.agda b/proofs/agda/EchoGradedComonadInterface.agda index 90c19038..2f42fe5e 100644 --- a/proofs/agda/EchoGradedComonadInterface.agda +++ b/proofs/agda/EchoGradedComonadInterface.agda @@ -13,20 +13,12 @@ -- `gc-coassoc`) stated against the monoid's propositional identities -- via `subst` along `·G-identityʳ` / `·G-identityˡ` / `·G-assoc`. -- --- F3 guardrail (earn-back-plan.adoc §F3): the record carries no --- field equivalent to the retracted `⊑-prop` from `EchoGraded`. The --- abstraction is structural and equational only — no order, no --- propositionality-of-the-grade-relation hypothesis, nothing that --- bakes in a single load-bearing thinness assumption. Inspection: --- the field list below is exactly the structure, the monoid laws, --- and the comonad laws — anything more would be over-claiming. --- --- This module on its own does NOT pass F3; F3 passes when at least --- two non-isomorphic-grade-monoid instances satisfy this record. --- Instance 1 = `EchoGradedComonadInstance1.agda` (the F1 --- iterated-residue construction at `(ℕ, +, 0)`). Instance 2 (at e.g. --- the free monoid `(List X, ++, [])` over a non-trivial `X`) is --- phase 2, separate follow-up. +-- Compatible algebraic interface for a monoid-indexed carrier and pointwise +-- functor and comonad equations. Naturality and congruence for pointwise +-- function equality are supplied separately by NaturalGradedComonad in +-- EchoGradedComonadNaturality; this record alone does not assert them. +-- Neither record assumes a grade order or thinness of a grade relation. +-- The nat and list instances package both records explicitly. module EchoGradedComonadInterface where @@ -35,11 +27,9 @@ open import Relation.Binary.PropositionalEquality using (_≡_; refl; subst) ---------------------------------------------------------------------- --- The interface record. --- --- Universe-polymorphic over the grade type `G`. The carrier `D` is --- `Set`-valued (matching F1) to keep the record proof-irrelevant --- about universe choices for the wrapped types. +-- The grade carrier G and D's arguments/results live in Set; the record +-- itself lives in Set₁. This interface is not universe polymorphic. +---------------------------------------------------------------------- record GradedComonadStructure : Set₁ where field @@ -75,7 +65,7 @@ record GradedComonadStructure : Set₁ where -- -- Stated against the monoid's PROPOSITIONAL identities via -- `subst` along the corresponding equation. For the ℕ instance - -- this reduces (the equations are refl) and the substs vanish; + -- left-unit reduces definitionally; right-unit and associativity do not. -- for an arbitrary monoid (e.g. List concatenation), the -- propositional form is what is provable in general. -------------------------------------------------------------- diff --git a/proofs/agda/EchoGradedComonadNaturality.agda b/proofs/agda/EchoGradedComonadNaturality.agda new file mode 100644 index 00000000..24ae281e --- /dev/null +++ b/proofs/agda/EchoGradedComonadNaturality.agda @@ -0,0 +1,21 @@ +{-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} + +module EchoGradedComonadNaturality where + +open import Relation.Binary.PropositionalEquality using (_≡_) +open import EchoGradedComonadInterface using (GradedComonadStructure) + +-- Companion to the existing API. Morphisms are functions with pointwise +-- equality; no function extensionality or UIP for arbitrary types is used. +record NaturalGradedComonad (S : GradedComonadStructure) : Set₁ where + open GradedComonadStructure S + field + mapD-cong : ∀ g {A B} {f h : A → B} → + (∀ a → f a ≡ h a) → ∀ (x : D g A) → mapD g f x ≡ mapD g h x + ε-natural : ∀ {A B} (f : A → B) (x : D 1G A) → + ε (mapD 1G f x) ≡ f (ε x) + δ-natural : ∀ g h {A B} (f : A → B) (x : D (g ·G h) A) → + δ g h (mapD (g ·G h) f x) ≡ mapD g (mapD h f) (δ g h x) + -- Equality of grades alone is proof irrelevant. This does not assert + -- proof irrelevance for values, residues, or every type in Set. + grade-isSet : ∀ {g h : G} (p q : g ≡ h) → p ≡ q diff --git a/proofs/agda/EchoHaplotypeCollapsing.agda b/proofs/agda/EchoHaplotypeCollapsing.agda index a7c90b05..faf335c2 100644 --- a/proofs/agda/EchoHaplotypeCollapsing.agda +++ b/proofs/agda/EchoHaplotypeCollapsing.agda @@ -26,7 +26,7 @@ -- -- For the Nickel / Julia / JEG pipeline, see the companion docs: -- docs/echo-types/applications/haplotype-collapsing.adoc --- docs/echo-types/applications/haplotype-collapsing.k9.ncl +-- docs/echo-types/applications/haplotype-collapsing.k9.ncl.in (inert documentation specimen) -- docs/echo-types/applications/haplotype-collapsing.jl -- -- Related: EchoAggregation (general monoid form), EchoChoreo (role order), diff --git a/proofs/agda/EchoNaturalityIndependence.agda b/proofs/agda/EchoNaturalityIndependence.agda new file mode 100644 index 00000000..3c638418 --- /dev/null +++ b/proofs/agda/EchoNaturalityIndependence.agda @@ -0,0 +1,117 @@ +{-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} + +module EchoNaturalityIndependence where + +open import Data.Bool.Base using (Bool; true; false; not) +open import Data.Unit.Base using (⊤; tt) +open import Data.Empty using (⊥) +open import Function.Base using (id; _∘_) +open import Relation.Binary.PropositionalEquality using (_≡_; refl; sym; trans; cong) + +-- A categorical independence countermodel, not an inhabitant of the +-- polymorphic Set → Set interface GradedComonadStructure. There is one +-- object and its endomorphisms are all Boolean functions. No type case +-- analysis or polymorphic Boolean negation is being assumed. +Obj : Set +Obj = ⊤ + +Endo : Set +Endo = Bool → Bool + +Hom : Obj → Obj → Set +Hom _ _ = Endo + +infix 4 _≈_ +_≈_ : Endo → Endo → Set +f ≈ g = ∀ b → f b ≡ g b + +≈-refl : ∀ {f} → f ≈ f +≈-refl b = refl + +≈-sym : ∀ {f g} → f ≈ g → g ≈ f +≈-sym p b = sym (p b) + +≈-trans : ∀ {f g h} → f ≈ g → g ≈ h → f ≈ h +≈-trans p q b = trans (p b) (q b) + +compose-cong : ∀ {f f′ g g′ : Endo} → f ≈ f′ → g ≈ g′ → + (f ∘ g) ≈ (f′ ∘ g′) +compose-cong {f′ = f′} {g = g} p q b = trans (p (g b)) (cong f′ (q b)) + +identity-left : ∀ (f : Endo) → (id ∘ f) ≈ f +identity-left f b = refl + +identity-right : ∀ (f : Endo) → (f ∘ id) ≈ f +identity-right f b = refl + +composition-assoc : ∀ (f g h : Endo) → ((f ∘ g) ∘ h) ≈ (f ∘ (g ∘ h)) +composition-assoc f g h b = refl + +-- The singleton grade monoid and identity endofunctor. +Grade : Set +Grade = ⊤ + +unit : Grade +unit = tt + +infixl 6 _∙_ +_∙_ : Grade → Grade → Grade +_ ∙ _ = tt + +grade-left-unit : ∀ g → unit ∙ g ≡ g +grade-left-unit tt = refl + +grade-right-unit : ∀ g → g ∙ unit ≡ g +grade-right-unit tt = refl + +grade-assoc : ∀ g h k → (g ∙ h) ∙ k ≡ g ∙ (h ∙ k) +grade-assoc g h k = refl + +D₀ : Grade → Obj → Obj +D₀ _ o = o + +mapD : Grade → Endo → Endo +mapD _ f = f + +mapD-cong : ∀ g {f h} → f ≈ h → mapD g f ≈ mapD g h +mapD-cong g p = p + +mapD-id : ∀ g → mapD g id ≈ id +mapD-id g b = refl + +mapD-compose : ∀ g (f h : Endo) → mapD g (f ∘ h) ≈ (mapD g f ∘ mapD g h) +mapD-compose g f h b = refl + +ε : Endo +ε = not + +δ : Grade → Grade → Endo +δ _ _ = not + +not-involutive : ∀ b → not (not b) ≡ b +not-involutive true = refl +not-involutive false = refl + +counit-right : ∀ g → (ε ∘ δ unit g) ≈ id +counit-right g = not-involutive + +counit-left : ∀ g → (mapD g ε ∘ δ g unit) ≈ id +counit-left g = not-involutive + +coassoc : ∀ g h k → (δ g h ∘ δ (g ∙ h) k) ≈ + (mapD g (δ h k) ∘ δ g (h ∙ k)) +coassoc g h k b = refl + +constant-true : Endo +constant-true _ = true + +-- Both proposed naturality squares fail on the same endomorphism. +ε-naturality-fails : ((ε ∘ mapD unit constant-true) ≈ (constant-true ∘ ε)) → ⊥ +ε-naturality-fails natural with natural true +... | () + +δ-naturality-fails : ∀ g h → + ((δ g h ∘ mapD (g ∙ h) constant-true) ≈ + (mapD g (mapD h constant-true) ∘ δ g h)) → ⊥ +δ-naturality-fails g h natural with natural true +... | () diff --git a/proofs/agda/EchoNoSectionGeneric.agda b/proofs/agda/EchoNoSectionGeneric.agda index 3ac5b58e..7adc92cf 100644 --- a/proofs/agda/EchoNoSectionGeneric.agda +++ b/proofs/agda/EchoNoSectionGeneric.agda @@ -93,6 +93,9 @@ private variable ---------------------------------------------------------------------- no-section-of-collapsing-map : + -- Historical "no-section" names in this module negate a LEFT inverse + -- of lower (exact recovery). They do not negate a right inverse of + -- lower; EchoCharacteristic exhibits both directions explicitly. (lower : A → R) (e₁ e₂ : A) (e₁≢e₂ : e₁ ≢ e₂) diff --git a/proofs/agda/EchoResidue.agda b/proofs/agda/EchoResidue.agda index e7715697..b25f92ac 100644 --- a/proofs/agda/EchoResidue.agda +++ b/proofs/agda/EchoResidue.agda @@ -50,6 +50,15 @@ collapse-residue-same : collapse-to-residue echo-true ≡ collapse-to-residue echo-false collapse-residue-same = refl +-- Choosing a representative gives a right inverse of lowering, even +-- though exact recovery of every original Echo has no left inverse. +collapse-residue-raise : EchoR ⊤ TrivialCert tt → Echo collapse tt +collapse-residue-raise _ = echo-true + +collapse-residue-right-inverse : ∀ r → + collapse-to-residue (collapse-residue-raise r) ≡ r +collapse-residue-right-inverse (tt , tt) = refl + -- No section exists that recovers the original full echo after lowering. no-section-collapse-to-residue : ¬ (Σ (EchoR ⊤ TrivialCert tt → Echo collapse tt) diff --git a/proofs/agda/EchoResidueCell.agda b/proofs/agda/EchoResidueCell.agda index d5761b1a..0df83909 100644 --- a/proofs/agda/EchoResidueCell.agda +++ b/proofs/agda/EchoResidueCell.agda @@ -9,11 +9,11 @@ -- `ResidueCell f y` that is either `Holding` a residue or `Spent`. -- `takeForReverse` replays a Holding cell (recovering the input) and returns -- `nothing` on a Spent cell; consuming a cell transitions it Holding → Spent, --- so a residue reverses AT MOST ONCE. +-- so reading the RETURNED consumed state yields nothing. -- -- The Idris version enforces once-only via the LINEAR quantity `(1 e : Echo f --- y)`. Agda has no such quantity under `--safe`, so this module enforces it --- via the STATE MACHINE instead: `consume` makes the cell `Spent`, and +-- y)`. This ordinary Agda datatype does not enforce linear usage: +-- `consume` returns a `Spent` value, and -- `once-only` proves that a second `takeForReverse` after `consume` is always -- `nothing`. This is the operational half that `EchoReversibilityBridge` -- deferred as "runtime Holding/Spent bookkeeping": the bridge's @@ -21,10 +21,10 @@ -- it is the partial `ResidueCell f y → Maybe A` with the cell carrying the -- Holding/Spent state. -- --- Honest scope: this captures the once-PER-CELL discipline operationally. It +-- Scope: this captures read-after-consume for the returned state. It -- does NOT model linear NON-DUPLICATION (nothing stops a caller copying a --- `holding` cell before consuming) — that needs the `(1 e)` quantity / an --- `@0`-style erasure encoding and remains the documented next slice. +-- `holding` cell before consuming). Enforced single use needs an explicit +-- usage discipline and a separate refinement argument. {-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} @@ -79,10 +79,8 @@ consume-spends : {f : A → B} {y : B} (e : Echo f y) → consume-spends _ = refl -- THE once-only theorem: after consuming ANY cell, a further `takeForReverse` --- is always `nothing` — a residue reverses at most once. This is the --- state-machine form of the Idris `(1 e)` linear-consumption guarantee, and --- the operational content of 007's cross-handler "once-only" property that --- the rung-3b *static* check could only approximate by presence. +-- on the returned state is always `nothing`. The original holding value +-- can still be retained and read again; this law does not enforce one use. once-only : {f : A → B} {y : B} (c : ResidueCell f y) → takeForReverse (consume c) ≡ nothing once-only (holding _) = refl diff --git a/proofs/agda/EchoReversibilityBridge.agda b/proofs/agda/EchoReversibilityBridge.agda index 23e45db8..a7e9b778 100644 --- a/proofs/agda/EchoReversibilityBridge.agda +++ b/proofs/agda/EchoReversibilityBridge.agda @@ -1,9 +1,9 @@ -- SPDX-License-Identifier: MPL-2.0 -- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -- --- EchoReversibilityBridge: the constructive discharge of the 007 language's --- Layer-10 reversibility (echo-residue) "phase-2" proof obligations against --- this library of record. +-- EchoReversibilityBridge: retained-witness recovery and a concrete +-- weakening obstruction in Agda. These statements do not establish +-- refinement of the 007 Rust/Idris implementations or enforced linear use. -- -- 007 (https://github.com/hyperpolymath/007) models reversibility with an -- echo residue: `reversible as ` arms a residue cell holding an @@ -23,7 +23,8 @@ -- This module re-states the *interface* those obligations describe and shows -- echo-types' own `Echo` / `EchoTotalCompletion` / `EchoLinear` satisfy it, -- under `--safe --without-K` with zero postulates. The Agda here is the --- source of truth; 007's Rust checker and Idris2 spec mirror this model. +-- checked model here; implementation correspondence requires a separate +-- simulation/refinement argument and an explicit consumption discipline. {-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} @@ -50,7 +51,7 @@ private variable -- The minimal data 007's reversibility model needs from a residue carrier: -- arm a residue from an input (`hold`), take-it-for-reverse to recover an --- input (`takeForReverse`), and the once-only correctness that replaying a +-- input (`takeForReverse`), and the recovery correctness that replaying a -- freshly-armed residue returns the original input (`reverse-recovers`). -- -- `takeForReverse` here is the *total* `Just`-branch of 007's @@ -88,7 +89,7 @@ reversibility-via-totality f = mk↔ₛ′ (decode f) (encode f) (decode-encode f) (encode-decode f) ------------------------------------------------------------------------ --- Obligation 3: the phase-2 linear discipline. +-- A concrete weakening map; linear usage is not enforced by these types. ------------------------------------------------------------------------ -- "Affine capability": a live (linear) undo residue may always be weakened @@ -96,11 +97,9 @@ reversibility-via-totality f = capability-can-be-dropped : LEcho linear → LEcho affine capability-can-be-dropped = weaken --- "Linear consumption / Spent-does-not-reverse": there is NO section of --- `weaken` — once the residue is degraded (the undo dropped, the cell --- `Spent`) the linear residue cannot be recovered. This is echo-types' --- `no-section-weaken`, the library-of-record discharge of the irreversibility --- of dropping the capability. +-- There is no input-reconstructing LEFT inverse of this weakening map. +-- This excludes uniform recovery from its output alone. It does not +-- prevent retaining or duplicating the original Agda input value. no-recovery-once-dropped : ¬ (Σ (LEcho affine → LEcho linear) (λ raise → ∀ e → raise (weaken e) ≡ e)) diff --git a/proofs/agda/EchoSeparating.agda b/proofs/agda/EchoSeparating.agda index dac95b10..c7488a3e 100644 --- a/proofs/agda/EchoSeparating.agda +++ b/proofs/agda/EchoSeparating.agda @@ -2,35 +2,14 @@ -- SPDX-License-Identifier: MPL-2.0 -- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell --- Pillar C of docs/echo-types/establishment-plan.adoc. --- --- REAL MODULE (separating model landed 2026-05-17). --- --- Goal: a SEPARATING MODEL. The only objection every referee raises --- is "isn't this all Σ-lemmas with renamed components?" The --- gold-standard answer is a model in which the *generic* Σ/Echo --- functoriality laws (`Echo.map-over-id` / `map-over-comp`) still --- hold, yet the *characteristic* loss-grade composition law --- `EchoGraded.degrade-compose` (equivalently `degrade-via-join`) --- FAILS — at a concrete, decidable witness. That proves the graded --- family is genuine structure, not bookkeeping. --- --- The precise pin. `EchoGraded.degrade-compose` holds for exactly --- one reason: `≤g-prop` — the loss order `_≤g_` is propositional, so --- the chosen factoring `p12 ∙ p23` and the direct `p13` are forced --- equal, and `degrade-comp` then closes it. This model is `EchoGraded` --- with that single hypothesis removed: a "loss order" `_⊑_` with TWO --- distinct arrows `s₀ , s₁ : lo ⊑ hi` (so `sep-order-not-prop`), a --- reindexing `deg` that distinguishes them (`s₀ ↦ id`, `s₁ ↦ not`). --- Nothing else changes; in particular the Σ/`map-over` layer is the --- *same generic layer* and its laws still hold here (`sep-map-over-*`). --- The path-independence law breaks (`sep-degrade-compose-fails`). --- --- This continues the negative-exhibit discipline of --- `characteristic/VisibleConstraintAudit.agda` / --- `characteristic/IntegrationAudit.agda` (collapsing pseudo-theorems --- to `proj₂`), but in the positive direction: an explicit --- countermodel object, with the failure a checked `true ≢ false`. +-- Walking parallel-arrow category with a lawful pointwise action. +-- Its two distinct lo → hi arrows act by identity and Boolean negation. +-- sep-compose and sep-deg-comp prove composition is functorial. +-- SepDegradeCompose instead compares a composite with an arbitrary direct +-- arrow: sep-degrade-compose-fails refutes that arrow-independence claim. +-- The ordinary Sigma/Echo map-over laws continue to hold. This separates +-- thinness-dependent path independence from ordinary functoriality; it +-- does not refute functoriality or category composition without thinness. module EchoSeparating where @@ -70,6 +49,64 @@ deg rfl-hi b = b deg s₀ b = b deg s₁ b = not b +-- Ordinary composition retains the choice of parallel arrow. It does +-- not identify an arbitrary direct arrow with the chosen composite. +sep-id : (g : G) → g ⊑ g +sep-id lo = rfl-lo +sep-id hi = rfl-hi + +sep-compose : ∀ {g₁ g₂ g₃} → g₁ ⊑ g₂ → g₂ ⊑ g₃ → g₁ ⊑ g₃ +sep-compose rfl-lo rfl-lo = rfl-lo +sep-compose rfl-lo s₀ = s₀ +sep-compose rfl-lo s₁ = s₁ +sep-compose s₀ rfl-hi = s₀ +sep-compose s₁ rfl-hi = s₁ +sep-compose rfl-hi rfl-hi = rfl-hi + +sep-compose-idˡ : ∀ {g₁ g₂} (p : g₁ ⊑ g₂) → + sep-compose (sep-id g₁) p ≡ p +sep-compose-idˡ rfl-lo = refl +sep-compose-idˡ rfl-hi = refl +sep-compose-idˡ s₀ = refl +sep-compose-idˡ s₁ = refl + +sep-compose-idʳ : ∀ {g₁ g₂} (p : g₁ ⊑ g₂) → + sep-compose p (sep-id g₂) ≡ p +sep-compose-idʳ rfl-lo = refl +sep-compose-idʳ rfl-hi = refl +sep-compose-idʳ s₀ = refl +sep-compose-idʳ s₁ = refl + +sep-compose-assoc : ∀ {g₁ g₂ g₃ g₄} + (p : g₁ ⊑ g₂) (q : g₂ ⊑ g₃) (r : g₃ ⊑ g₄) → + sep-compose (sep-compose p q) r ≡ sep-compose p (sep-compose q r) +sep-compose-assoc rfl-lo rfl-lo rfl-lo = refl +sep-compose-assoc rfl-lo rfl-lo s₀ = refl +sep-compose-assoc rfl-lo rfl-lo s₁ = refl +sep-compose-assoc rfl-lo s₀ rfl-hi = refl +sep-compose-assoc rfl-lo s₁ rfl-hi = refl +sep-compose-assoc s₀ rfl-hi rfl-hi = refl +sep-compose-assoc s₁ rfl-hi rfl-hi = refl +sep-compose-assoc rfl-hi rfl-hi rfl-hi = refl + +-- Pointwise action laws need no equality principle for functions. +sep-deg-id : ∀ g (e : Obj g) → deg (sep-id g) e ≡ e +sep-deg-id lo e = refl +sep-deg-id hi e = refl + +sep-deg-comp : ∀ {g₁ g₂ g₃} + (p : g₁ ⊑ g₂) (q : g₂ ⊑ g₃) (e : Obj g₁) → + deg q (deg p e) ≡ deg (sep-compose p q) e +sep-deg-comp rfl-lo rfl-lo e = refl +sep-deg-comp rfl-lo s₀ e = refl +sep-deg-comp rfl-lo s₁ e = refl +sep-deg-comp s₀ rfl-hi e = refl +sep-deg-comp s₁ rfl-hi e = refl +sep-deg-comp rfl-hi rfl-hi e = refl + +sep-parallel-actions-distinct : ¬ (deg s₀ true ≡ deg s₁ true) +sep-parallel-actions-distinct () + ---------------------------------------------------------------------- -- The loss order here is NOT propositional. This is the *single* -- hypothesis whose presence (`EchoGraded.