Adds 6 new sections addressing concrete drift patterns found by auditing
the Compiler surface:
1. ofFloat leakage — Compiler-surface modules (RRC.*, AVMIsa.*, ReceiptCore)
must have zero ofFloat calls in any compute path; undocumented magic
integers are a bug.
2. #eval witness contract — every #eval must carry a '-- expect:' comment
with a hand-computed expected value; treat divergence as a failing test.
3. Namespace/closing discipline — namespace X must close with 'end X'
as the last non-blank line; no file-level open leakage; BEq RRCShape
pitfall documented.
4. Lakefile/Compiler surface discipline — Compiler roots are frozen;
job-count decrease after a change is an error signal.
5. Schema and claim_boundary strings — versioned, named, must not be
renamed; table of current schemas added; vague strings forbidden.
6. Promotion gate invariant — promotion=not_promoted is a hard invariant;
Promotion.candidate in any new code requires user approval.
Also adds: axiom/unsafe/native_decide prohibition, canonical Python shim
BOUNDARY comment format (exact format, PARTIAL BOUNDARY for mixed files).
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Adds .devin/skills/lean-proof/SKILL.md enforcing:
- Double-check output after every lake build (re-read + verify #eval values)
- Sorries must be explained (why deferred, proof sketch, TODO_MAP tracking)
or eliminated — bare sorry not acceptable
- TODOs follow the same contract: named, sketched, tracked
- No tautological theorems — proof must guarantee something non-trivial
about a domain type; trivially-true wrappers are forbidden
- Proof must have a stated purpose answering "what does this guarantee?"
- Q16_16 fixed-point contract (no Float in compute paths)
- Namespace/import conventions for RRC and RRCLogogramProjection
- Reference file index for the Lean workspace
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Project-wide sweep to find and fix every place Lean was treated as secondary,
optional, or subordinate to Python/Rust. The invariant: Lean is the source of
truth. Python and Rust are extraction targets only; they contain no logic, no
invariant checks, no