≤g-prop`) makes @@ -112,7 +149,7 @@ sep-map-over-comp : sep-map-over-comp e = map-over-comp not (λ _ → refl) not (λ _ → refl) e ---------------------------------------------------------------------- --- The characteristic law FAILS. +-- Independence from an arbitrary direct arrow FAILS. -- -- `SepDegradeCompose` is `EchoGraded.degrade-compose` transcribed -- with `_⊑_` / `deg` for `_≤g_` / `degrade`. It is refuted at the diff --git a/proofs/agda/EchoSourcePreserving.agda b/proofs/agda/EchoSourcePreserving.agda new file mode 100644 index 00000000..0b8f8d3e --- /dev/null +++ b/proofs/agda/EchoSourcePreserving.agda @@ -0,0 +1,73 @@ +{-# OPTIONS --safe --without-K --cubical-compatible #-} +-- SPDX-License-Identifier: MPL-2.0 +-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell + +module EchoSourcePreserving where + +open import Level using (Level) +open import Data.Product.Base using (Σ; _,_; proj₁; proj₂) +open import Data.Bool.Base using (Bool; true; false; not) +open import Data.Empty using (⊥) +open import Relation.Binary.PropositionalEquality using (_≡_; refl; sym; trans) +open import Echo using (Echo; echo-intro) + +-- Fibre equivalence alone forgets which source supplied an observation. +record FibreIso {a : Level} {A : Set a} (f g : A → A) : Set a where + field + to : ∀ {y} → Echo f y → Echo g y + from : ∀ {y} → Echo g y → Echo f y + from-to : ∀ {y} (e : Echo f y) → from (to e) ≡ e + to-from : ∀ {y} (e : Echo g y) → to (from e) ≡ e + +SourcePreserving : ∀ {a} {A : Set a} {f g : A → A} → FibreIso f g → Set a +SourcePreserving {f = f} i = ∀ {y} (e : Echo f y) → proj₁ (FibreIso.to i e) ≡ proj₁ e + +-- Only the forward map and its source equation are needed for this direction. +source-preserving-implies-identity : + ∀ {a} {A : Set a} {f : A → A} + (i : FibreIso f (λ x → x)) → SourcePreserving i → ∀ x → f x ≡ x +source-preserving-implies-identity {f = f} i preserves x = + trans (sym (proj₂ (FibreIso.to i (echo-intro f x)))) + (preserves (echo-intro f x)) + +cancel-left : ∀ {a} {A : Set a} {x y z : A} + (p : x ≡ y) (q : y ≡ z) → trans (sym p) (trans p q) ≡ q +cancel-left refl q = refl + +cancel-right : ∀ {a} {A : Set a} {x y z : A} + (p : x ≡ y) (q : x ≡ z) → trans p (trans (sym p) q) ≡ q +cancel-right refl q = refl + +identity-fibre-iso : ∀ {a} {A : Set a} {f : A → A} → + (∀ x → f x ≡ x) → FibreIso f (λ x → x) +identity-fibre-iso h = record + { to = λ { (x , p) → x , trans (sym (h x)) p } + ; from = λ { (x , p) → x , trans (h x) p } + ; from-to = λ { (x , p) → pair-cong (cancel-right (h x) p) } + ; to-from = λ { (x , p) → pair-cong (cancel-left (h x) p) } + } + where + pair-cong : ∀ {a b} {X : Set a} {P : X → Set b} {x : X} {p q : P x} → + p ≡ q → _≡_ {A = Σ X P} (x , p) (x , q) + pair-cong refl = refl + +identity-fibre-iso-preserves-source : ∀ {a} {A : Set a} {f : A → A} + (h : ∀ x → f x ≡ x) → SourcePreserving (identity-fibre-iso h) +identity-fibre-iso-preserves-source h e = refl + +-- Counterexample to the unqualified fibre-equivalence identity criterion. +negation-fibre-iso : FibreIso not (λ x → x) +negation-fibre-iso = record + { to = λ { (true , p) → false , p ; (false , p) → true , p } + ; from = λ { (true , p) → false , p ; (false , p) → true , p } + ; from-to = λ { (true , p) → refl ; (false , p) → refl } + ; to-from = λ { (true , p) → refl ; (false , p) → refl } + } + +negation-not-identity : (∀ x → not x ≡ x) → ⊥ +negation-not-identity h with h true +... | () + +negation-iso-not-source-preserving : SourcePreserving negation-fibre-iso → ⊥ +negation-iso-not-source-preserving preserves = + negation-not-identity (source-preserving-implies-identity negation-fibre-iso preserves) diff --git a/proofs/agda/EchoThinPreorderExample.agda b/proofs/agda/EchoThinPreorderExample.agda new file mode 100644 index 00000000..78285b8f --- /dev/null +++ b/proofs/agda/EchoThinPreorderExample.agda @@ -0,0 +1,26 @@ +{-# OPTIONS --safe --without-K --cubical-compatible --exact-split --no-sized-types --no-guardedness #-} + +module EchoThinPreorderExample where + +open import Level using (0ℓ) +open import Data.Bool.Base using (Bool; true; false) +open import Data.Unit.Base using (⊤; tt) +open import Data.Empty using (⊥) +open import Relation.Binary.PropositionalEquality using (_≡_; refl) +open import Echo.Index.ThinPoset using (ThinPoset) + +-- The legacy record requires a thin preorder, but no antisymmetry law. +-- Its name therefore does not justify equality of mutually reachable objects. +indiscrete : ThinPoset 0ℓ 0ℓ +indiscrete = record + { Ix = Bool + ; _≤_ = λ _ _ → ⊤ + ; ≤-refl = tt + ; ≤-trans = λ _ _ → tt + ; ≤-thin = λ { tt tt → refl } + } + +no-antisymmetry : + (∀ (a b : Bool) → ⊤ → ⊤ → a ≡ b) → ⊥ +no-antisymmetry antisym with antisym true false tt tt +... | () diff --git a/proofs/agda/EchoTotalCompletion.agda b/proofs/agda/EchoTotalCompletion.agda index dc490acf..52c0e194 100644 --- a/proofs/agda/EchoTotalCompletion.agda +++ b/proofs/agda/EchoTotalCompletion.agda @@ -149,6 +149,8 @@ f-factors-via-projection _ _ = refl -- proj₁ ∘ encode f ≡ f -- pointwise, definitionally. Pinned separately because downstream -- (OFS) wants this direction explicitly. +-- Legacy name: this is a commuting/factorization equation, not in general +-- a section of proj₁. Its right-hand side is f x, not the identity at x. encode-is-section-of-proj₁ : (f : A → B) (x : A) → proj₁ (encode f x) ≡ f x encode-is-section-of-proj₁ _ _ = refl diff --git a/proofs/agda/EchoVariance.agda b/proofs/agda/EchoVariance.agda index 963fdef7..8467d5fa 100644 --- a/proofs/agda/EchoVariance.agda +++ b/proofs/agda/EchoVariance.agda @@ -2,79 +2,29 @@ -- SPDX-License-Identifier: MPL-2.0 -- SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell --- EchoVariance — resolving, IN --safe AGDA RATHER THAN ASSERTED, the --- monad / comonad / adjunction variance of loss accumulation. +-- EchoVariance: fibre composition, retained-witness recovery, and the +-- iterated-product split/merge equivalence. These are the statements below. +-- They do not supply the categorical data for a tropical graded monad. -- --- THE LIVE QUESTION (the new understanding of echo-types). An echo-type --- is a tropically-graded modality of structured information loss: an --- instance of graded-(co)monad machinery over the min-plus semiring --- (ℕ ∪ {∞}, min, +), with recoverability "exact on a homotopy fibre --- rather than over-approximating or complement-storing". Its precise --- variance was unsettled: the *combining* direction of loss is monadic --- (accumulation is μ : D_r (D_s A) → D_{r+s} A), so is the right word --- "graded comonad", "graded monad", or "graded adjunction (with the --- section as unit/counit)"? R-2026-05-18 (docs/retractions.adoc) --- already RETRACTED the unqualified "graded comonad" claim on --- `EchoGradedComonad`, reframing it as a loss-graded *reindexing* --- modality with NO nested D_r D_s. This module supplies the nested maps --- the question is actually about, and lets the type-checker decide. +-- The core fibre is standard dependent-sum mathematics. Accumulation and +-- splitting are inverse for specified maps f and g. Total completion has +-- no grade parameter and recovers the source stored in the fibre witness. +-- Its round trips alone are not an adjunction; EchoDependentPushforward +-- supplies the separate dependent-pushforward/reindexing adjunction. -- --- HOW THE TROPICAL SEMIRING SPLITS ACROSS THE TWO AXES (already the --- repo's architecture): --- * min (⊕, the order / lattice) is the thin echo INDEX --- (`Echo.Index.ThinPoset`); `degrade` reindexes along it. This is the --- proof-relevant modality CORE, deliberately semiring-free. --- * + (⊗, accumulation) is the residue MEASURE (`Echo.Measure.*`), a --- lossy, monotone OBSERVATION. The accumulation μ : D_r D_s → D_{r+s} --- the live question names lives on THIS axis. +-- no-bare-recovery forbids a LEFT inverse of a particular Boolean collapse. +-- It does not forbid graded comonads: EchoErasingGradedComonad gives a +-- natural graded comonad whose positive-grade carriers erase the input. +-- Its counit is required only at the unit grade. -- --- THE VERDICT (each clause proved below, not asserted): +-- F1 supplies an iterated-product model. The split/merge inverse laws below +-- do not themselves package a graded monad. Naturality for its graded +-- comonad is certified separately by EchoGradedComonadNaturality and the +-- concrete instance modules. Ordered/tropical compatibility needs its own +-- explicitly specified laws; it is not a consequence of these map shapes. -- --- (1) ACCUMULATION IS MONADIC. The combining map μ on the genuine --- (fibre) loss modality — nested loss → combined loss — is total --- and CANONICAL: it is definable from the layered data alone (the --- factoring is its input). `accumulate` = `Echo-comp-iso-from`. --- This is the graded-monad multiplication shape; the loss --- magnitudes add. --- --- (2) RECOVERABILITY IS EXACT ON THE FIBRE. For a FIXED factoring, --- accumulate and split are mutually inverse (both round-trips --- `refl`): the fibre stores the loss precisely — not over- --- approximating, not complement-storing. At grade 0 this is the --- totality iso `A ↔ Σ B (Echo f)` (`recoverable-fibre`): the --- section/retraction pair, i.e. the unit/counit of the ADJUNCTION --- reading. --- --- (3) THE COMONAD DIRECTION FAILS FOR GENUINE LOSS. A graded comonad --- would supply a NATURAL δ on the BARE residual functor: recover the --- intermediate/layered data from a residue WITHOUT being handed a --- factoring. For genuine loss that is exactly the irreversibility --- obstruction: the canonical collapse has NO section --- (`no-bare-recovery`). The forgotten bit is retained ON THE FIBRE --- (`fibre-retains-lost-bit`) but is NOT a recoverable complement of --- the residue. --- --- (4) THE "GRADED COMONAD" READING IS THE COMPLEMENT-STORING NEIGHBOUR. --- `EchoGradedComonadF1` IS a genuine nested graded comonad — but its --- model `D r A = A × Boolʳ` RETAINS its residue layers, so its δ is --- `coe` along a TYPE EQUALITY `D (m+n) A ≡ D m (D n A)`, hence --- INVERTIBLE. We exhibit the inverse `μ-writer` and prove both --- round-trips: the writer is simultaneously a graded comonad AND a --- graded monad. That bi-directionality is the signature of a --- COMPLEMENT-STORING (resource / coeffect) modality — precisely what --- the new understanding says echo-types is NOT. --- --- ONE-LINE RESOLUTION. Echo-types (fibre-based loss) is a GRADED MONAD of --- accumulation (the + axis) together with a section/retraction ADJUNCTION --- that is exact on the grade-0 fibre; it is NOT a graded comonad — the --- comonad reading silently substitutes the complement-storing writer, --- which is lossless. The min axis (order / `degrade`) carries the --- reindexing modality; the + axis (accumulation) carries the monad. --- --- --safe --without-K, zero postulates. Everything reuses existing kernel --- theorems (`Echo-comp-iso`, `no-section-of-collapsing-map`, `A↔ΣEcho`, --- and F1's `δ`/`D-+`/`coe`); nothing here is new trust. - +-- Legacy theorem names are retained for API compatibility. The NotProved +-- markers below are unit-valued documentation markers, not theorem proofs. module EchoVariance where open import Level using (Level) @@ -104,7 +54,7 @@ private variable C : Set ℓc ---------------------------------------------------------------------- --- (1) ACCUMULATION IS MONADIC — μ : D_r (D_s A) → D_{r+s} A. +-- (1) COMPOSITION OF FIBRES FOR TWO SPECIFIED MAPS. -- -- A "nested loss" is an f-echo sitting under a g-step: the layered data -- `Σ B (λ b → Echo f b × (g b ≡ y))`. `accumulate` composes the two @@ -132,10 +82,8 @@ split-with-factoring f g = Echo-comp-iso-to f g -- (2) RECOVERABILITY IS EXACT ON THE FIBRE. -- -- For a FIXED factoring the two maps are mutually inverse — both --- round-trips are `refl`. The fibre stores the loss precisely: no --- over-approximation, no stored complement. This is the --- "exact-on-a-homotopy-fibre" half of the verdict at the level of a --- single layered computation. +-- round-trips are `refl`. A fibre inhabitant retains its chosen source +-- witness and equality proof. No storage-minimality result follows. ---------------------------------------------------------------------- accumulate-split-id : @@ -149,23 +97,16 @@ split-accumulate-id : split-with-factoring f g (accumulate f g r) ≡ r split-accumulate-id f g = Echo-comp-iso-to-from f g --- The grade-0 instance: A ≅ Σ B (Echo f). The unit (encode) / counit --- (decode) of the section/retraction ADJUNCTION live on the grade-0 --- fibre. This is the "section/retraction pair whose round-trip is exact --- on a homotopy fibre", pinned as a genuine ↔. +-- Total completion A ≅ Σ B (Echo f), with no grading parameter. +-- This type equivalence alone is not a categorical adjunction. recoverable-fibre : (f : A → B) → A ↔ Σ B (Echo f) recoverable-fibre = A↔ΣEcho ---------------------------------------------------------------------- --- (3) THE COMONAD DIRECTION FAILS FOR GENUINE LOSS. +-- (3) NO INPUT-RECONSTRUCTING LEFT INVERSE FOR BOOLEAN COLLAPSE. -- --- A graded COMONAD would supply a NATURAL δ on the BARE residual functor: --- recover the intermediate / layered data from a residue WITHOUT being --- handed a factoring. For genuine loss that is the irreversibility --- obstruction. The canonical collapse `collapse : Bool → ⊤` has NO --- section: no `raise : ⊤ → Bool` satisfies `raise ∘ collapse ≡ id`. The --- forgotten bit cannot be recovered from the residue alone — genuine loss --- does NOT store its complement. +-- No raise : ⊤ → Bool satisfies raise ∘ collapse ≡ id. Right inverses +-- do exist. This result is not an obstruction to graded comonads. ---------------------------------------------------------------------- no-bare-recovery : @@ -175,25 +116,23 @@ no-bare-recovery = -- The fibre nevertheless retains the lost bit EXACTLY: `echo-true` and -- `echo-false` are distinct echoes over the SAME residue `tt`. The loss --- is stored on the FIBRE, not as a recoverable residue-complement — which --- is exactly why `no-bare-recovery` holds while `accumulate-split-id` --- is `refl`. +-- witness is retained in each fibre inhabitant; it is absent from the +-- bare output. This explains the different recovery statements. fibre-retains-lost-bit : echo-true ≢ echo-false fibre-retains-lost-bit = echo-true≢echo-false ---------------------------------------------------------------------- --- (4) THE "GRADED COMONAD" READING IS THE COMPLEMENT-STORING NEIGHBOUR. +-- (4) INVERTIBLE SPLIT/MERGE FOR THE SEPARATE ITERATED-PRODUCT MODEL. -- -- `EchoGradedComonadF1` is a genuine nested graded comonad, but its model -- `D r A = A × Boolʳ` RETAINS its residue layers. Its comultiplication is -- `δ = coe (D-+ m n A)` along the TYPE EQUALITY `D (m+n) A ≡ D m (D n A)`, -- so it is INVERTIBLE. We exhibit the inverse `μ-writer` and prove both --- round-trips: the writer is simultaneously a graded comonad AND a graded --- monad. That bi-directionality is the signature of a COMPLEMENT-STORING --- (resource / coeffect) modality — precisely what echo-types is NOT. +-- round-trips. A corresponding graded-monad package additionally needs +-- naturality, its unit and coherent multiplication laws. -- -- `μ-writer : D_m (D_n A) → D_{m+n} A` — note the type literally adds the --- grades m + n, the additive (⊗ = +) axis of the tropical semiring. +-- grades m + n; no tropical ordering compatibility is proved here. ---------------------------------------------------------------------- coe-sym : ∀ {X Y : Set} (p : X ≡ Y) (x : X) → coe (sym p) (coe p x) ≡ x @@ -212,8 +151,7 @@ writer-μ-section : writer-μ-section m n {A} = coe-sym (D-+ m n A) -- μ-writer is also a RETRACTION of δ: splitting-then-combining is the --- identity. Together these show δ is an isomorphism — the writer is --- LOSSLESS, hence both a graded comonad and a graded monad. +-- identity. Together these show δ is an isomorphism. writer-δ-section : ∀ m n {A : Set} (y : D m (D n A)) → δ m n (μ-writer m n y) ≡ y writer-δ-section m n {A} = coe-sym′ (D-+ m n A) @@ -225,9 +163,8 @@ writer-δ-section m n {A} = coe-sym′ (D-+ m n A) -- categorical impossibility theorem. ---------------------------------------------------------------------- --- NOT claimed: that no graded comonad of any kind touches Echo. F1 is one --- — on the complement-storing writer. The claim is that GENUINE --- (fibre-based, non-complement-storing) loss is not a graded comonad. +-- Compatibility marker only. No universal obstruction is proved here; +-- EchoErasingGradedComonad explicitly permits positive-grade loss. NotProved-no-graded-comonad-of-any-kind : Set NotProved-no-graded-comonad-of-any-kind = ⊤ diff --git a/proofs/agda/Smoke.agda b/proofs/agda/Smoke.agda index 924cca43..0eaf0cb0 100644 --- a/proofs/agda/Smoke.agda +++ b/proofs/agda/Smoke.agda @@ -8,6 +8,29 @@ module Smoke where +open import EchoGradedComonadNaturality using (NaturalGradedComonad) +open import EchoThinPreorderExample using (indiscrete; no-antisymmetry) +open import EchoGradedComonadInstance1 using (nat-natural-instance) +open import EchoGradedComonadInstance2 using (list-natural-instance) + +-- Bounded foundational audit: lawful parallel-arrow action, explicit +-- naturality for the concrete instances, and right-inverse examples. +open import EchoSeparating using + ( sep-id; sep-compose; sep-compose-idˡ; sep-compose-idʳ + ; sep-compose-assoc; sep-deg-id; sep-deg-comp + ; sep-parallel-actions-distinct + ) +open import EchoGradedComonadF1 using (ε-natural; δ-natural) +open import EchoGradedComonadInstance1 using (nat-ε-natural; nat-δ-natural) +open import EchoGradedComonadInstance2 using (list-ε-natural; list-δ-natural) +open import EchoCharacteristic using + ( collapse-raise-true; collapse-raise-false + ; collapse-right-inverse-true; collapse-right-inverse-false + ; collapse-right-inverses-distinct + ) +open import EchoResidue using + (collapse-residue-raise; collapse-residue-right-inverse) + open import Echo using ( Echo ; echo-intro diff --git a/roadmap-gates.adoc b/roadmap-gates.adoc index 3b204cd9..1a4c9485 100644 --- a/roadmap-gates.adoc +++ b/roadmap-gates.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 2 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] The identity claim for echo types (see <>) rests on three conditions. Each is treated as a decision gate with an explicit failure @@ -33,7 +39,7 @@ toc::[] | Drop identity claim; retain as Agda exposition. | <> -| At least two theorems are naturally echo-shaped and not reducible to generic sigma lemmas. +| Evaluate usefulness of the selected theorem presentations; no general separation from Sigma is asserted. | `docs/characteristic.adoc` | Drop claim of a distinct theorem family; modules remain. @@ -53,11 +59,8 @@ non-injective computation. The fibre is not novel and coincides with HoTT fibres and Σ-relevant refinement; comparisons with other treatments are specific to the models and witness information they retain. -Distinctness rests on two structural arguments: the *truncation -argument* (echo types are non-truncatable for non-injective -functions with multiple preimages, formally certified by the -`echo-not-prop` family in `proofs/agda/examples/`) and the *2-cell -argument* (neighbour-framework natural 2-cells are +The current scoped evidence consists of the *truncation comparison* (the chosen fibres have distinct source projections, so propositional truncation cannot retain that same source-sensitive information, formally certified by the +`echo-not-prop` family in `proofs/agda/examples/`) and the selected *2-cell constructions* (neighbour-framework natural 2-cells are Σ-over-preimages-shaped, formally certified by `Sophisticated.equalizer→echo-pair` in `EchoVsQuotient.agda` and `Sophisticated.meet→echo-intersection` in `EchoVsGalois.agda`). @@ -102,8 +105,7 @@ elsewhere under another name. .Claim **** -There exist theorems whose statements are naturally echo-shaped and are -not reducible to generic sigma/fiber lemmas. +The library contains useful fibre presentations and examples. Their novelty, priority, and application value require independent assessment; expressing them as general Sigma/fibre lemmas does not invalidate the constructions and is not a separation result. **** [NOTE] diff --git a/roadmap.adoc b/roadmap.adoc index 87526c73..55901e5d 100644 --- a/roadmap.adoc +++ b/roadmap.adoc @@ -7,6 +7,12 @@ :sectnumlevels: 3 :icons: font + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] Single canonical roadmap for the echo-types project. As of 2026-05-26 this file replaces the previously fragmented set of overlapping @@ -28,8 +34,7 @@ type-theoretic standing. CLAUDE.md is the session-level rung ledger. *Retraction discipline.* The single most credible thing about this project is `docs/retractions.adoc` R-2026-05-18: under adversarial review, four headline claims were narrowed (full universal property → -funext-relative pointwise mediator; graded comonad → thin-poset -reindexing modality; model-independence → carrier-parametricity over a +funext-relative pointwise mediator; graded comonad → preorder-indexed diagram; model-independence → carrier-parametricity over a fixed grade poset; conservativity metatheorem → postulate-free build that is evidence-for, not proof-of, conservativity). Narrowing is a feature, not a defect. Every lane below carries an explicit @@ -105,7 +110,7 @@ for the full status-tagged listing: * *Tier 1* — `EchoTotalCompletion` (`A ≃ Σ B (Echo f)`), `EchoOrthogonalFactorizationSystem` (`ofs-witness`), `EchoImageFactorization` (`Image`), - `EchoNoSectionGeneric` (structural no-section). + `EchoNoSectionGeneric` (structural no-left-inverse theorem; historical identifier retained). * *Tier 2* — `EchoLossTaxonomy` / `EchoResidueTaxonomy` / `EchoDecorationStructure` / `EchoObservationalEquivalence` (the four-axis classification grid as named records, not @@ -199,18 +204,15 @@ submission-ready abstract respectively. *Retraction-watch.* Pillar B's pullback is *pointwise, funext-relative* — never describe it as a categorical universal property. Pillar D is *carrier-parametricity over a fixed grade poset* — never -"model-independence". The graded structure is a *thin-poset reindexing -modality* — never "graded comonad". These three narrowings are the +"model-independence". The graded structure is a *preorder-indexed diagram*. This interface alone is neither a reflective modality nor a graded-comonad interface. These three narrowings are the load-bearing R-2026-05-18 commitments. *Owner / cadence.* Claude session work + author-driven write-up. Re-checked at every rung consolidation. -=== Lane 2 [ACTIVE] — Echo-vs-Σ identity claim +=== Lane 2 [ACTIVE] — Fibre presentation and scoped encoding comparisons -*Load-bearing question.* Can a sceptic, walking the repo cold, -convince themselves that Echo is not just renamed Σ within one -sitting? +*Research question.* Which concrete encodings or observations discard fibre information, and does presenting these standard Σ-types together provide a useful contribution? Echo is definitionally a Σ-type; no general separation is possible. Novelty and priority remain unresolved. *Bottleneck.* Today's session opened this lane; Track A (synthesis doc + reviewer-facing AsciiDoc companion + theorem-index aggregates + @@ -224,12 +226,11 @@ gate cross-links) landed in-session. Tracks B + C remain. . *LANDED 2026-05-26.* Track C (per-example raw-Σ counter-programs) shipped as `proofs/agda/examples/EchoVsSigma.agda`, pairing each headline example (parser, provenance, abs-int) with the small - Σ-misuse it blocks. Builds clean under `--safe --without-K`; + misuse of a chosen insufficiently constrained representation. General Σ-types can express the same invariants. The historical safe-build claim applies to its dated revision; pinned in `Smoke.agda` under own `using` block. *Cementing follow-ons (LANDED 2026-05-27).* Two additional artefacts -strengthen the same "Echo's distinguishing power lives in the witness" -line by knocking out the two most credible alternative readings: +illustrate information lost by two selected observations; they do not eliminate arbitrary alternative encodings: * `proofs/agda/EchoEntropy.agda` — Shannon-entropy non-distinguishing theorem in discrete form. The entropic shadow (`FiberSize-fin` over @@ -238,25 +239,18 @@ line by knocking out the two most credible alternative readings: factoring through it gives the same value on `echo-true` and `echo-false`. The witness side (`EchoAbstractionBarrier.sigma-distinguishes`) is the matched- - negative companion. Closes the Shannon-entropy item that was flagged - as deferred in `EchoThermodynamics.agda` and `EchoStabilityTests.agda`. + negative companion. This establishes a finite count-surrogate comparison, not a full Shannon-entropy theory or a separation from every probabilistic encoding. * `proofs/agda/EchoLLEncoding.agda` — linear-logic shallow-encoding gap theorem. An `LLShallowEncoding` record captures the data a - standard LL `!A`-style encoding must provide; the canonical + selected shallow LL-style encoding provides; the canonical `X m := ⊤` shadow (LL `!A := 1`) admits a section of the encoded weakening, while the source-side `EchoLinear.no-section-weaken` - refutes any source section. The gap-pair `gap-paired` is the - checked, paired artefact: encoded section exists, source-side - section does not. Closes the "minimal encoding gap vs standard - linear logic" item flagged in `core/skepticisms/what-is-actually- - new.md`. + refutes a source left inverse. The gap-pair `gap-paired` compares this chosen lossy encoding with exact source recovery. Historical “section” negatives here concern left inverses. No universal gap against standard linear logic follows. Both modules build under `--safe --without-K` with zero postulates and no funext use; pinned in `Smoke.agda` under their own `using` blocks, -wired into `All.agda`. Real-valued Shannon entropy and the full -universal LL-encoding gap (over arbitrary shallow encodings, not just -the trivial witness) remain open and are documented in the modules' -own companion-remark blocks. +wired into `All.agda`. Real-valued Shannon entropy and +comparisons against specified richer LL encodings remain research tasks. A universal separation from every faithful dependent encoding is not a viable goal; each comparison needs an explicit target and preservation criterion. *Architectural keystone (LANDED 2026-05-27).* Two further artefacts land the synthesis spine: @@ -264,9 +258,7 @@ land the synthesis spine: * `proofs/agda/EchoTotalCompletion.agda` — `A ≃ Σ B (Echo f)`, the slogan-unlock theorem. `encode`/`decode` + round-trips + factorisation triangle (definitional). The single most-cited but - never-pinned theorem in the project's narrative ("irreversible - computation + echo = reversible representation") now has an Agda - artefact behind it. + never-pinned theorem in the project's narrative. The representation is reversible because it retains the original source; there is no bare-output recovery, minimal-storage result, or grade-zero parameter. * `proofs/agda/EchoOrthogonalFactorizationSystem.agda` — the (equivalence, projection) factorisation system witness. Every `f : A → B` factors canonically as `A ≃ Σ B (Echo f) → B`, with diff --git a/scripts/check-agda-invocations.py b/scripts/check-agda-invocations.py deleted file mode 100644 index a6943010..00000000 --- a/scripts/check-agda-invocations.py +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/env python3 -# SPDX-License-Identifier: MPL-2.0 -"""Check direct Agda proof commands in the maintained CI/local entrypoints. - -Static policy lint only: not an Agda typecheck or a parser for arbitrary shell. -The separately reviewed full-cubical profile is not implied by this check. -""" -import re -import sys -from pathlib import Path - -DEFAULTS = [".github/workflows/agda.yml", "scripts/check-grade3.sh", "scripts/verify.sh", "Justfile"] -PROFILE = {"--safe", "--without-K", "--cubical-compatible"} -CUBICAL = "proofs/agda/EchoImageFactorizationPropCubical.agda" -DENIED = {"--allow-unsolved-metas", "--with-K", "--no-without-K", "--type-in-type", "--no-termination-check", "--no-positivity-check"} -pattern = re.compile(r"^\s*(?:run:\s*)?agda\s+(.*)$") -failed = False -for filename in sys.argv[1:] or DEFAULTS: - path = Path(filename) - count = 0 - for line_no, line in enumerate(path.read_text().splitlines(), 1): - match = pattern.match(line) - if not match: - continue - args = set(match.group(1).split()) - if args == {"--version"}: - continue - count += 1 - required = {"--safe", "--cubical"} if CUBICAL in args else PROFILE - forbidden = args & DENIED - if CUBICAL not in args and "--cubical" in args: - forbidden.add("--cubical") - missing = required - args - if missing or forbidden: - print(f"{filename}:{line_no}: missing {sorted(missing)}, forbidden {sorted(forbidden)}", file=sys.stderr) - failed = True - if not count: - print(f"{filename}: no direct Agda proof command found", file=sys.stderr) - failed = True -if failed: - sys.exit(1) -print("Agda invocation lint: OK (static only; no proof was checked)") diff --git a/scripts/check-agda-invocations.sh b/scripts/check-agda-invocations.sh new file mode 100644 index 00000000..723ceba8 --- /dev/null +++ b/scripts/check-agda-invocations.sh @@ -0,0 +1,51 @@ +#!/bin/sh +# SPDX-License-Identifier: MPL-2.0 +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +# Static lint for direct, single-line agda commands; not a shell parser/typecheck. +set -eu +if [ "$#" -eq 0 ]; then + set -- .github/workflows/agda.yml scripts/check-grade3.sh scripts/verify.sh Justfile +fi +for file do + test -r "$file" || { printf '%s: unreadable input\n' "$file" >&2; exit 1; } +done +awk ' +function finish() { + if (FILENAME != "" && count == 0) { + print FILENAME ": no direct Agda proof command found" > "/dev/stderr" + failed = 1 + } +} +FNR == 1 { + if (NR > 1 && count == 0) { + print previous ": no direct Agda proof command found" > "/dev/stderr" + failed = 1 + } + count = 0; previous = FILENAME +} +{ + line = $0 + sub(/^[[:space:]]*(run:[[:space:]]*)?/, "", line) + sub(/^@/, "", line) + if (line !~ /^agda[[:space:]]+/) next + sub(/^agda[[:space:]]+/, "", line) + sub(/[[:space:]]*#.*/, "", line) + sub(/[[:space:]]+$/, "", line) + if (line == "--version") next + count++ + for (key in arg) delete arg[key] + n = split(line, fields, /[[:space:]]+/) + for (i = 1; i <= n; i++) arg[fields[i]] = 1 + cubical = ("proofs/agda/EchoImageFactorizationPropCubical.agda" in arg) + missing = !("--safe" in arg) || (cubical ? !("--cubical" in arg) : (!("--without-K" in arg) || !("--cubical-compatible" in arg))) + forbidden = (!cubical && ("--cubical" in arg)) + split("--allow-unsolved-metas --with-K --no-without-K --type-in-type --no-termination-check --no-positivity-check", denied, " ") + for (i in denied) if (denied[i] in arg) forbidden = 1 + if (missing || forbidden) { + printf "%s:%d: invalid proof profile (missing=%d, forbidden=%d)\n", FILENAME, FNR, missing, forbidden > "/dev/stderr" + failed = 1 + } +} +END { finish(); exit failed } +' "$@" +printf '%s\n' 'Agda invocation lint: OK (static only; no proof was checked)' diff --git a/scripts/check-experimental-aggregate.sh b/scripts/check-experimental-aggregate.sh index 3e31f2d3..bb8e278d 100644 --- a/scripts/check-experimental-aggregate.sh +++ b/scripts/check-experimental-aggregate.sh @@ -6,12 +6,50 @@ set -euo pipefail root="${1:-proofs/agda/experimental/echo-additive}" aggregate="$root/All.agda" test -f "$aggregate" || { echo "Missing $aggregate" >&2; exit 1; } +imports="$(mktemp)" +trap 'rm -f "$imports"' EXIT + +# Ignore line comments, nested Agda block comments, and string literals. +# A commented-out import must not certify that a module is typechecked. +# Keep whitespace where a comment occurred so adjacent tokens do not join. +awk ' + { + for (i = 1; i <= length($0); ) { + pair = substr($0, i, 2) + char = substr($0, i, 1) + if (depth > 0) { + if (pair == "{-") { depth++; i += 2 } + else if (pair == "-}") { depth--; i += 2 } + else i++ + } else if (quoted) { + if (char == "\\") i += 2 + else { if (char == "\"") quoted = 0; i++ } + } else if (pair == "--") { + break + } else if (pair == "{-") { + depth++; printf " "; i += 2 + } else if (char == "\"") { + quoted = 1; printf " "; i++ + } else { + printf "%s", char; i++ + } + } + printf "\n" + } + END { + if (depth || quoted) { + print "Unterminated block comment or string in aggregate" > "/dev/stderr" + exit 1 + } + } +' "$aggregate" > "$imports" + fail=0 while IFS= read -r -d '' file; do name="${file##*/}" name="${name%.agda}" [ "$name" = All ] && continue - if ! grep -Eq "^[[:space:]]*(open[[:space:]]+)?import[[:space:]]+experimental[.]echo-additive[.]${name}([[:space:];(]|$)" "$aggregate"; then + if ! grep -Eq "^[[:space:]]*(open[[:space:]]+)?import[[:space:]]+experimental[.]echo-additive[.]${name}([[:space:];(]|$)" "$imports"; then echo "Missing aggregate import: $name" >&2 fail=1 fi diff --git a/scripts/check-grade3.sh b/scripts/check-grade3.sh index 733a3017..d85c6d8f 100644 --- a/scripts/check-grade3.sh +++ b/scripts/check-grade3.sh @@ -18,7 +18,7 @@ for f in "${AGDA_DIR:-$HOME/.agda}/libraries" "${AGDA_DIR:-$HOME/.agda}/defaults done sh scripts/kernel-guard.sh -python3 scripts/check-agda-invocations.py +sh scripts/check-agda-invocations.sh bash scripts/check-experimental-aggregate.sh bash tools/check-guardrails.sh proofs/agda diff --git a/scripts/setup-agda.sh b/scripts/setup-agda.sh new file mode 100644 index 00000000..015b0cad --- /dev/null +++ b/scripts/setup-agda.sh @@ -0,0 +1,79 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Linux x86-64 CI toolchain. A release archive is accepted only at the +# checked-in checksum; version/dependency mismatches fail before typechecking. +set -euo pipefail + +AGDA_VERSION=2.7.0.1 +AGDA_SHA256=975b515a14877ab6bce5bfc641e16c4a3ee52ca5d7f846577dee80aa2145db8a +STDLIB_SHA=8326c7475af1fa456ca04a0203c168d5d7ff842b +ABSZ_SHA=f486c29903434589117fa0662c6f29b0f17d1d5f + +test "$(uname -s)-$(uname -m)" = Linux-x86_64 +tool_dir="${AGDA_TOOLS_DIR:-${RUNNER_TEMP:?RUNNER_TEMP or AGDA_TOOLS_DIR is required}/echo-agda}" +mkdir -p "$tool_dir" +tool_dir="$(cd "$tool_dir" && pwd)" +archive="${AGDA_ARCHIVE_PATH:-$tool_dir/Agda-v$AGDA_VERSION-linux.tar.xz}" +if [ ! -f "$archive" ]; then + curl --fail --location --retry 3 --proto '=https' \ + --output "$archive" \ + "https://github.com/agda/agda/releases/download/v$AGDA_VERSION/Agda-v$AGDA_VERSION-linux.tar.xz" +fi +printf '%s %s\n' "$AGDA_SHA256" "$archive" | sha256sum --check --strict - +tar -xf "$archive" -C "$tool_dir" +agda_root="$tool_dir/Agda-v$AGDA_VERSION" +export Agda_datadir="$agda_root/data" +actual_version="$("$agda_root/bin/agda" --version)" +if [ "$actual_version" != "Agda version $AGDA_VERSION" ]; then + printf 'Compiler mismatch: expected Agda version %s, got %s\n' "$AGDA_VERSION" "$actual_version" >&2 + exit 1 +fi + +fetch_pinned() { + local url="$2" revision="$3" destination="$tool_dir/$1" actual + if [ ! -d "$destination/.git" ]; then + git init --quiet "$destination" + git -C "$destination" remote add origin "$url" + git -C "$destination" fetch --quiet --depth=1 origin "$revision" + git -C "$destination" checkout --quiet --detach FETCH_HEAD + fi + actual="$(git -C "$destination" rev-parse HEAD)" + if [ "$actual" != "$revision" ]; then + printf 'Dependency mismatch in %s: expected %s, got %s\n' "$destination" "$revision" "$actual" >&2 + exit 1 + fi +} +fetch_pinned agda-stdlib https://github.com/agda/agda-stdlib.git "$STDLIB_SHA" +fetch_pinned absolute-zero https://github.com/hyperpolymath/absolute-zero.git "$ABSZ_SHA" + +mkdir -p "$tool_dir/libraries" +printf 'name: standard-library\ninclude: %s/agda-stdlib/src\n' "$tool_dir" > "$tool_dir/libraries/standard-library.agda-lib" +printf 'name: absolute-zero\ninclude: %s/absolute-zero/proofs/agda\n' "$tool_dir" > "$tool_dir/libraries/absolute-zero.agda-lib" +agda_config="${AGDA_CONFIG_DIR:-$tool_dir/agda-config}" +mkdir -p "$agda_config" +printf '%s\n%s\n' "$tool_dir/libraries/standard-library.agda-lib" "$tool_dir/libraries/absolute-zero.agda-lib" > "$agda_config/libraries" +printf 'standard-library\n' > "$agda_config/defaults" +export AGDA_DIR="$agda_config" +export AGDA="$agda_root/bin/agda" +export AGDA_STDLIB="$tool_dir/agda-stdlib/src" +export ABSOLUTE_ZERO_AGDA="$tool_dir/absolute-zero/proofs/agda" + +# Local callers can source this file; CI receives the same values below. +{ + printf 'export AGDA=%q\n' "$AGDA" + printf 'export Agda_datadir=%q\n' "$Agda_datadir" + printf 'export AGDA_DIR=%q\n' "$AGDA_DIR" + printf 'export AGDA_STDLIB=%q\n' "$AGDA_STDLIB" + printf 'export ABSOLUTE_ZERO_AGDA=%q\n' "$ABSOLUTE_ZERO_AGDA" + printf 'export PATH=%q:"$PATH"\n' "$agda_root/bin" +} > "$tool_dir/env.sh" + +if [ -n "${GITHUB_PATH:-}" ]; then + printf '%s\n' "$agda_root/bin" >> "$GITHUB_PATH" +fi +if [ -n "${GITHUB_ENV:-}" ]; then + printf 'AGDA=%s\nAgda_datadir=%s\nAGDA_DIR=%s\nAGDA_STDLIB=%s\nABSOLUTE_ZERO_AGDA=%s\n' \ + "$AGDA" "$Agda_datadir" "$AGDA_DIR" "$AGDA_STDLIB" "$ABSOLUTE_ZERO_AGDA" >> "$GITHUB_ENV" +fi +printf '%s\ncompiler-sha256=%s\nstdlib=%s\nabsolute-zero=%s\n' \ + "$actual_version" "$AGDA_SHA256" "$STDLIB_SHA" "$ABSZ_SHA" | tee "$tool_dir/toolchain.txt" diff --git a/scripts/test-experimental-aggregate.sh b/scripts/test-experimental-aggregate.sh new file mode 100644 index 00000000..f77e2763 --- /dev/null +++ b/scripts/test-experimental-aggregate.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Regression controls for aggregate wiring; no Agda source is modified. +set -euo pipefail +checker="$(cd "$(dirname "$0")" && pwd)/check-experimental-aggregate.sh" +fixture="$(mktemp -d)" +trap 'rm -rf "$fixture"' EXIT +printf 'module experimental.echo-additive.Grade where\n' > "$fixture/Grade.agda" + +printf 'open import experimental.echo-additive.Grade\n' > "$fixture/All.agda" +bash "$checker" "$fixture" >/dev/null + +printf '{-\nopen import experimental.echo-additive.Grade\n-}\n' > "$fixture/All.agda" +if bash "$checker" "$fixture" > "$fixture/block.log" 2>&1; then + echo 'ERROR: block-commented import was accepted' >&2 + exit 1 +fi +grep -q 'Missing aggregate import: Grade' "$fixture/block.log" + +printf '{-\n{- nested -}\nopen import experimental.echo-additive.Grade\n-}\n' > "$fixture/All.agda" +if bash "$checker" "$fixture" > "$fixture/nested.log" 2>&1; then + echo 'ERROR: nested-block-commented import was accepted' >&2 + exit 1 +fi +grep -q 'Missing aggregate import: Grade' "$fixture/nested.log" + +printf '%s\n' '-- open import experimental.echo-additive.Grade' > "$fixture/All.agda" +if bash "$checker" "$fixture" > "$fixture/line.log" 2>&1; then + echo 'ERROR: line-commented import was accepted' >&2 + exit 1 +fi + +printf '%s\n' 'label = "{- not a block comment -}"' \ + 'open {- inline comment -} import experimental.echo-additive.Grade' > "$fixture/All.agda" +bash "$checker" "$fixture" >/dev/null +echo 'Experimental aggregate controls: PASS (active imports accepted; commented imports rejected)' diff --git a/stapeln.toml b/stapeln.toml index 29abf578..81365381 100644 --- a/stapeln.toml +++ b/stapeln.toml @@ -1,93 +1,23 @@ # SPDX-License-Identifier: MPL-2.0 -# stapeln.toml — layered Chainguard container build for echo-types. -# Echo-types is a proof library, not a service. The container is an artefact carrier: -# it bundles type-checked Agda artefacts (.agdai) for downstream consumers to mount. - +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +# The Containerfile is the single build definition; no parallel unpinned layers. +# Podman builds are verified separately. This file declares launcher preferences, +# not evidence of a stapeln/vordr/svalinn run or of a signed published image. [metadata] name = "echo-types" version = "0.1.0-alpha" -description = "Constructive Agda formalisation of echo types" +description = "Agda proof-source carrier; All checked by the pinned toolchain" author = "Jonathan D.A. Jewell " license = "MPL-2.0" -registry = "ghcr.io/hyperpolymath" [build] containerfile = "Containerfile" context = "." runtime = "podman" -[layers.echo-types-base] -description = "Chainguard wolfi-base base" -from = "cgr.dev/chainguard/wolfi-base:latest" # TODO(scaffold): pin @sha256 -cache = true -verify = true - -[layers.echo-types-toolchain] -description = "Agda + GHC build toolchain" -extends = "echo-types-base" -packages = ["agda", "ghc", "cabal"] -cache = true - -[layers.echo-types-build] -description = "Type-check all proofs." -extends = "echo-types-toolchain" -copy = [ - { src = "proofs/", dst = "/build/proofs/" }, - { src = "echo-types.agda-lib", dst = "/build/echo-types.agda-lib" }, -] -commands = [ - "agda -i proofs/agda proofs/agda/All.agda", -] -artifacts = [ - { src = "/build/proofs/agda/", dst = "/app/proofs/agda/" }, -] - -[layers.echo-types-runtime] -description = "Minimal artefact carrier." -from = "cgr.dev/chainguard/static:latest" # TODO(scaffold): pin @sha256 -copy-from = [ - { layer = "echo-types-build", src = "/app/", dst = "/app/" }, -] -user = "nonroot" - [security] non-root = true read-only-root = true no-new-privileges = true cap-drop = ["ALL"] seccomp-profile = "default" - -[security.signing] -algorithm = "ML-DSA-87" -provider = "cerro-torre" - -[security.sbom] -format = "spdx-json" -output = "sbom.spdx.json" -include-deps = true - -[verify] -vordr = true -svalinn = true -scan-on-build = true -fail-on = ["critical", "high"] - -[targets.development] -description = "Local development." -layers = ["echo-types-runtime"] -env = { LOG_LEVEL = "debug" } - -[targets.staging] -description = "Staging." -layers = ["echo-types-runtime"] -env = { LOG_LEVEL = "debug" } - -[targets.production] -description = "Production." -layers = ["echo-types-runtime"] -env = { LOG_LEVEL = "warning" } - -[targets.test] -description = "Test." -layers = ["echo-types-runtime"] -env = { LOG_LEVEL = "debug" } diff --git a/tools/audit-inventory.mjs b/tools/audit-inventory.mjs new file mode 100644 index 00000000..825627a6 --- /dev/null +++ b/tools/audit-inventory.mjs @@ -0,0 +1,70 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +// Read-only inventory: Bun runtime filesystem/process APIs, no dependencies. +import { execFileSync } from 'node:child_process'; +import { readFileSync, existsSync } from 'node:fs'; +import { dirname, resolve } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const root = resolve(dirname(fileURLToPath(import.meta.url)), '..'); +const excluded = new Set([ + 'proofs/agda/EchoOrdinal.agda', + 'proofs/agda/Ordinal/OmegaMarkers.agda', + 'proofs/agda/Ordinal/Buchholz/Syntax.agda', +]); +const entrypoints = ['All', 'Smoke', 'characteristic/All', 'examples/All', + 'EchoImageFactorizationPropCubical', 'experimental/echo-additive/All', 'NarrowingSmoke']; +const git = (...args) => execFileSync('git', ['-C', root, ...args], { encoding: 'utf8' }); +const paths = text => text.split('\0').filter(Boolean); +const tracked = new Set(paths(git('ls-files', '-z'))); +const local = new Set([...tracked, ...paths(git('ls-files', '--others', '--exclude-standard', '-z'))]); +const agda = new Set([...local].filter(p => p.endsWith('.agda') && existsSync(resolve(root, p)))); + +// Nested block and line comments; preserve line boundaries for import matching. +function uncomment(text) { + const result = []; + let depth = 0; + for (let i = 0; i < text.length;) { + if (text.startsWith('{-', i)) { depth++; i += 2; } + else if (depth && text.startsWith('-}', i)) { depth--; i += 2; } + else if (!depth && text.startsWith('--', i)) { + const newline = text.indexOf('\n', i); + if (newline === -1) break; + i = newline; + } else { result.push(!depth || text[i] === '\n' ? text[i] : ' '); i++; } + } + return result.join(''); +} +const edges = new Map([...agda].map(path => { + const source = uncomment(readFileSync(resolve(root, path), 'utf8')); + const imports = [...source.matchAll(/^\s*(?:open\s+)?import\s+([^\s;({]+)/gm)] + .map(match => `proofs/agda/${match[1].replaceAll('.', '/')}.agda`) + .filter(path => agda.has(path)); + return [path, imports]; +})); +function closure(rootPath) { + const seen = new Set(), pending = [rootPath]; + while (pending.length) { + const path = pending.pop(); + if (seen.has(path) || excluded.has(path) || !agda.has(path)) continue; + seen.add(path); + pending.push(...edges.get(path).filter(p => !seen.has(p))); + } + return seen; +} +const closures = new Map(entrypoints.map(name => [name, closure(`proofs/agda/${name}.agda`)])); +const covered = new Set([...closures.values()].flatMap(set => [...set])); +const inScope = [...agda].filter(path => !excluded.has(path)); +console.log(JSON.stringify({ + baseline_commit: git('rev-parse', 'HEAD').trim(), + mode: 'working tree, including untracked unignored source files', + tracked_files: tracked.size, + local_unignored_files: local.size, + agda_files: agda.size, + in_scope_agda_files: inScope.length, + excluded_paths: [...excluded].filter(path => agda.has(path)).sort(), + entrypoint_closure_sizes: Object.fromEntries([...closures].map(([name, set]) => [name, set.size])), + covered_in_scope: covered.size, + outside_closures: inScope.filter(path => !covered.has(path)).sort(), + method: 'static repository-local import traversal; not typechecking evidence', +}, null, 2)); diff --git a/tools/check-audit.sh b/tools/check-audit.sh new file mode 100644 index 00000000..abc17769 --- /dev/null +++ b/tools/check-audit.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Check the audit's changed proofs plus the existing seven CI entrypoints. +# Required: AGDA_STDLIB points at stdlib src, ABSOLUTE_ZERO_AGDA at proofs/agda. +# Optional: AGDA (executable), AUDIT_LOG_DIR, AUDIT_COLD=1 (ignore interfaces). +set -euo pipefail +cd "$(dirname "$0")/.." +: "${AGDA_STDLIB:?Set AGDA_STDLIB to the pinned standard-library src directory}" +: "${ABSOLUTE_ZERO_AGDA:?Set ABSOLUTE_ZERO_AGDA to the pinned CNO source directory}" +agda_bin="${AGDA:-agda}" +log_dir="${AUDIT_LOG_DIR:-build/audit-2026-11-06}" +mkdir -p "$log_dir" +args=(--no-libraries -i proofs/agda -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA") +if [[ "${AUDIT_COLD:-0}" == 1 ]]; then args+=(--ignore-interfaces); fi +"$agda_bin" --version > "$log_dir/compiler.txt" +git rev-parse HEAD > "$log_dir/base-commit.txt" +find proofs/agda -name '*.agda' -type f -print0 | sort -z | xargs -0 sha256sum > "$log_dir/proof-sources.sha256" +: > "$log_dir/results.tsv" +check() { + local profile="$1" module="$2" key="${2//\//_}" + local flags=(--safe --without-K --cubical-compatible) + if [[ "$profile" == cubical ]]; then flags=(--safe --cubical); fi + if "$agda_bin" "${args[@]}" "${flags[@]}" "proofs/agda/$module.agda" > "$log_dir/$key.log" 2>&1; then + printf 'PASS\t%s\n' "$module" | tee -a "$log_dir/results.tsv" + else + local status=$? + printf 'FAIL(%s)\t%s\n' "$status" "$module" | tee -a "$log_dir/results.tsv" + tail -n 35 "$log_dir/$key.log" + return "$status" + fi +} +for module in EchoSourcePreserving EchoCNOSemantics EchoDependentPushforward \ + EchoErasingGradedComonad EchoNaturalityIndependence \ + EchoThinPreorderExample EchoGradedComonadNaturality \ + EchoGradedComonadF1 EchoGradedComonadInstance1 EchoGradedComonadInstance2 \ + EchoSeparating EchoCharacteristic EchoResidue EchoNoSectionGeneric AuditSmoke; do + check ordinary "$module" +done +for module in All Smoke characteristic/All examples/All experimental/echo-additive/All NarrowingSmoke; do + check ordinary "$module" +done +check cubical EchoImageFactorizationPropCubical diff --git a/tools/check-metadata.sh b/tools/check-metadata.sh new file mode 100644 index 00000000..2131b2af --- /dev/null +++ b/tools/check-metadata.sh @@ -0,0 +1,90 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Validate declarations without executing their embedded probe strings. +set -euo pipefail + +repo=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd) +cd "$repo" +standards=${ECHO_STANDARDS_DIR:-"$repo/../.echo-standards-references/standards"} +expected_revision=ba640e9a57f22608710ffecdca282074eac55a0b +bun=${BUN:-bun} +nickel=${K9_NICKEL:-nickel} + +fail() { printf 'metadata: %s\n' "$*" >&2; exit 2; } +[[ -d "$standards/.git" ]] || fail "set ECHO_STANDARDS_DIR to the pinned standards checkout" +[[ $(git -C "$standards" rev-parse HEAD) == "$expected_revision" ]] || fail "standards revision must be $expected_revision" +for source in \ + 1-formats/deed/tools/deed_lint.js \ + 1-formats/k9/tools/k9-validate.sh \ + 1-formats/k9/spec/contract/k9_contract.ncl; do + # Compare the actual executable source bytes, without refreshing the entire + # checkout index (which is costly on Windows-mounted workspaces). + expected_blob=$(git -C "$standards" rev-parse "$expected_revision:$source") + actual_blob=$(git -C "$standards" hash-object --no-filters "$source") + [[ $actual_blob == "$expected_blob" ]] || fail "validator source differs from its pin: $source" +done +command -v "$bun" >/dev/null || fail "Bun is required (set BUN to its executable)" +command -v "$nickel" >/dev/null || fail "Nickel is required for semantic K9 validation (set K9_NICKEL)" + +mapfile -d '' retired < <(find .machine_readable -type f -name '*.a2ml' -print0) +[[ ${#retired[@]} == 0 ]] || fail "retired .a2ml records remain: ${retired[*]}" +mapfile -d '' mirrors < <(find .machine_readable/svc -type f -print0 2>/dev/null || true) +[[ ${#mirrors[@]} == 0 ]] || fail "retired duplicate svc metadata remains: ${mirrors[*]}" +mapfile -d '' deeds < <(find . -maxdepth 1 -type f -name '*_chora.deed' -print0) +[[ ${#deeds[@]} == 1 && ${deeds[0]} == ./echo-types_chora.deed ]] || fail "exactly one root echo-types_chora.deed is required" +[[ ! -e 0-AI-MANIFEST.deed ]] || fail "descriptive metadata belongs in the single chora deed" + +tmp=$(mktemp -d) +trap 'rm -rf -- "$tmp"' EXIT +"$bun" "$standards/1-formats/deed/tools/deed_lint.js" --ast-json echo-types_chora.deed > "$tmp/chora.json" +"$bun" -e ' + const ast = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8")); + const fail = message => { throw new Error(message); }; + const field = (items, name, kind, expected) => { + const found = items.filter(x => x[0] === "field" && x[1] === name); + if (found.length !== 1 || found[0][2][0] !== kind || found[0][2][1] !== expected) + fail(`identity mismatch or duplicate: ${name}`); + }; + const clause = name => { + const found = ast.items.filter(x => x[0] === "clause" && x[1] === name); + if (found.length !== 1) fail(`required unique clause: ${name}`); + return found[0][2]; + }; + if (ast.head !== "repo-deed") fail("expected repo-deed"); + field(ast.items, "canonical-name", "string", "echo-types"); + // This pinned canonical AST intentionally elides UUID bodies as null. + // First establish their unique structural positions and types with it. + field(ast.items, "repo-uuid", "uuid8", null); + field(ast.items, "beholding-chora", "uuid5", null); + // Read only the two typed literal spans after the canonical grammar gate. + // Whole comments and strings are consumed first, preventing spoofed UUIDs + // in prose from satisfying the identity check. JSON handles the four + // escapes permitted in canonical DEED strings; no grammar is forked here. + const source = require("node:fs").readFileSync("echo-types_chora.deed", "utf8"); + const literalTokens = /;[^\r\n]*|"(?:[^"\\]|\\["\\nt])*"|#u[58]"(?:[^"\\]|\\["\\nt])*"/g; + const uuids = [...source.matchAll(literalTokens)].map(x => x[0]).filter(x => x.startsWith("#u")); + if (uuids.length !== 2) fail("exactly the two structural identity UUID literals are expected"); + const bodies = new Map(uuids.map(x => [x.slice(0, 3), JSON.parse(x.slice(3))])); + if (bodies.get("#u8") !== "gv-clade-index:github.com/hyperpolymath/echo-types" + || bodies.get("#u5") !== "estate/chora") fail("recorded UUID preimage mismatch"); + field(clause("identity"), "owner", "string", "hyperpolymath"); + field(clause("identity"), "prefixed-name", "string", "fv-echo-types"); + field(clause("clade"), "primary", "symbol", "fv"); + field(clause("clade"), "primary-name", "string", "Formal Verification & Proofs"); + field(clause("forges"), "github", "string", "hyperpolymath/echo-types"); + console.log("DEED grammar and recorded registry identity: PASS"); +' "$tmp/chora.json" + +components=(coordination.k9.ncl .machine_readable/self-validating/examples/project-metadata.k9.ncl) +for verb in must trust adjust dust bust intend; do + components+=(".machine_readable/contractiles/$verb/$verb.k9.ncl") + [[ -f ".machine_readable/contractiles/$verb/$verb.ncl" ]] || fail "missing $verb paired schema" + "$nickel" typecheck ".machine_readable/contractiles/$verb/$verb.ncl" +done +actual=() +while IFS= read -r -d '' component; do + [[ -f $component ]] && actual+=("$component") +done < <(git ls-files -z --cached --others --exclude-standard -- '*.k9.ncl') +[[ ${#actual[@]} == 8 ]] || fail "expected eight active K9 components across the repository, found ${#actual[@]}: ${actual[*]}" +bash "$standards/1-formats/k9/tools/k9-validate.sh" --strict --no-route --nickel "$nickel" "${components[@]}" +printf 'Metadata grammar and K9 semantic checks passed; declared probes were not executed.\n' diff --git a/wiki/Deniability.adoc b/wiki/Deniability.adoc index e77179f3..64a52f46 100644 --- a/wiki/Deniability.adoc +++ b/wiki/Deniability.adoc @@ -4,6 +4,12 @@ :toc: macro :toclevels: 3 + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:../docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] *Residue deniability* is a first-class echo property: whether an observer (`d : Residue → History`) can distinguish which history produced a given diff --git a/wiki/Home.adoc b/wiki/Home.adoc index 6fecb50f..20244c9e 100644 --- a/wiki/Home.adoc +++ b/wiki/Home.adoc @@ -4,6 +4,12 @@ :toc: macro :toclevels: 2 + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:../docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] *echo-types* is a constructive Agda formalisation of fiber-based *structured loss* — "echo types". The central definition is @@ -123,10 +129,7 @@ This wiki is a *distillation*. The authoritative records are: Pillar E is complete at the bounded-claim level. The one named *OPEN external* problem, *order-type fidelity* to ψ₀(Ω_ω) (decision-log `D-2026-06-14`), moved with the ordinal lane to ordinal-notation (below). -* *Variance* — resolved (`EchoVariance.agda`, #243): an echo is a graded - *monad of accumulation* with a section/retraction adjunction exact on the - grade-0 fibre — *not* a graded comonad (that reading is the lossless - complement-storing writer). +* *Variance* — `EchoVariance` gives inverse fibre-composition maps for a supplied factorisation and a Boolean no-left-inverse result. It does not establish a tropical graded monad. The total completion retains the source, has no grade parameter, and is not a minimal-residue or bare-output recovery theorem. Writer carriers and specific erasing carriers have different counit obligations. * *Aggregation* — `EchoAggregation.agda` generalised to the monoid/group form (`aggregation-as-fold`; #175), with `no-canonical-disaggregation` (the Sonnenschein–Mantel–Debreu / representative-agent critique, stated diff --git a/wiki/Overview.adoc b/wiki/Overview.adoc index cbf20b8f..844c2cde 100644 --- a/wiki/Overview.adoc +++ b/wiki/Overview.adoc @@ -4,6 +4,12 @@ :toc: macro :toclevels: 2 + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:../docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + toc::[] == What is an echo type? @@ -37,7 +43,7 @@ and `roadmap-gates.adoc`): distinct from refinement types, lens/optic theory, HoTT fibers, setoid quotients, and provenance semirings. . *Characteristic theorems* — at least two theorems are naturally echo-shaped - and not reducible to generic Σ lemmas. + with usefulness and priority assessed against specified encodings; no general separation from Σ is asserted. . *Canonical examples* — at least one worked example where echo types are the right explanatory unit. diff --git a/wiki/Roadmap.adoc b/wiki/Roadmap.adoc index 46441830..f228e41c 100644 --- a/wiki/Roadmap.adoc +++ b/wiki/Roadmap.adoc @@ -4,6 +4,12 @@ :toc: macro :toclevels: 2 + +[IMPORTANT] +==== +*Foundation scope correction, 2026-11-06.* The current contract is link:../docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:../docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. +==== + [.lead] Two layers: the *identity-claim gates* (the falsifiable conditions the project must keep meeting) and the *live open work* per track. Authoritative sources: @@ -30,7 +36,7 @@ in the next. | Drop identity claim; retain as Agda exposition. | 2. Characteristic theorems -| At least two theorems are naturally echo-shaped and not reducible to generic +| At least two theorems present useful fibre statements; no separation from generic Σ lemmas. Current nominees: `EchoGraded.degrade-via-join`, `EchoGraded.degrade-compose`, `EchoChoreo.applyChoreo-compose`, `EchoLinear.degradeMode-compose` (survives the audit 4-of-4). From f413ea14012a6d2ea428a3746070e4b92678df1f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 13:31:31 +0000 Subject: [PATCH 2/7] Repair live proof and metadata gates and record scoped scanner findings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix fresh full-Cubical toolchain bootstrap, explicit library selection, kernel classification, metadata PATH resolution, and current governance policy. Preserve qualified EI2 evidence and restrict SMTP egress. Ratchet-exception: .machine_readable/root-allow.txt — register the canonical chora deed, coordination contract, explicit Gitbot enrollment, and container context exclusions; no proof or security suppression is added by this ledger. Ratchet-exception: .hypatia-ignore — record alert 331 as a reviewed false positive for fixed read-only Git argv through execFileSync with shell:false in tools/audit-inventory.mjs; re-review if these calls change. Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/agda.yml | 26 ++-- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/metadata.yml | 3 + .github/workflows/push-email-notify.yml | 10 +- .hypatia-ignore | 8 ++ .machine_readable/contractiles/README.adoc | 9 ++ .../contractiles/trust/trust.k9.ncl | 7 + PROOF-STATUS.adoc | 33 +++++ docs/audit/2026-11-06-evidence.adoc | 6 +- .../2026-11-06-repository-readiness.adoc | 128 +++++++++++++++++- docs/echo-types/MAP.adoc | 43 ++++-- docs/echo-types/echo-kernel-note.adoc | 38 ++++++ echo-types_chora.deed | 15 ++ scripts/setup-agda.sh | 13 ++ stapeln.toml | 5 +- tools/audit-inventory.mjs | 2 +- tools/check-metadata.sh | 34 ++++- 18 files changed, 348 insertions(+), 36 deletions(-) diff --git a/.github/workflows/agda.yml b/.github/workflows/agda.yml index 284e01da..3e107063 100644 --- a/.github/workflows/agda.yml +++ b/.github/workflows/agda.yml @@ -46,11 +46,11 @@ jobs: agdai-${{ runner.os }}-2.7.0.1-stdlib8326c747-abszf486c299- - name: Typecheck shipped closure and headlines run: | - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda - agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda cold-check: # A separate runner and no restored interfaces: cached success never @@ -66,11 +66,11 @@ jobs: run: bash scripts/setup-agda.sh - name: Cold typecheck shipped closure and headlines run: | - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda - agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/Smoke.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/AuditSmoke.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/characteristic/All.agda + agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/examples/All.agda experimental: name: Experimental echo-additive @@ -86,7 +86,7 @@ jobs: - name: Check experimental aggregate coverage run: bash scripts/check-experimental-aggregate.sh - name: Typecheck experimental closure on its own signal - run: agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/experimental/echo-additive/All.agda + run: agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/experimental/echo-additive/All.agda narrowing: name: Bit-narrowing exhibit @@ -100,7 +100,7 @@ jobs: - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries run: bash scripts/setup-agda.sh - name: Typecheck narrowing closure on its own signal - run: agda --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/NarrowingSmoke.agda + run: agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/NarrowingSmoke.agda cubical: name: Cubical epi/mono profile @@ -114,4 +114,4 @@ jobs: - name: Install checksum-pinned Agda 2.7.0.1 and pinned libraries run: bash scripts/setup-agda.sh - name: Typecheck isolated full-Cubical profile - run: agda --ignore-interfaces --safe --cubical -i proofs/agda proofs/agda/EchoImageFactorizationPropCubical.agda + run: agda --no-libraries -i "$AGDA_STDLIB" -i "$ABSOLUTE_ZERO_AGDA" --ignore-interfaces --safe --cubical -i proofs/agda proofs/agda/EchoImageFactorizationPropCubical.agda diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 94b40cd2..a723377c 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -38,4 +38,4 @@ jobs: # matches the sibling repos' pin (e.g. ochrance-framework). Bump # deliberately, never float: an unpinned reusable workflow is an # unpinned trust boundary. mirror.yml / scorecard.yml already pin. - uses: metadatastician/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@ba640e9a57f22608710ffecdca282074eac55a0b diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 1c3826f6..3250ce32 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -52,7 +52,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - # Match the source-ref in the fleet envelopes. + # Scan the same PR head checked out by the fleet producer. ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Setup Elixir 1.19.4 / OTP 28.3 for Hypatia scanner diff --git a/.github/workflows/metadata.yml b/.github/workflows/metadata.yml index 7d2779da..82ae565d 100644 --- a/.github/workflows/metadata.yml +++ b/.github/workflows/metadata.yml @@ -67,4 +67,7 @@ jobs: - name: Validate deed and active K9 contracts # The metadata checker validates declarations. It does not execute # declared probes, install Agda, or rely on an Agda job's status. + env: + BUN: ${{ runner.temp }}/metadata-bin/bun + K9_NICKEL: ${{ runner.temp }}/metadata-bin/nickel run: bash tools/check-metadata.sh diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 15508481..6fd5373e 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -40,10 +40,16 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - name: Monitor outbound requests before supplying SMTP credentials + - name: Restrict outbound requests before supplying SMTP credentials uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 with: - egress-policy: audit + egress-policy: block + # The pinned action downloads its checksum-verified release binary, + # then connects only to the configured implicit-TLS SMTP endpoint. + allowed-endpoints: >- + github.com:443 + release-assets.githubusercontent.com:443 + ${{ secrets.SMTP_HOST }}:${{ secrets.SMTP_PORT || '465' }} - name: Send push notification email uses: hyperpolymath/smtp-notify-action@e384daf6167a7a7567642d6a62060106244d2413 # v0.5.1 with: diff --git a/.hypatia-ignore b/.hypatia-ignore index 505318b4..b4e6a3d7 100644 --- a/.hypatia-ignore +++ b/.hypatia-ignore @@ -33,3 +33,11 @@ code_safety/agda_postulate:proofs/agda/Smoke.agda # never dereferenced over the network. It MUST remain http:// (changing it # to https would be semantically wrong and break SVG handling). Not CWE-319. code_safety/js_http_url_in_code:tools/banner/build-banner.mjs + +# code_safety/js_exec_sync — alert 331 points at the child_process import. +# audit-inventory uses execFileSync("git", argv, {shell: false}) exclusively. +# All call sites are fixed read-only ls-files/rev-parse argument arrays; the +# repository path is one argv value. No shell parses paths or command text. +# This is a reviewed CWE-78 false positive, not permission to add exec/execSync +# or a shell-enabled call. Re-evaluate this exact file/rule if its calls change. +code_safety/js_exec_sync:tools/audit-inventory.mjs diff --git a/.machine_readable/contractiles/README.adoc b/.machine_readable/contractiles/README.adoc index 0c1d5433..18f58a76 100644 --- a/.machine_readable/contractiles/README.adoc +++ b/.machine_readable/contractiles/README.adoc @@ -21,3 +21,12 @@ sign-off dates remain in these declarations. Validate grammar and K9 semantics with `bash tools/check-metadata.sh` from the repository root. Run the named root recipes separately to discharge obligations. + +`ei-2-record-intact` restores the repository-specific pre-estate Trust check. +Its source is `3ce822e91c56b9096f351d6582442ded22614bfd:contractiles/Trustfile.a2ml`; +the retired STATE record remains available at revision `39a7a99`. +The successor `(ei-2)` chora clause preserves the negative PATH-B verdict, +the older stronger impossibility wording as history, the report's current +qualification, and the claims audit's missing-module warning. The metadata +validator requires those records; it does not reopen EI-2 or claim the missing +generic theorem or cited 2-cell modules have been mechanised. diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl index 38dc029c..9487e9de 100644 --- a/.machine_readable/contractiles/trust/trust.k9.ncl +++ b/.machine_readable/contractiles/trust/trust.k9.ncl @@ -33,6 +33,13 @@ K9! }, declaration = { verifications = [ + { + id = "ei-2-record-intact", + description = "Preserve the EI-2 negative PATH-B record, its superseded readings, and the documented historical/audit qualifications.", + probe = "bash tools/check-metadata.sh", + status = 'declared, + notes = "Migrates the repository-specific pre-estate Trustfile check without restoring A2ML or promoting its stronger historical claims into current proof results." + }, { id = "assumption-boundary", description = "Full-Cubical and postulated roots stay separate from the ordinary aggregate.", diff --git a/PROOF-STATUS.adoc b/PROOF-STATUS.adoc index 6a080cac..e4392ff7 100644 --- a/PROOF-STATUS.adoc +++ b/PROOF-STATUS.adoc @@ -249,3 +249,36 @@ This does not broaden what the test proves. * The EI-2 integration-recipe-distinctness investigation is *terminated negatively* and must not be reopened (see `docs/EI2_REPORT.adoc`); the narrower adjacency questions above are separate. + +== 2026-11-06 toolchain and warning receipt + +This dated update supersedes the earlier current-status wording about unpinned +CI and undispatched narrowing. PR #360 introduces the checksum-pinned official +Agda 2.7.0.1 binary and separate core, cold, experimental, narrowing and Cubical +jobs. Local setup verifies stdlib commit +`8326c7475af1fa456ca04a0203c168d5d7ff842b` (v2.3) and absolute-zero commit +`f486c29903434589117fa0662c6f29b0f17d1d5f`. The main-branch release status must +be read from link:docs/audit/2026-11-06-repository-readiness.adoc[the readiness ledger]; +a draft PR and local checks do not mean every remote job has passed. + +Fresh warning counts under these exact dependencies are measured below. +A count is the number of emitted `warning: -W[no]UnsupportedIndexedMatch` +diagnostics, with the immediately preceding `.agda` location used to identify +stdlib origins. Warnings may be replayed through imports; these are log-message +counts, not distinct defects or a comparable score across different root/cache +profiles. No warning-suppression flag was used. + +[cols="3,1,1,3",options="header"] +|=== +|Receipt |All emitted |Stdlib emitted |Scope +|`AuditSmoke-cold.log` |1264 |1167 |Fresh `--ignore-interfaces` AuditSmoke closure +|`All-final.log` |888 |771 |Final local All check with existing interfaces +|`container-build.log` |1935 |1522 |Fresh container All closure, ordinary safe profile +|=== + +The exact reproduction commands, source identities, ordinary/Cubical boundary, +new ordered-erasure warning limitations and independent proof-lane negative +controls are recorded in link:docs/audit/2026-11-06-evidence.adoc[the proof ledger] +and the readiness ledger. Raw local receipts and `warning-counts.json` remain +under ignored `build/audit-2026-11-06/`. The older November 1 measurements retain +their original date and candidate toolchain; they are not silently relabeled. diff --git a/docs/audit/2026-11-06-evidence.adoc b/docs/audit/2026-11-06-evidence.adoc index c36536e7..5666534d 100644 --- a/docs/audit/2026-11-06-evidence.adoc +++ b/docs/audit/2026-11-06-evidence.adoc @@ -80,11 +80,11 @@ It passed 15 direct/audit targets and the seven existing CI roots. The separate proofs/agda/AuditSmoke.agda ---- -`tools/check-guardrails.sh proofs/agda` passed with its three existing exemptions. A line-ending-normalized temporary copy of the unchanged guard script was used under WSL. `git diff --check` also passed. The original inventory receipt used `python3 tools/audit-inventory.py` (historical command at that audit step). The current replacement is `bun tools/audit-inventory.mjs`; its equivalence check is being verified separately. Static coverage is explicitly separate from compiler evidence. +`tools/check-guardrails.sh proofs/agda` passed with its three existing exemptions. A line-ending-normalized temporary copy of the unchanged guard script was used under WSL. `git diff --check` also passed. The original inventory receipt used `python3 tools/audit-inventory.py` (historical command at that audit step). The current replacement is `bun tools/audit-inventory.mjs`; its completed equivalence check reproduces the closure counts and outside-closure list exactly (see the repository-readiness ledger). Static coverage is explicitly separate from compiler evidence. Local receipts are retained in ignored `build/audit-2026-11-06/`: `results.tsv`, `compiler.txt`, `provenance.txt`, `inventory.json`, `proof-sources.sha256`, `proof-sources-initial.sha256`, `manifest-verification.log`, and individual compiler logs (including `AuditSmoke-cold.log` and `All-final.log`). The original manifest preserves the initial suite/cold-check snapshot; the final manifest includes the two comment corrections. These are local checks, not a new remote CI run. -No commit, push, branch publication, or pull request was made. Existing ordinal source files were not edited; their inherited aggregate imports were treated only as build boundaries. +At the end of that initial local-only stage, no commit, push, branch publication, or pull request had been made. Subsequent authorized publication is recorded in the repository-readiness ledger. Existing ordinal source files were not edited; their inherited aggregate imports were treated only as build boundaries. == Governance documentation remediation (2026-11-06) @@ -98,7 +98,7 @@ For #282, `LICENSE` already has a matching MPL-2.0 SPDX header and body; it has Contribution links resolve, the archive matches its pre-move SHA256, and `git diff --check` passes. These local checks do not certify OpenSSF status or modify remote repository settings. The older CC-BY-4.0 documentation declaration in README and `LICENSE-docs` differs from many per-file CC-BY-SA-4.0 headers and the estate default; reconciling that existing licence history remains an owner decision, outside this no-relicensing correction. -The current static invocation-profile check is `sh scripts/check-agda-invocations.sh`. Earlier Python invocations in dated receipts describe the previous implementation; they are not current setup instructions. The Bun inventory conversion and shell guard conversion require their own equivalence checks, distinct from the completed Agda source checks above. +The current static invocation-profile check is `sh scripts/check-agda-invocations.sh`. Earlier Python invocations in dated receipts describe the previous implementation; they are not current setup instructions. The Bun inventory conversion and shell guard conversion passed their separate equivalence and rejection checks; see the repository-readiness ledger. These checks remain distinct from the completed Agda source checks above. === Prose licence scope — owner decision packet diff --git a/docs/audit/2026-11-06-repository-readiness.adoc b/docs/audit/2026-11-06-repository-readiness.adoc index e0e391b3..6135291f 100644 --- a/docs/audit/2026-11-06-repository-readiness.adoc +++ b/docs/audit/2026-11-06-repository-readiness.adoc @@ -139,9 +139,131 @@ zero open Dependabot alerts and zero open GitHub secret-scanning alerts. This snapshot is not a claim about future alerts or scanner completeness. The raw alert values/secrets were not copied into this document. -PANIC/PONS scans, semantic DEED/K9 validation, final PR checks and final alert -reconciliation are pending in this working ledger and must be appended before -readiness is declared. +Local scanner and semantic metadata results are recorded below. Final PR checks +and alert reconciliation remain separate release gates. + +== Local integration receipt and first publication + +Commit `448613f5743696d60b001c1607279490c91ff1f8` was pushed and draft PR #360 +opened against the recorded baseline. The draft is not a merged release. + +* DEED grammar and registered identity validation pass. All eight active K9 + components pass strict native validation with Nickel 1.18.0, with zero + warnings and zero skipped layers; all six paired schemas typecheck. The checker + inventories all tracked/unignored active K9 files, including documentation + paths. The haplotype specimen is marked inert `.k9.ncl.in`, with its incomplete + semantics explicitly documented rather than called a validated contract. +* Metadata rejection controls pass: missing standards, missing Nickel, a + grammar-valid wrong UUID preimage, and an unreviewed active K9 file under + `docs/` all fail. The verifier dependencies are checked byte-for-byte against + their pinned Git blobs. +* Experimental and narrowing proof mutants fail specifically on unsolved metas + in their respective lanes, while `All.agda` passes. Each mutation was restored + in an isolated test copy; workspace proofs were not mutated for these tests. + Receipts: `build/audit-2026-11-06/lane-mutants/`. +* Static invocation checks reject missing without-K, unsafe meta flags and an + unsafe `@agda` recipe. Aggregate coverage rejects block-commented, nested- + commented and line-commented imports. These close the two static-check gaps + reported on PR #359; neither check claims to parse arbitrary shell or prove Agda. +* A comment-only update points `EchoHaplotypeCollapsing.agda` to the inert + specimen. That module was rechecked successfully with the pinned compiler and + libraries; its SHA256 is + `a1eca6beae258a6367298a28ca35501f5eeaa32d87a85aa4c405cca46d9e7ade`. + The other 144 files in the earlier 145-file proof manifest matched byte-for-byte. +* PANIC 2.5.5 at the recorded source revision scanned 213 candidate files with + 213 completed stated adapters. Initial findings exposed two unpinned container + bases and explicit root execution. The repaired container has no high/critical + findings in the follow-up scan. Two medium findings remain classified: the + deliberately quarantined postulated module is a real documented assumption; + the SVG `http://www.w3.org/2000/svg` namespace is not a network operation. + No dynamic stress/attack command was executed. PANIC's obsolete optional A2ML + manifest-reader warning is recorded; legacy metadata was not reintroduced. +* PONS 0.1.0 at the recorded revision scanned two JavaScript files. One new + inventory allocation pattern was repaired. Eight remaining heuristic warnings + concern constant-size banner loops (four corners, eight stages, at most six + edges and seven marks), not unbounded input. The run reported 21 skipped inputs; + Agda is outside its native source-analysis coverage. Its JSX parser skipped the + prototype, but Bun 1.4.4 parsed/bundled that file successfully with dependencies + externalized. This is evidence of a PONS coverage gap, not a browser test. +* The rootless Podman build completed, typechecking `All.agda` with the same + checksum-pinned compiler and revision-pinned libraries. Base image: + `cgr.dev/chainguard/wolfi-base@sha256:0efdcacdc6ab6d4f00507f1c0aa35e6bcbd50f838a45fe560e0e3b12056e3181`. + Package provisioning occurs in the build administrator context; downloads, + proof checking and the runtime carrier use UID 65532. The initial build exposed + BusyBox/GNU checksum-option incompatibility, repaired by explicitly installing + coreutils. The carrier's shell exists; the old static-image shell entrypoint + was not executable. Container checking covers All, not every independent root. +* `stapeln.toml` now records preferences for that single Containerfile instead of + a competing unpinned pipeline and unissued signing/verification claims. Its + TOML shape matches the owning example at `metadatastician/stapeln` + `33d7e5ee28d8de2170fe8671323c41c8bae221d7`. No executable consumer of these TOML + preferences was established; Podman flags are the actual enforcement evidence. +* Gitbot enrollment names three applicable report adapters and explains six + declines. The pinned producer and Hypatia consumer share the same source SHA. + Consumer negative controls preserve missing/not-run reports as orange advisory + rows. A green aggregate color is not proof that every enrolled reporter ran; + the actual adapter results must be inspected. + +The new Base ruleset requires pull requests, resolved review threads, signed +commits and linear history. GitHub rejected the canonical organization's +integration bypass actors for this user-owned repository (HTTP 422). The +accepted ruleset has *no bypass actors*, preserving stricter protection. +Existing secret-scanner protection was retained. Required check names are added +from actual emitted job results, not invented contexts. + +After the allowlist repair, fresh baseline Governance run `42221254568` started +21 jobs instead of failing at startup. Its historical Python source violation and +Allowlist Preflight findings are distinct from the new PR's results and must not +be represented as fixed merely because the workflow now starts. + +== First PR run and bounded repairs + +The first run at `448613f5743696d60b001c1607279490c91ff1f8` provided new +evidence rather than an all-green release. Agda run `42222241232` passed its +cold ordinary, experimental and narrowing lanes. The ordinary cached lane +failed the separate kernel classification guard: seven new modules needed +explicit documentation classification. Those entries are now supplied without +weakening the guard. The full-Cubical lane exposed Agda 2.7.0.1's first-use +primitive-interface compiler panic (exit 154, `Signature.hs:872`). The setup +helper now bootstraps the compiler's own primitive interface in the safe, +without-K, cubical-compatible profile. A fresh full-Cubical check then passed; +the theorem's full-Cubical flags are unchanged. All lanes explicitly disable +ambient libraries and supply the pinned library paths. + +Metadata run `42222241673` exposed the native validator's requirement for an +executable Nickel path. The wrapper now resolves PATH names to absolute paths; +the workflow also supplies its installed paths explicitly. PATH-only positive +validation and missing-tool rejection pass. EI2's historical negative finding +is preserved by a restored guard, together with the current report's narrower +interpretation; six rejection controls cover accidental removal or reopening. + +Governance run `42222242037` exposed an older callee's stale allowlist and the +root-file ratchet. The reusable workflow is advanced to the reviewed standards +revision recorded above. Four root entries register actual architecture files; +a ledger-scoped ratchet exception records those additions. No proof guard +exemption is added. A second scoped exception records Hypatia alert #331's +reviewed false positive: the inventory uses only fixed read-only Git argument +arrays with `execFileSync` and `shell: false`. The precise file/rule suppression +must be reconsidered if those calls change. SMTP containment is separately +repaired with blocking egress and explicit release-download and configured +SMTP endpoints; credentialed delivery is not tested because notification is +not enabled. + +The secret scanner and both CodeQL language jobs passed on the first head. +Gitbot's three actual report envelopes contained rhodibot 13 errors/1 info, +finishingbot 8 errors/257 warnings/6 info, and glambot 1 warning/133 info. +These are advisory findings, not security clearance. Many expect retired +A2ML/SCM metadata or miss Agda proof checks; 129 of 209 reference warnings +resolve by existing relative/root paths or Agda module basenames. Historical +and explicitly absent research references are not silently rewritten. The +envelope `ref` identifies fleet tool revision `34908580...`, not the scanned +source revision. The producer and consumer source checkouts identify the target. + +CodeRabbit comment `6685429337` skipped review because 138 selected files exceed +its 100-file limit; account usage availability was also reported. No independent +review or paid usage is inferred. Other installed app registrations without +completed check runs do not establish app health. GitHub installation inventory +was unavailable to this credential (HTTP 403). == Decisions and obligations that setup does not settle diff --git a/docs/echo-types/MAP.adoc b/docs/echo-types/MAP.adoc index ab119610..8ea92622 100644 --- a/docs/echo-types/MAP.adoc +++ b/docs/echo-types/MAP.adoc @@ -58,7 +58,7 @@ remainder of information-losing computation: for `f : A → B`, `docs/echo-types/echo-kernel-note.adoc`. * Library: `echo-types.agda-lib` (`depend: standard-library absolute-zero`). -* Concept doc: `docs/echo-types/overview.md`, +* Concept doc: `docs/echo-types/overview.adoc`, `docs/echo-types/types-abstract.adoc`, `docs/echo-types/paper.adoc`. @@ -68,7 +68,7 @@ remainder of information-losing computation: for `f : A → B`, builds against.* A dotted `Echo.*` namespace under `proofs/agda/Echo/` that re-exports and packages the proven flat modules behind stable names, so consumers depend on a small documented surface rather than -the research sprawl. Contract doc: `FOUNDATION_CONTRACT.md` (repo +the research sprawl. Contract doc: `FOUNDATION_CONTRACT.adoc` (repo root). All build `--safe --without-K`, zero postulates; wired into `All.agda`, pinned in `Smoke.agda`. @@ -339,6 +339,33 @@ proposed as adequate substitutes for Echo, now provably aren't: shadow admits a section that the source `LEcho` provably does not. `proofs/agda/EchoLLEncoding.agda`. +== Foundation audit companions (2026-11-06) `[LOCAL-CHECKED]` + +These derived modules are outside the two-file kernel cone. Their completed +local Agda checks are recorded in link:../audit/2026-11-06-evidence.adoc[the evidence ledger]; +PR workflow results are tracked in link:../audit/2026-11-06-repository-readiness.adoc[the readiness ledger]. +`[LOCAL-CHECKED]` does not mean merged or remotely green. + +* `EchoSourcePreserving` and `EchoDependentPushforward`: kernel-plus-stdlib + fibre results using pointwise equality, including the source-preserving + identity criterion and dependent pushforward/reindexing adjunction data. + Composition is a natural isomorphism; full base-indexed coherence is not claimed. +* `EchoCNOSemantics`: derived bridge through `EchoCNOBridge` and pinned native + `CNO.state-eq`. Its source-preserving relation-fibre map criterion and + same-program certification are scoped to the external total zero-energy model. +* `EchoGradedComonadNaturality` and `EchoErasingGradedComonad`: strengthened + companion obligations plus a concrete natural-grade erasing model. Grade UIP + is explicit in the interface and discharged for Nat in the model; no global + funext/UIP is introduced. Ordered grade-change proofs retain their recorded + Cubical transport computation limitations. +* `EchoNaturalityIndependence`: stdlib-only one-object categorical countermodel, + rather than an inhabitant of the polymorphic graded-comonad record. +* `EchoThinPreorderExample`: derived from `Echo.Index.ThinPoset`, showing the + legacy interface permits distinct mutually reachable objects. + +The dependency and assumption classification is in +link:echo-kernel-note.adoc[the kernel note]. No new guardrail exemption follows. + == Directions === Thermodynamic — Landauer/Bennett energy bounds `[REAL]` @@ -412,7 +439,7 @@ Constructive fiber theory ↔ JanusKey "architecturally impossible data loss". * Proofs: `proofs/agda/EchoJanusBridge.agda`. -* Docs: `docs/EchoJanusBridge.md`, `docs/EchoBridges.md`. +* Docs: `docs/bridges/EchoJanusBridge.adoc`, `docs/bridges/EchoBridges.adoc`. === Ephapax L3 — linear/affine modality bridge `[REAL]` Cross-repo navigability marker for the `hyperpolymath/ephapax` @@ -472,18 +499,18 @@ postulates. quantity-semantics port (`@0`-style erasure) is the documented next slice. === Tropical / Dyadic `[REAL*]` -Bridge domains enumerated in `docs/EchoBridges.md` (JanusKey / CNO / +Bridge domains enumerated in `docs/bridges/EchoBridges.adoc` (JanusKey / CNO / Tropical / Dyadic). Dyadic is mechanised; Tropical is named/early. * Proofs: `proofs/agda/Dyadic.agda`, `proofs/agda/DyadicEchoBridge.agda`. -* Docs: `docs/EchoBridges.md`. +* Docs: `docs/bridges/EchoBridges.adoc`. === MAA Framework integration `[ROADMAP]` Connect echo types with MAA's reversibility proofs (`maa-echo-equivalence`). absolute-zero lives under `…/verification-ecosystem/maa-framework/`. Planned, not built. -* Docs: `roadmap.adoc` §"Deferred research track", `docs/EchoJanusBridge.md`. +* Docs: `roadmap.adoc` §"Deferred research track", `docs/bridges/EchoJanusBridge.adoc`. === Shannon / information theory `[REAL*]` Partial. The *discrete non-distinguishing* form lands as @@ -657,13 +684,13 @@ are kept for history and **may overclaim** (pre-retraction). `roadmap.adoc`) | Concept / definition -| `docs/echo-types/overview.md`, `docs/echo-types/taxonomy.md`, +| `docs/echo-types/overview.adoc`, `docs/echo-types/taxonomy.adoc`, `docs/echo-types/paper.adoc`; doc-side UI sketches: `docs/echo-types/prototypes/` | `COMPREHENSIVE_DOCUMENTATION.md` | Bridges -| `docs/EchoBridges.md` + this file's Directions +| `docs/bridges/EchoBridges.adoc` + this file's Directions | `docs/echo-types/cross-repo-bridge-status.md` (detail) | Adjacency / related theory diff --git a/docs/echo-types/echo-kernel-note.adoc b/docs/echo-types/echo-kernel-note.adoc index 61b5d8cc..6f8341b5 100644 --- a/docs/echo-types/echo-kernel-note.adoc +++ b/docs/echo-types/echo-kernel-note.adoc @@ -225,6 +225,44 @@ kernel** — the boundary is real and lives outside this core. `proofs/agda/Echo/` (dotted submodules), so they are outside the flat `Echo*.agda` glob that Check B lints; recorded here for discoverability. Not kernel (the kernel remains exactly `Echo`). + +| *Derived — Tier 1 additions (2026-11-06)* +| `EchoSourcePreserving`, `EchoDependentPushforward` +| Each imports only `Echo` and stdlib. The former proves the source-preserving + identity-fibre criterion and Boolean-negation counterexample. The latter + develops dependent pushforward/reindexing with pointwise hom equality, + unit/counit triangles, and a composition natural isomorphism; it does not + establish full base-indexed coherence. Neither adds global funext or UIP. + +| *Derived — external semantic bridge (2026-11-06)* +| `EchoCNOSemantics` +| Imports `Echo`, `EchoCNOBridge`, stdlib, and the pinned external `CNO` module. + Same-program certification and the source-preserving relation-fibre map + criterion use native `state-eq`, not propositional equality of function-valued + states. The identity/IsCNO characterization is scoped to that total, + zero-energy model; it is not a physical theorem or a FibreIso inverse-law claim. + +| *Derived — graded interface and model (2026-11-06)* +| `EchoGradedComonadNaturality`, `EchoErasingGradedComonad` +| The companion imports `EchoGradedComonadInterface` and adds pointwise map + congruence, counit/comultiplication naturality, and an explicit `grade-isSet` + field. It does not derive those obligations for every old instance. + The erasing model imports both interfaces, preserves values at grade zero, + and erases at positive natural grades. Its grade equality is proof irrelevant + by decidable Nat equality; no UIP for arbitrary value types is assumed. + Its ordered grade-change laws are separate from Echo's proposed tropical model. + The accepted `grade-change-compose` and `grade-change-δ` proofs retain the + recorded Cubical transport computation warnings. + +| *Derived — independent countermodels (2026-11-06)* +| `EchoNaturalityIndependence`, `EchoThinPreorderExample` +| The former is stdlib-only: a one-object category of Boolean endomorphisms + with pointwise equality shows naturality is an independent categorical + obligation; it is not a polymorphic `GradedComonadStructure` instance. + The latter imports `Echo.Index.ThinPoset` and stdlib and exhibits mutual + reachability of distinct Boolean objects. It refutes antisymmetry of the + legacy interface, not its reflexivity, transitivity, or thin homs. + |=== `EchoOrdinal` is Tier-1 off `Echo` but additionally pulls two diff --git a/echo-types_chora.deed b/echo-types_chora.deed index f395c485..32815257 100644 --- a/echo-types_chora.deed +++ b/echo-types_chora.deed @@ -37,6 +37,21 @@ (source :name "standards" :revision "ba640e9a57f22608710ffecdca282074eac55a0b") (source :name "rsr-template-repo" :revision "acdc0ebd1d69f3f70995f4eec078e342078dd885") (source :name "gv-clade-index" :revision "2cfabd15d6cb966ed369ee13aa7174b960f45abd")) + (ei-2 + :record-version 1 + :status closed-negatively + :route path-b + :closed "2026-04-29" + :data-points 7 + :authoritative-report "docs/EI2_REPORT.adoc" + :superseded-readings "docs/EI2_READINGS_COMPARISON.adoc" + :historical-record-source "39a7a99cbe19a918843e9624010510b5fc3b8366:.machine_readable/6a2/STATE.a2ml" + :historical-trust-source "3ce822e91c56b9096f351d6582442ded22614bfd:contractiles/Trustfile.a2ml#ei-2-record-intact" + :historical-closing-rationale "The retired STATE record said the full 2D iff theorem was not formalisable in safe Agda without postulates." + :current-qualification "The report does not prove that every safe formulation is impossible; the generic iff remains unproved." + :audit-contradiction "The report cites a 2-cell distinctness argument, but the current claims audit records that the cited Sophisticated modules do not exist and that half is unmechanised." + :audit-source "docs/CLAIMS_AUDIT.adoc" + :do-not-reopen #t) (validation :metadata-command "bash tools/check-metadata.sh" :proof-command "just test" :guard-command "just guard" :status declared :note "No assurance grade, signature or certification is asserted.")) diff --git a/scripts/setup-agda.sh b/scripts/setup-agda.sh index 015b0cad..82c98593 100644 --- a/scripts/setup-agda.sh +++ b/scripts/setup-agda.sh @@ -29,6 +29,19 @@ if [ "$actual_version" != "Agda version $AGDA_VERSION" ]; then exit 1 fi +# Agda 2.7.0.1 can panic in Signature.hs when its first primitive-interface +# build is in full-Cubical mode. Bootstrap the compiler's own Primitive +# interface in the standard safe profile first. Only this generated cache +# file is discarded; the release sources and proof profiles are unchanged. +rm -f "$Agda_datadir/lib/prim/_build/$AGDA_VERSION/agda/Agda/Primitive.agdai" +cat > "$tool_dir/AgdaToolchainBootstrap.agda" <<'AGDA' +{-# OPTIONS --safe --without-K --cubical-compatible #-} +module AgdaToolchainBootstrap where +open import Agda.Primitive using (Level) +AGDA +"$agda_root/bin/agda" --no-libraries --safe --without-K --cubical-compatible \ + -i "$tool_dir" "$tool_dir/AgdaToolchainBootstrap.agda" + fetch_pinned() { local url="$2" revision="$3" destination="$tool_dir/$1" actual if [ ! -d "$destination/.git" ]; then diff --git a/stapeln.toml b/stapeln.toml index 81365381..86590831 100644 --- a/stapeln.toml +++ b/stapeln.toml @@ -1,8 +1,9 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # The Containerfile is the single build definition; no parallel unpinned layers. -# Podman builds are verified separately. This file declares launcher preferences, -# not evidence of a stapeln/vordr/svalinn run or of a signed published image. +# This records declarative build/security preferences matching the upstream +# example. Podman + Containerfile is the executed build path; these declarations +# are not evidence of a stapeln/vordr/svalinn run or a signed published image. [metadata] name = "echo-types" version = "0.1.0-alpha" diff --git a/tools/audit-inventory.mjs b/tools/audit-inventory.mjs index 825627a6..e0e15072 100644 --- a/tools/audit-inventory.mjs +++ b/tools/audit-inventory.mjs @@ -14,7 +14,7 @@ const excluded = new Set([ ]); const entrypoints = ['All', 'Smoke', 'characteristic/All', 'examples/All', 'EchoImageFactorizationPropCubical', 'experimental/echo-additive/All', 'NarrowingSmoke']; -const git = (...args) => execFileSync('git', ['-C', root, ...args], { encoding: 'utf8' }); +const git = (...args) => execFileSync('git', ['-C', root, ...args], { encoding: 'utf8', shell: false }); const paths = text => text.split('\0').filter(Boolean); const tracked = new Set(paths(git('ls-files', '-z'))); const local = new Set([...tracked, ...paths(git('ls-files', '--others', '--exclude-standard', '-z'))]); diff --git a/tools/check-metadata.sh b/tools/check-metadata.sh index 2131b2af..efb9240a 100644 --- a/tools/check-metadata.sh +++ b/tools/check-metadata.sh @@ -23,8 +23,17 @@ for source in \ actual_blob=$(git -C "$standards" hash-object --no-filters "$source") [[ $actual_blob == "$expected_blob" ]] || fail "validator source differs from its pin: $source" done -command -v "$bun" >/dev/null || fail "Bun is required (set BUN to its executable)" -command -v "$nickel" >/dev/null || fail "Nickel is required for semantic K9 validation (set K9_NICKEL)" +resolve_executable() { + local resolved + resolved=$(command -v -- "$1") || return 1 + [[ -f $resolved && -x $resolved ]] || return 1 + case "$resolved" in + /*) printf '%s\n' "$resolved" ;; + *) printf '%s/%s\n' "$(cd -- "$(dirname -- "$resolved")" && pwd)" "$(basename -- "$resolved")" ;; + esac +} +bun=$(resolve_executable "$bun") || fail "Bun is required (set BUN to its executable)" +nickel=$(resolve_executable "$nickel") || fail "Nickel is required for semantic K9 validation (set K9_NICKEL)" mapfile -d '' retired < <(find .machine_readable -type f -name '*.a2ml' -print0) [[ ${#retired[@]} == 0 ]] || fail "retired .a2ml records remain: ${retired[*]}" @@ -72,9 +81,30 @@ trap 'rm -rf -- "$tmp"' EXIT field(clause("clade"), "primary", "symbol", "fv"); field(clause("clade"), "primary-name", "string", "Formal Verification & Proofs"); field(clause("forges"), "github", "string", "hyperpolymath/echo-types"); + const ei2 = clause("ei-2"); + field(ei2, "record-version", "integer", "1"); + field(ei2, "status", "symbol", "closed-negatively"); + field(ei2, "route", "symbol", "path-b"); + field(ei2, "closed", "string", "2026-04-29"); + field(ei2, "data-points", "integer", "7"); + field(ei2, "authoritative-report", "string", "docs/EI2_REPORT.adoc"); + field(ei2, "superseded-readings", "string", "docs/EI2_READINGS_COMPARISON.adoc"); + field(ei2, "historical-record-source", "string", "39a7a99cbe19a918843e9624010510b5fc3b8366:.machine_readable/6a2/STATE.a2ml"); + field(ei2, "historical-trust-source", "string", "3ce822e91c56b9096f351d6582442ded22614bfd:contractiles/Trustfile.a2ml#ei-2-record-intact"); + field(ei2, "historical-closing-rationale", "string", "The retired STATE record said the full 2D iff theorem was not formalisable in safe Agda without postulates."); + field(ei2, "current-qualification", "string", "The report does not prove that every safe formulation is impossible; the generic iff remains unproved."); + field(ei2, "audit-contradiction", "string", "The report cites a 2-cell distinctness argument, but the current claims audit records that the cited Sophisticated modules do not exist and that half is unmechanised."); + field(ei2, "audit-source", "string", "docs/CLAIMS_AUDIT.adoc"); + field(ei2, "do-not-reopen", "boolean", "#t"); console.log("DEED grammar and recorded registry identity: PASS"); ' "$tmp/chora.json" +grep -Fq 'EI-2 TERMINATED — negative verdict, via PATH B.' docs/EI2_REPORT.adoc || fail "EI-2 negative verdict record is missing" +grep -Fq 'not a proof that every safe formulation is impossible.' docs/EI2_REPORT.adoc || fail "EI-2 qualification against a universal impossibility claim is missing" +grep -Fq '= EI-2 readings comparison — SUPERSEDED' docs/EI2_READINGS_COMPARISON.adoc || fail "EI-2 superseded-readings record is missing" +grep -Fq 'the 2-cell half of the distinctness claim is unmechanised.' docs/CLAIMS_AUDIT.adoc || fail "EI-2 cited-module audit qualification is missing" +printf 'EI-2 negative record and historical/audit qualifications: PASS\n' + components=(coordination.k9.ncl .machine_readable/self-validating/examples/project-metadata.k9.ncl) for verb in must trust adjust dust bust intend; do components+=(".machine_readable/contractiles/$verb/$verb.k9.ncl") From 035861fad6aba9e1e57b6f6ac31e629cea438817 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 13:58:40 +0000 Subject: [PATCH 3/7] Complete capability records, public API checks and executable repository setup Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/CODE_OF_CONDUCT.md | 7 ++ .github/workflows/pages.yml | 9 +- .github/workflows/scorecard.yml | 6 +- SECURITY.md | 7 ++ build/guix.scm | 45 +++++----- docs/AUDIT.adoc | 17 ++++ docs/MAINTAINERS.adoc | 9 ++ .../2026-11-06-repository-readiness.adoc | 82 +++++++++++++++++++ docs/build.adoc | 70 +++++++++++++++- docs/characteristic.adoc | 10 +++ docs/echo-types/comparators.adoc | 4 +- docs/next-questions.adoc | 4 +- echo-types_chora.deed | 28 +++++++ manifest.scm | 26 +----- proofs/agda/Smoke.agda | 25 ++++++ roadmap-gates.adoc | 2 +- roadmap.adoc | 2 +- scripts/check-no-unsafe.sh | 18 ++-- scripts/prepare-pages.sh | 45 ++++++++++ scripts/verify.sh | 24 +++--- tools/check-metadata.sh | 30 +++++++ wiki/Overview.adoc | 2 +- wiki/Tutorial-Consuming-Echo.adoc | 6 +- wiki/Working-Rules.adoc | 2 +- 24 files changed, 383 insertions(+), 97 deletions(-) create mode 100644 .github/CODE_OF_CONDUCT.md create mode 100644 SECURITY.md create mode 100644 docs/AUDIT.adoc create mode 100644 docs/MAINTAINERS.adoc create mode 100644 scripts/prepare-pages.sh diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md new file mode 100644 index 00000000..d6775de9 --- /dev/null +++ b/.github/CODE_OF_CONDUCT.md @@ -0,0 +1,7 @@ + + + +# Code of conduct + +See the canonical [code of conduct](../CODE_OF_CONDUCT.adoc). +This discovery pointer does not change that document's policy or existing licence terms. diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index f461a822..5c519cc3 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -14,6 +14,8 @@ concurrency: cancel-in-progress: false jobs: build: + # A manual feature-branch run must not replace the public documentation. + if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) runs-on: ubuntu-latest timeout-minutes: 15 container: @@ -35,12 +37,7 @@ jobs: run: idris2 Ddraig.idr -o ddraig - name: Build site run: | - mkdir -p src - if [ ! -f src/index.md ] && [ -f README.md ]; then - cp README.md src/index.md - elif [ ! -f src/index.md ]; then - echo "# ${GITHUB_REPOSITORY}" > src/index.md - fi + bash scripts/prepare-pages.sh src ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 656c84bf..0f7a8bb3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -6,6 +6,7 @@ name: Scorecards supply-chain security on: branch_protection_rule: + workflow_dispatch: schedule: - cron: '23 4 * * 1' @@ -15,6 +16,9 @@ permissions: jobs: analysis: + # Manual refreshes measure the merged default branch. Keep the OIDC-bearing + # publication job off manually selected feature branches. + if: github.event_name != 'workflow_dispatch' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) # Caller-granted permissions per the scorecard-reusable contract # (its header documents: the caller MUST grant security-events:write # + id-token:write; contents:read lets it read the repo). Closes the @@ -27,4 +31,4 @@ jobs: contents: read security-events: write id-token: write - uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@ba640e9a57f22608710ffecdca282074eac55a0b diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..176c4566 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,7 @@ + + + +# Security policy + +See the canonical [security policy](SECURITY.adoc). +This discovery pointer does not change that document's policy or existing licence terms. diff --git a/build/guix.scm b/build/guix.scm index f6dbed6e..790bd6c3 100644 --- a/build/guix.scm +++ b/build/guix.scm @@ -1,29 +1,22 @@ ;; SPDX-License-Identifier: MPL-2.0 -;; Guix development environment. -;; Usage: guix shell -D -f build/guix.scm +;; Development prerequisites, not a distributable echo-types package. +;; Usage: guix shell -m build/guix.scm -- bash +;; Then follow docs/build.adoc to install the checksum-pinned Agda toolchain. +;; Syntax: GNU Guix manual, "Writing Manifests" and "Invoking guix shell". +;; https://guix.gnu.org/manual/en/html_node/Writing-Manifests.html +;; Package versions follow the caller's Guix channel; no channel is pinned here. -(use-modules (guix packages) - (guix build-system gnu) - (guix licenses) - (gnu packages base) - (gnu packages bash) - (gnu packages agda) - (gnu packages base) - (gnu packages java) - (gnu packages rust) - (gnu packages cmake) - (gnu packages zig) - (gnu packages golang) - (gnu packages node) - (gnu packages python)) +(use-modules (gnu packages)) -(package - (name "echo-types") - (version "0.1.0") - (source #f) - (build-system gnu-build-system) - (inputs (list coreutils bash agda make openjdk rust cmake zig go node python)) - (synopsis "echo-types") - (description "echo-types — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/echo-types") - (license ((@@ (guix licenses) license) "MPL-2.0" "https://github.com/hyperpolymath/palimpsest-license"))) +(specifications->manifest + '("bash" + "coreutils" + "curl" + "git-minimal" + "nss-certs" + "tar" + "xz" + "findutils" + "grep" + "sed" + "gawk")) diff --git a/docs/AUDIT.adoc b/docs/AUDIT.adoc new file mode 100644 index 00000000..b9f4d72f --- /dev/null +++ b/docs/AUDIT.adoc @@ -0,0 +1,17 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Audit navigation + +Use the dated records for their stated source revisions, checks and limits: + +* link:audit/2026-11-06-evidence.adoc[Foundation evidence]: compiler checks, + dependency identities, inventory and warnings. +* link:audit/2026-11-06-repository-readiness.adoc[Repository readiness]: + standards reconciliation, issue disposition and evolving CI results. +* link:audit/2026-11-06-foundation-decisions.adoc[Foundation decisions]: + bounded mathematical choices and remaining research obligations. +* link:audit/2026-11-06-license-inventory.adoc[Licence inventory]: existing + notices and the unresolved prose-licence scope. + +These records distinguish local receipts, remote checks and unresolved work. +This index adds no execution receipt, certification or assurance grade. diff --git a/docs/MAINTAINERS.adoc b/docs/MAINTAINERS.adoc new file mode 100644 index 00000000..4ab08817 --- /dev/null +++ b/docs/MAINTAINERS.adoc @@ -0,0 +1,9 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Maintainer record + +The canonical link:../MAINTAINERS[MAINTAINERS] file lists maintainer roles, +responsibilities and participation expectations. Consult +link:../GOVERNANCE.adoc[GOVERNANCE.adoc] for the decision process. + +This navigation page does not change those records or their existing licence terms. diff --git a/docs/audit/2026-11-06-repository-readiness.adoc b/docs/audit/2026-11-06-repository-readiness.adoc index 6135291f..790d29e8 100644 --- a/docs/audit/2026-11-06-repository-readiness.adoc +++ b/docs/audit/2026-11-06-repository-readiness.adoc @@ -265,6 +265,88 @@ review or paid usage is inferred. Other installed app registrations without completed check runs do not establish app health. GitHub installation inventory was unavailable to this credential (HTTP 403). +== Repair-head verification and remaining compatibility limits + +Repair head `f413ea14012a6d2ea428a3746070e4b92678df1f` passed all five Agda +jobs in run `42226213296`, metadata `42226213288`, governance `42226214197`, +secret scanning `42226214020`, CodeQL, GitGuardian and Semgrep. Hypatia run +`42226214059` and its separate native SARIF check both passed: the graded source +findings were zero at every severity. Its 20 observations of prior main-branch +code-scanning alerts are separate from new source findings and require a fresh +main scan. Fleet advisory findings remain visible rather than being relabelled +as security findings or suppressed. + +Ruleset `26696686` (Verified Gates) requires 30 actually emitted contexts, with +strict up-to-date checking and no bypass actors. It includes governance gates, +secret scans, fleet production, Hypatia workflow plus native SARIF check, all +five proof lanes and metadata. Canonical advisory contexts and CodeQL remain +non-required, as prescribed by the owning gates table. Existing default-branch +governance context names were checked; the new proof/metadata lanes were added +from observed PR results before first merge, closing the otherwise ungated +first-release interval. Native Hypatia uses app integration 57789; Actions jobs +use 15368. No nonexistent status name was invented. + +The release review added explicit named Smoke pins for the new headline results. +That ordinary-profile check passed with the pinned compiler and libraries; +the exact updated Smoke SHA256 is +`b0d38fb6b82a41964584351b7886aa0f163bd2646c6a766a776852e2416b5d80`. +Current source and checked snapshot manifests matched. This extends API smoke +coverage without changing any theorem statement or assumption. + +The single deed now includes a populated manifest, descriptive directory map +and RSR capability profile. The native grammar, registry identity, scoped +profile checks and all eight strict K9 components pass. The independent native +`check-rsr-profile.sh` remains nonzero because its pinned gate table still asks +for `verification/proofs/`, a separate container directory and retired +manifest/descriptiles paths. Actual proofs live in `proofs/agda`, the root +Containerfile is executed, and descriptive records live in the one chora deed. +Real audit/maintainer and GitHub policy navigation pointers were added; empty +compatibility scaffolding was not. This is recorded in issue #361 and is not +represented as complete native RSR conformance. + +Fleet reference triage accounts for all 209 initial warnings. Verified active +renamed links were repaired. The last Gate 2 alias was resolved by commit +`8670ae9`: the delivered file was `docs/characteristic.adoc`; its original +parallel-instance naming note is retained with a dated correction. Existing +non-clickable shorthand, theorem identifiers, absent historical artifacts and +explicit research proposals remain distinguishable. Issues #361 and #362 track +owning-reader incompatibilities and external review/tool coverage respectively. + +== Final setup checks + +The Guix development manifest no longer declares a fictitious GNU package or +unrelated language runtimes. The root `manifest.scm` loads the single primary +`build/guix.scm`. Both evaluate; a pure shell provisions its 11 prerequisites, +resolves the tested tools within that profile, supplies CA certificates and +performs an HTTPS request. The committed pinned Agda setup and an Echo check +also pass inside that shell. Tested Guix channel: +`230aa373f315f247852ee07dff34146e9b480aec`. The channel is not pinned in-tree; +this is not a measured reproducibility claim. + +The Pages workflow previously fed a Markdown-only generator a fallback page +because this repository has an AsciiDoc README. It now builds a substantive +navigation page linking seven existing canonical documents at the deployed +source SHA. The exact pinned Ddraig source compiled and rendered that page +offline in the pinned container; the title and all seven HTML links passed +checks. Only the default branch can deploy, including manual runs. Public +availability still requires the actual GitHub Pages deployment result. + +The documented `scripts/verify.sh` now invokes the same four canonical guards +and proof runner as `just verify`, without requiring just. Its legacy unsafe +checker delegates to the existing comment-aware, explicitly scoped guardrails; +the three established profile/quarantine exemptions are unchanged. It no +longer rejects the documented quarantined module via an indiscriminate grep. + +Metadata controls additionally reject a missing capability profile, duplicated +capability, incorrect capability and duplicate capability field. Each failed +before a healthy verdict; the native positive grammar/K9 run passed. These +controls do not reinterpret the separately recorded native RSR path failures. + +Scorecard now allows a default-branch-only manual refresh and uses the reviewed +standards callee. Its minimal caller permissions are preserved. The old callee +already had native action-lock reconciliation; refreshing main, rather than +claiming a new reconciler, is what updates the stale alerts. + == Decisions and obligations that setup does not settle * Prose licensing: historical owner decisions use both CC-BY-4.0 and diff --git a/docs/build.adoc b/docs/build.adoc index 7117a3ff..80ee12e1 100644 --- a/docs/build.adoc +++ b/docs/build.adoc @@ -10,19 +10,71 @@ This repository contains mechanically verified proofs written in Agda. === Prerequisites -* Agda (with the standard library) -* `+just+` (command runner) +The pinned compiler setup supports Linux x86-64. It needs Bash, Git, curl, +tar, xz, a CA certificate bundle, and the usual GNU shell utilities. Agda +2.7.0.1 and both library revisions are selected by +`scripts/setup-agda.sh`; a distribution's Agda package does not select this +toolchain. + +From the repository root: + +[source,bash] +---- +export AGDA_TOOLS_DIR="$PWD/../.echo-proof-tools" +bash scripts/setup-agda.sh +source "$AGDA_TOOLS_DIR/env.sh" +---- + +The generated environment selects `AGDA`, `Agda_datadir`, `AGDA_DIR`, +`AGDA_STDLIB`, `ABSOLUTE_ZERO_AGDA`, and the compiler's `PATH` entry. +The setup downloads a checksum-verified Linux compiler and fetches exact +library commits. It does not install Guix or change the system's Agda +configuration. `just` is optional for the recipes below; its version and +the Bun version used by the inventory tool are declared in `mise.toml`. + +=== Guix development shell + +The manifest supplies the shell, download, archive, certificate, and static +check prerequisites above: + +[source,bash] +---- +guix shell -m build/guix.scm -- bash +export AGDA_TOOLS_DIR="$PWD/../.echo-proof-tools" +bash scripts/setup-agda.sh +source "$AGDA_TOOLS_DIR/env.sh" +---- + +The root `manifest.scm` loads this same manifest for callers using +`guix shell -m manifest.scm -- bash`. +This is a development manifest, not an Echo Types package build. It does +not provide Agda, Bun, Nickel, `just`, the security scanners, or a +documentation renderer. It follows the caller's Guix channel; there is +no checked-in channel pin or claim of a reproducible Guix environment. +Network access is needed for provisioning. Proof results still require +the explicit checks below. See the GNU Guix manual's +https://guix.gnu.org/manual/en/html_node/Writing-Manifests.html[Writing Manifests] +and https://guix.gnu.org/manual/en/html_node/Invoking-guix-shell.html[Invoking guix shell] +sections for the `-m` interface. === Verifying the Proofs -To run the complete verification suite, including safety checks and -build steps: +After sourcing the generated environment, run the canonical static guards +and the audit typechecking entrypoint: [source,bash] ---- sh scripts/verify.sh ---- +The wrapper runs kernel classification, foundation guardrails, experimental +aggregate coverage, and invocation-profile lint before +`tools/check-audit.sh`. The audit checker typechecks the ordinary, +experimental, narrowing, and isolated full-Cubical roots and writes dated +logs. Static lint success and typechecking results are separate evidence. +This entrypoint does not require `just` or run the metadata and security +scanners. + To build the Agda proofs via `+just+`: [source,bash] @@ -36,3 +88,13 @@ To run the full suite via `+just+`: ---- just test-all ---- + +=== Documentation site + +The Pages workflow compiles the pinned Ddraig generator in its pinned +Idris 2 container. `scripts/prepare-pages.sh` creates a Markdown landing +page with links to the canonical AsciiDoc documents at the deployed source +revision. Ddraig renders that landing page; GitHub renders the linked +AsciiDoc sources. Site publication is limited to the repository's default +branch, including manual workflow runs. Site generation supplies navigation; +proof checking uses the entrypoints above. diff --git a/docs/characteristic.adoc b/docs/characteristic.adoc index 1767ece0..15376766 100644 --- a/docs/characteristic.adoc +++ b/docs/characteristic.adoc @@ -36,6 +36,16 @@ parallel-instance lane discipline used to produce it. Rename or symlink at integration time. ==== +[NOTE] +==== +*Navigation correction, 2026-11-06.* The integration note above is retained +from Revision 4. Commit `8670ae9` (2026-04-29, “gate-2: characteristic theorem +family audit, revision 4”) added the document at `docs/characteristic.adoc`. +The parallel-instance name `docs/gate-2-characteristic.adoc` has no path history +in the available Git refs. Use `docs/characteristic.adoc` for current navigation; +this correction changes no historical nominee, theorem, or audit verdict. +==== + == Historical inherited spec (2026-05 audit) For the sceptic-facing evidence map ("is this just renamed Σ?", diff --git a/docs/echo-types/comparators.adoc b/docs/echo-types/comparators.adoc index 19e65b4d..2a1a9297 100644 --- a/docs/echo-types/comparators.adoc +++ b/docs/echo-types/comparators.adoc @@ -240,12 +240,12 @@ For balance — the affirmative side of the same discipline: credibility asset. * *No-left-inverse examples across decoration layers.* See the aggregate - row in `docs/theorem-index.md`. Each decoration *separately* + row in `docs/theorem-index.adoc`. Each decoration *separately* gives a non-injectivity consequence equally expressible using raw Σ. * *Per-decoration composition law lands by the same recipe in 6 layers.* graded, linear/affine, choreographic, access, cost, - search. See `degrade-laws` aggregate row in `theorem-index.md`. + search. See `degrade-laws` aggregate row in `docs/theorem-index.adoc`. * *Consumer-side abstraction barrier at the affine instance.* The Echo interface at affine mode does not export `proj₁`, and that diff --git a/docs/next-questions.adoc b/docs/next-questions.adoc index 78e3f032..f6ad5a8a 100644 --- a/docs/next-questions.adoc +++ b/docs/next-questions.adoc @@ -272,7 +272,7 @@ is not echo-specific. === Q2.3 — RoleGraded as nominee N5 `characteristic.RoleGraded.choreo-grade-commute` is flagged as a -candidate fifth nominee in `gate-2-characteristic.adoc` but not +candidate fifth nominee in link:characteristic.adoc[characteristic.adoc] but not adopted. Should it be? Status:: @@ -297,7 +297,7 @@ adopting underweights it relative to the per-axis nominees. === Q2.4 — Falsifier attempts for surviving nominees Each of the four surviving Gate 2 nominees has at least one -unattempted concrete falsifier (`gate-2-characteristic.adoc` §11 +unattempted concrete falsifier (link:characteristic.adoc[characteristic.adoc] §11 honest qualifications #3). The pass is conditional on those falsifiers being attempted and not succeeding. diff --git a/echo-types_chora.deed b/echo-types_chora.deed index 32815257..3929aab9 100644 --- a/echo-types_chora.deed +++ b/echo-types_chora.deed @@ -33,6 +33,34 @@ :supersedes "Retired 6a2 records; historical tree 39a7a99cbe19a918843e9624010510b5fc3b8366." :preserves "Proof-profile boundaries, source provenance, and the distinction between declarations and verification receipts." :evidence "Local working tree; not a published release or certification.") + (manifest + :version "1.0.0" + :project "echo-types" + :purpose "Constructive Agda proofs about dependent fibres and explicitly scoped loss, provenance and reversibility interfaces." + :instructions "CLAUDE.md" + :roadmap "roadmap.adoc" + :audit "docs/AUDIT.adoc" + :permissions "The current user task supplies authority; this manifest grants no external mutation or agent permissions." + :scope-exclusion "Ordinal mathematics belongs to the separate ordinal-notations repository.") + (ply + (directory :path "proofs/agda" :description "Mechanised proof sources; independent roots and assumptions are inventoried by tools/audit-inventory.mjs.") + (directory :path "docs" :description "Definitions, theorem claims, research obligations and dated audit evidence.") + (directory :path ".github" :description "Pinned workflows, repository automation and community discovery pointers.") + (directory :path ".machine_readable" :description "K9 contractile declarations, shared schemas and policy configuration; repository identity and descriptive records live in this deed.") + (directory :path "scripts" :description "Toolchain setup and proof/profile guards.") + (directory :path "tools" :description "Read-only inventory, metadata validation and verification runners.")) + (rsr-profile + :version "1.0.0" + :spec "rsr-criteria-v2" + :declares-against "2.1.1-draft" + :capabilities ("agda" "bash" "library" "formal-proofs" "container" + "reproducible-build" "docs-site" "governance-tier") + (notes + :proofs "Mechanised sources live in proofs/agda, with explicit independent profile boundaries." + :container "Root Containerfile builds an unprivileged proof-source carrier; no production service." + :reproducibility "build/guix.scm declares the primary recipe; a reproducibility comparison has not been measured." + :docs-site "The Pages workflow builds the documentation site; source capability is not deployment availability." + :governance "Existing governance, affirmation and maintainer records plus the dated audit ledger; no assurance grade or certification.")) (standards-sources (source :name "standards" :revision "ba640e9a57f22608710ffecdca282074eac55a0b") (source :name "rsr-template-repo" :revision "acdc0ebd1d69f3f70995f4eec078e342078dd885") diff --git a/manifest.scm b/manifest.scm index dd942c7f..433125b6 100644 --- a/manifest.scm +++ b/manifest.scm @@ -1,24 +1,6 @@ ;;; SPDX-License-Identifier: MPL-2.0 -;;; manifest.scm — Generic Guix manifest for RSR-compliant projects -;;; -;;; Usage: -;;; guix shell -m manifest.scm -;;; +;;; Compatibility entrypoint for the primary development manifest. +;;; Usage: guix shell -m manifest.scm -- bash +;;; Keep the package list and its limitations in build/guix.scm. -(specifications->manifest - '(;; Core development tools - "git" - "just" - "nickel" - "curl" - "bash" - "coreutils" - - ;; Documentation - "asciidoctor" - "pandoc" - - ;; Common build dependencies - "openssl" - "zlib" - "pkg-config")) +(load (string-append (dirname (current-filename)) "/build/guix.scm")) diff --git a/proofs/agda/Smoke.agda b/proofs/agda/Smoke.agda index 0eaf0cb0..47909b28 100644 --- a/proofs/agda/Smoke.agda +++ b/proofs/agda/Smoke.agda @@ -8,6 +8,31 @@ module Smoke where +-- Pin the audit's named public results as well as compiling their modules. +import EchoSourcePreserving as SourcePreserving using + ( source-preserving-implies-identity + ; identity-fibre-iso; identity-fibre-iso-preserves-source + ; negation-iso-not-source-preserving + ) +import EchoCNOSemantics as CNOSemantics using + ( CertifiedProgramEcho; certified-echo-native-null; native-null-to-cno + ; native-null-source-map; source-map-native-null; nop-not-certified + ) +import EchoDependentPushforward as DependentPushforward using + ( transpose-untranspose; untranspose-transpose + ; unit-natural; counit-natural; triangle-push; triangle-reindex + ; echo-roundtrip; terminal-push-roundtrip + ; push-composite-from-to; push-composite-to-from; push-composite-natural + ) +import EchoErasingGradedComonad as Erasing using + ( erasing-natural; bool-input-collision; positive-erasure-no-left-inverse + ; grade-change-natural; grade-change-id; grade-change-compose + ; grade-change-proof-independent; grade-change-ε; grade-change-δ + ; erase-is-grade-change + ) +import EchoNaturalityIndependence as NaturalityIndependence using + ( ε-naturality-fails; δ-naturality-fails ) + open import EchoGradedComonadNaturality using (NaturalGradedComonad) open import EchoThinPreorderExample using (indiscrete; no-antisymmetry) open import EchoGradedComonadInstance1 using (nat-natural-instance) diff --git a/roadmap-gates.adoc b/roadmap-gates.adoc index 1a4c9485..181fe273 100644 --- a/roadmap-gates.adoc +++ b/roadmap-gates.adoc @@ -153,7 +153,7 @@ does not count. [NOTE] ==== This table was amended on the basis of the audit in -`docs/gate-2-characteristic.adoc`. The previous nominees — +link:docs/characteristic.adoc[docs/characteristic.adoc]. The previous nominees — `EchoCharacteristic.visible-constraint`, the same `EchoGraded` lemma (then named only descriptively as "compositional degradation law"), and `EchoIntegration.knowledge-and-controlled-degradation` — were diff --git a/roadmap.adoc b/roadmap.adoc index 55901e5d..b4f6bf23 100644 --- a/roadmap.adoc +++ b/roadmap.adoc @@ -81,7 +81,7 @@ narrowing history and `roadmap-gates.adoc` for the test discipline. | Gate 2: Characteristic theorem family | PASSED (narrowed) -| `docs/characteristic.adoc` — 4 nominees, 3 survive threshold. Aggregate degrade-law family pinned in `docs/theorem-index.md`. +| `docs/characteristic.adoc` — 4 nominees, 3 survive threshold. Aggregate degrade-law family pinned in `docs/theorem-index.adoc`. | Gate 3: Canonical examples | PROVISIONAL diff --git a/scripts/check-no-unsafe.sh b/scripts/check-no-unsafe.sh index a15c1191..023a2b4f 100644 --- a/scripts/check-no-unsafe.sh +++ b/scripts/check-no-unsafe.sh @@ -2,16 +2,8 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -echo "Checking for unsafe constructs in proofs/agda..." - -# Search for postulate, TERMINATING, NON_TERMINATING, allow-unsolved-metas, ignoring lines containing -- that explain the lack of postulates. -UNSAFE=$(grep -rnE '^\s*postulate\b|{-# TERMINATING #-}|{-# NON_TERMINATING #-}|{-# OPTIONS.*--allow-unsolved-metas' proofs/agda) - -if [ -n "$UNSAFE" ]; then - echo "❌ Unsafe constructs found:" - echo "$UNSAFE" - exit 1 -fi - -echo "✅ No unsafe constructs found." -exit 0 +set -eu +cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)" +# Compatibility entrypoint. The canonical guard strips comments and enforces +# the existing, explicit quarantine/profile exemptions; do not duplicate it. +exec bash tools/check-guardrails.sh proofs/agda diff --git a/scripts/prepare-pages.sh b/scripts/prepare-pages.sh new file mode 100644 index 00000000..a22b8f8d --- /dev/null +++ b/scripts/prepare-pages.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Ddraig accepts Markdown; canonical documentation remains AsciiDoc. +set -euo pipefail + +repository="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}" +revision="${GITHUB_SHA:?GITHUB_SHA is required}" +if [[ ! "$repository" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || + [[ ! "$revision" =~ ^[0-9a-fA-F]{40}$ ]]; then + printf 'Expected a GitHub owner/repository and a full commit SHA.\n' >&2 + exit 2 +fi +root="$(cd "$(dirname "$0")/.." && pwd)" +destination="${1:-src}" +documents=(README.adoc docs/echo-types/what-echo-is.adoc PROOF-STATUS.adoc + docs/build.adoc tutorial/README.adoc docs/theorem-index.adoc docs/echo-types/MAP.adoc) +for document in "${documents[@]}"; do + test -f "$root/$document" || { + printf 'Missing canonical documentation: %s\n' "$document" >&2 + exit 1 + } +done +base="https://github.com/$repository/blob/$revision" +mkdir -p "$destination" +cat > "$destination/index.md" < -set -e - -echo "Running verifications..." - -echo "1. Checking no unsafe constructs..." -sh scripts/check-no-unsafe.sh - -echo "2. Building All.agda..." -agda --safe --without-K --cubical-compatible -i proofs/agda proofs/agda/All.agda - -echo "3. Running just verify..." -just verify - -echo "✅ All verifications passed." +set -eu +cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)" + +# Same guards and proof runner as `just verify`, without requiring just. +# Source the environment from scripts/setup-agda.sh before running this. +sh scripts/kernel-guard.sh +bash tools/check-guardrails.sh proofs/agda +sh scripts/check-experimental-aggregate.sh +sh scripts/check-agda-invocations.sh +exec bash tools/check-audit.sh diff --git a/tools/check-metadata.sh b/tools/check-metadata.sh index efb9240a..b88157fc 100644 --- a/tools/check-metadata.sh +++ b/tools/check-metadata.sh @@ -81,6 +81,36 @@ trap 'rm -rf -- "$tmp"' EXIT field(clause("clade"), "primary", "symbol", "fv"); field(clause("clade"), "primary-name", "string", "Formal Verification & Proofs"); field(clause("forges"), "github", "string", "hyperpolymath/echo-types"); + const manifest = clause("manifest"); + field(manifest, "project", "string", "echo-types"); + field(manifest, "instructions", "string", "CLAUDE.md"); + field(manifest, "roadmap", "string", "roadmap.adoc"); + field(manifest, "audit", "string", "docs/AUDIT.adoc"); + const directories = clause("ply").filter(x => x[0] === "clause" && x[1] === "directory"); + if (directories.length !== 6) fail("expected six descriptive directory records"); + for (const [index, path] of ["proofs/agda", "docs", ".github", ".machine_readable", "scripts", "tools"].entries()) { + field(directories[index][2], "path", "string", path); + if (!require("node:fs").statSync(path).isDirectory()) fail(`described directory missing: ${path}`); + } + const profile = clause("rsr-profile"); + field(profile, "version", "string", "1.0.0"); + field(profile, "spec", "string", "rsr-criteria-v2"); + field(profile, "declares-against", "string", "2.1.1-draft"); + const capabilities = profile.filter(x => x[0] === "field" && x[1] === "capabilities"); + const expectedCapabilities = ["agda", "bash", "library", "formal-proofs", "container", + "reproducible-build", "docs-site", "governance-tier"].sort(); + if (capabilities.length !== 1 || capabilities[0][2][0] !== "list") + fail("required unique capability list"); + const declared = capabilities[0][2][1]; + if (declared.some(x => x[0] !== "string") || + JSON.stringify(declared.map(x => x[1]).sort()) !== JSON.stringify(expectedCapabilities)) + fail("capabilities must match the reviewed repository profile without duplicates"); + // Presence checks establish the declared layout, not reproducibility, + // deployment availability, or conformance to every estate criterion. + for (const path of ["proofs/agda/All.agda", "Containerfile", "build/guix.scm", + ".github/workflows/pages.yml", "GOVERNANCE.adoc", "AFFIRMATION.adoc", "MAINTAINERS", + "docs/audit/2026-11-06-repository-readiness.adoc"]) + if (!require("node:fs").existsSync(path)) fail(`capability evidence missing: ${path}`); const ei2 = clause("ei-2"); field(ei2, "record-version", "integer", "1"); field(ei2, "status", "symbol", "closed-negatively"); diff --git a/wiki/Overview.adoc b/wiki/Overview.adoc index 844c2cde..6c4b4ebb 100644 --- a/wiki/Overview.adoc +++ b/wiki/Overview.adoc @@ -76,7 +76,7 @@ The project's standing posture is *narrow-true over broad-easy*: indexed/residual modality: a resource algebra may *measure* Echo residues (the `Echo.Measure` seam), but it does not *define* Echo. Equal residue measure does not imply equal Echo — mechanised in - `Echo.Separation.NotResourceInstance`, stated in `FOUNDATION_CONTRACT.md`. + `Echo.Separation.NotResourceInstance`, stated in `FOUNDATION_CONTRACT.adoc`. Downstream languages must not model Echo as a `Soundness(S)` resource instance. * The integration recipe across the five decoration axes is *organising diff --git a/wiki/Tutorial-Consuming-Echo.adoc b/wiki/Tutorial-Consuming-Echo.adoc index 2a9894aa..6db7411b 100644 --- a/wiki/Tutorial-Consuming-Echo.adoc +++ b/wiki/Tutorial-Consuming-Echo.adoc @@ -9,7 +9,7 @@ For *end users* — you want to use echo types' structured-loss vocabulary in your own language, tool, or proof, and you are not (yet) extending the Agda. This is a from-the-outside-in walkthrough: one idea, one definition, what you can and cannot do with it, and four real consumers. For the stable interface -contract read `FOUNDATION_CONTRACT.md` first; for the honest "what it does and +contract read `FOUNDATION_CONTRACT.adoc` first; for the honest "what it does and does not add" read <>. toc::[] @@ -74,7 +74,7 @@ no-section-of-collapsing-map -- EchoNoSectionGeneric.agda This is the load-bearing negative result. A consumer that wants recovery must *store the echo* (Section 4); it cannot reconstruct it from the output. The boundary invariant *Echo IS-NOT a resource instance* (see -`FOUNDATION_CONTRACT.md`) is the same statement read at the interface level. +`FOUNDATION_CONTRACT.adoc`) is the same statement read at the interface level. == 6. Four real consumers @@ -110,7 +110,7 @@ table. == 8. Where to go next -* `FOUNDATION_CONTRACT.md` — the stable `Echo.*` interface to build against. +* `FOUNDATION_CONTRACT.adoc` — the stable `Echo.*` interface to build against. * *EchoTypes.jl* — run the finite-domain shadow on your own data. * `docs/bridges/cross-repo-bridge-status.md` — every consumer bridge, with its honest scope and main blocker. diff --git a/wiki/Working-Rules.adoc b/wiki/Working-Rules.adoc index c5656005..90ee6d1f 100644 --- a/wiki/Working-Rules.adoc +++ b/wiki/Working-Rules.adoc @@ -18,7 +18,7 @@ toc::[] pragma. Never weaken either to land a proof. * *No postulates* unless explicitly isolated and justified. Load-bearing tracks carry *zero*. Exploratory truncation postulates, where they exist, are - enumerated in `docs/proof-debt.md` and stay out of `All.agda`'s trusted closure. + enumerated in `docs/proof-debt.adoc` and stay out of `All.agda`'s trusted closure. * *No escape hatches:* no `believe_me`, `primTrustMe`, `primEraseEquality`, `sorry`, `Admitted`, `unsafeCoerce`, `Obj.magic`. * *No escape pragmas:* no `{-# TERMINATING #-}`, `{-# NON_TERMINATING #-}`, or From 9e125c1dd7495f20865e45a433a972d102324399 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 13:59:25 +0000 Subject: [PATCH 4/7] Run the aggregate checker with its required Bash interpreter Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- Justfile | 2 +- docs/audit/2026-11-06-repository-readiness.adoc | 2 +- scripts/verify.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Justfile b/Justfile index 45d26d82..736e9d1c 100644 --- a/Justfile +++ b/Justfile @@ -24,7 +24,7 @@ verify: guard test guard: sh scripts/kernel-guard.sh bash tools/check-guardrails.sh proofs/agda - sh scripts/check-experimental-aggregate.sh + bash scripts/check-experimental-aggregate.sh sh scripts/check-agda-invocations.sh kernel-guard: diff --git a/docs/audit/2026-11-06-repository-readiness.adoc b/docs/audit/2026-11-06-repository-readiness.adoc index 790d29e8..d94edb1a 100644 --- a/docs/audit/2026-11-06-repository-readiness.adoc +++ b/docs/audit/2026-11-06-repository-readiness.adoc @@ -366,7 +366,7 @@ bun tools/audit-inventory.mjs sh scripts/check-agda-invocations.sh sh scripts/kernel-guard.sh bash tools/check-guardrails.sh proofs/agda -sh scripts/check-experimental-aggregate.sh +bash scripts/check-experimental-aggregate.sh bash scripts/setup-agda.sh # Source the env.sh path reported by setup before local proof checks. bash tools/check-audit.sh diff --git a/scripts/verify.sh b/scripts/verify.sh index bc57c85b..daaa4f3e 100644 --- a/scripts/verify.sh +++ b/scripts/verify.sh @@ -8,6 +8,6 @@ cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)" # Source the environment from scripts/setup-agda.sh before running this. sh scripts/kernel-guard.sh bash tools/check-guardrails.sh proofs/agda -sh scripts/check-experimental-aggregate.sh +bash scripts/check-experimental-aggregate.sh sh scripts/check-agda-invocations.sh exec bash tools/check-audit.sh From ddb08ee4278924bdf91ebedb2539a1407d4e5723 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 14:03:56 +0000 Subject: [PATCH 5/7] Keep direct-command lint scoped to direct Agda entrypoints Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- scripts/check-agda-invocations.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/check-agda-invocations.sh b/scripts/check-agda-invocations.sh index 723ceba8..0720eafb 100644 --- a/scripts/check-agda-invocations.sh +++ b/scripts/check-agda-invocations.sh @@ -4,7 +4,9 @@ # Static lint for direct, single-line agda commands; not a shell parser/typecheck. set -eu if [ "$#" -eq 0 ]; then - set -- .github/workflows/agda.yml scripts/check-grade3.sh scripts/verify.sh Justfile + # verify.sh delegates to tools/check-audit.sh. That runner constructs argv + # arrays and is verified by execution, not this direct-command-only lint. + set -- .github/workflows/agda.yml scripts/check-grade3.sh Justfile fi for file do test -r "$file" || { printf '%s: unreadable input\n' "$file" >&2; exit 1; } From 9cd7e067d7958fbca9e2efab1e6fa3c6aa0ce7e0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 14:12:09 +0000 Subject: [PATCH 6/7] State the generated Pages accessibility coverage boundary accurately Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .gitbot-fleet/enrolment.json | 42 +++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/.gitbot-fleet/enrolment.json b/.gitbot-fleet/enrolment.json index 822fbbb7..26dcb417 100644 --- a/.gitbot-fleet/enrolment.json +++ b/.gitbot-fleet/enrolment.json @@ -1 +1,41 @@ -{"reporters":{"accessibilitybot":{"enrolled":false,"reason":"no HTML files or served HTML surface is present"},"cipherbot":{"enrolled":false,"reason":"no cryptographic implementation is present; dependency checksum pins are not crypto implementation evidence"},"echidnabot":{"enrolled":false,"reason":"Agda proofs are present, but no ECHIDNA engine is configured for this producer and the pinned report-back adapter has no engine dispatch"},"finishingbot":{"enrolled":true,"title":"finishingbot (release readiness)"},"glambot":{"enrolled":true,"title":"glambot (presentation quality)"},"panicbot":{"enrolled":false,"reason":"no Cargo.toml or Rust source is present; panic-attack has a separate explicit local recipe"},"rhodibot":{"enrolled":true,"title":"rhodibot (RSR compliance)"},"seambot":{"enrolled":false,"reason":"no seam register is declared (spec/seams/seam-register.json)"},"sustainabot":{"enrolled":false,"reason":"reserved fleet slot; no reporter adapter exists at the pinned fleet revision"}},"schema":1} +{ + "reporters": { + "accessibilitybot": { + "enrolled": false, + "reason": "No checked-in HTML input for the pinned reporter. Pages HTML is generated by pinned Ddraig and was locally built; this fleet adapter did not analyze it." + }, + "cipherbot": { + "enrolled": false, + "reason": "no cryptographic implementation is present; dependency checksum pins are not crypto implementation evidence" + }, + "echidnabot": { + "enrolled": false, + "reason": "Agda proofs are present, but no ECHIDNA engine is configured for this producer and the pinned report-back adapter has no engine dispatch" + }, + "finishingbot": { + "enrolled": true, + "title": "finishingbot (release readiness)" + }, + "glambot": { + "enrolled": true, + "title": "glambot (presentation quality)" + }, + "panicbot": { + "enrolled": false, + "reason": "no Cargo.toml or Rust source is present; panic-attack has a separate explicit local recipe" + }, + "rhodibot": { + "enrolled": true, + "title": "rhodibot (RSR compliance)" + }, + "seambot": { + "enrolled": false, + "reason": "no seam register is declared (spec/seams/seam-register.json)" + }, + "sustainabot": { + "enrolled": false, + "reason": "reserved fleet slot; no reporter adapter exists at the pinned fleet revision" + } + }, + "schema": 1 +} From e53960952f89bd5e263fe0eea7d458b1c162cdd3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 6 Nov 2026 14:20:48 +0000 Subject: [PATCH 7/7] Reconcile current proof lane status and preserve final verification receipts Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- AFFIRMATION.adoc | 17 +++++++++++++++++ PROOF-STATUS.adoc | 6 ++++-- docs/audit/2026-11-06-repository-readiness.adoc | 15 +++++++++++++++ docs/proof-debt.adoc | 13 ++++++++++--- 4 files changed, 46 insertions(+), 5 deletions(-) diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index 8c682986..59440470 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -10,6 +10,23 @@ *Foundation scope correction, 2026-11-06.* The current contract is link:docs/echo-types/what-echo-is.adoc[the standard dependent fibre and its scoped interfaces]. Earlier “modality” means a preorder-indexed diagram, and historical “no-section” negatives mean no left inverse. The parallel-arrow example refutes arbitrary-arrow independence, not chosen-composite functoriality. Fibre-composition inverses do not establish a tropical graded monad; erasure obstructions do not ban every graded comonad. Selected lossy-encoding examples do not separate Echo from general Σ-types, and novelty/priority remain unresolved. Build counts and green receipts below are dated records, not certification of local edits; see link:docs/audit/2026-11-06-evidence.adoc[the audit evidence]. These qualifications supersede broader formulations below. ==== +[NOTE] +==== +*Wiring update, 2026-11-06.* The June 19 snapshot below is retained, including +its historical “proved-but-unwired” and two-job descriptions. The current +workflow has an independently named `Experimental echo-additive` job checking +`proofs/agda/experimental/echo-additive/All.agda`, separate from the shipped +`All.agda` closure. At repair head `f413ea14012a6d2ea428a3746070e4b92678df1f`, +https://github.com/hyperpolymath/echo-types/actions/runs/42226213296[Agda run 42226213296] +passed that job and the separate core, cold, narrowing and Cubical jobs. +The isolated experimental and narrowing mutants fail on unsolved metas while +`All.agda` passes; the restored-source controls and local-only receipt paths +are summarized in link:docs/audit/2026-11-06-repository-readiness.adoc[the readiness ledger]. +This supersedes the snapshot's wiring status, not its dated verdicts or the +mathematical qualifications above. It is a repair-head receipt, not a claim +that every later head or main deployment has passed. +==== + _the No-Bullshit file: what we affirm was true and checkable at this moment_ [NOTE] diff --git a/PROOF-STATUS.adoc b/PROOF-STATUS.adoc index e4392ff7..3434c7a7 100644 --- a/PROOF-STATUS.adoc +++ b/PROOF-STATUS.adoc @@ -244,8 +244,10 @@ This does not broaden what the test proves. * `Smoke.agda` pins selected headline theorems; it is not a coverage guarantee for every module. The main `All.agda` closure is distinct from the separately invoked cubical and experimental roots. The - working-tree narrowing root is pending its first CI check; see the CI - coverage audit above. Unwired modules must not be treated as checked. + narrowing root now has its own `Bit-narrowing exhibit` job, which passed + at repair head `f413ea14012a6d2ea428a3746070e4b92678df1f` in Agda run + `42226213296`; see the dated November 6 update and readiness ledger below. + Unwired modules must not be treated as checked. * The EI-2 integration-recipe-distinctness investigation is *terminated negatively* and must not be reopened (see `docs/EI2_REPORT.adoc`); the narrower adjacency questions above are separate. diff --git a/docs/audit/2026-11-06-repository-readiness.adoc b/docs/audit/2026-11-06-repository-readiness.adoc index d94edb1a..f9f61653 100644 --- a/docs/audit/2026-11-06-repository-readiness.adoc +++ b/docs/audit/2026-11-06-repository-readiness.adoc @@ -336,6 +336,21 @@ and proof runner as `just verify`, without requiring just. Its legacy unsafe checker delegates to the existing comment-aware, explicitly scoped guardrails; the three established profile/quarantine exemptions are unchanged. It no longer rejects the documented quarantined module via an indiscriminate grep. +An end-to-end run at `ddb08ee4278924bdf91ebedb2539a1407d4e5723` passed all +four guards and 22 proof roots. The direct-command linter is explicitly scoped +to direct commands; the runner's constructed argument arrays are checked by +execution. An unsafe direct-invocation control still fails. The exact 156-file +source manifest matched workspace and checked snapshot, SHA256 +`e48db7890e240693a89d9ac71a12cb31ae970722be9e942f326eb252f939bde8`. + +The final local PANIC run covers 214 candidates with the same two classified +medium findings and no high/critical findings. PONS still has two supported +JavaScript files and eight bounded banner warnings, with 22 skipped inputs after +the Pages helper was added. The final proof carrier builds and runs read-only +as UID 65532; image ID +`8483033394f4cb91209902222fa9fc46e221a32f2d1fdba3b720777c3e3e26a8`. +Generated Pages HTML has not been analyzed by the fleet accessibility adapter; +its explicit enrollment decline now records that coverage boundary. Metadata controls additionally reject a missing capability profile, duplicated capability, incorrect capability and duplicate capability field. Each failed diff --git a/docs/proof-debt.adoc b/docs/proof-debt.adoc index bc7a9317..668c39da 100644 --- a/docs/proof-debt.adoc +++ b/docs/proof-debt.adoc @@ -131,9 +131,16 @@ later by the WIRED `+EchoVariance.agda+`* (#243, 2026-06-20 — in obstruction; sharpens `+R-2026-05-18+` from "`graded comonad withdrawn`" to "`decided against`"). Cite the WIRED `+EchoVariance+` for the verdict; the `+experimental/echo-additive/+` track is the earlier -attempt, still outside the shipped closure. The current workflow invokes -its own aggregate in both Agda jobs; it is not a separately named job. -See `+PROOF-STATUS.adoc+` for the current coverage and verification limits. See +attempt, still outside the shipped closure. The current workflow checks +its aggregate in the separately named `Experimental echo-additive` job, outside +the shipped `All.agda` closure. That job passed at repair head +`f413ea14012a6d2ea428a3746070e4b92678df1f` in +https://github.com/hyperpolymath/echo-types/actions/runs/42226213296[Agda run 42226213296]. +Local isolated experimental and narrowing mutants fail on unsolved metas while +`All.agda` passes, as summarized in +link:audit/2026-11-06-repository-readiness.adoc[the readiness ledger]. +This November 6 wiring update does not reinstate the historical mathematical +claims in the paragraph above. See `+PROOF-STATUS.adoc+` for coverage limits. See `+docs/echo-types/variance-resolution.adoc+`. Build on the wired `+Echo+` / `+EchoResidue+`, `+EchoVariance+`, `+EchoGradedComonad+` (coassoc/counit), the composition isos, and `+DyadicEchoBridge+`.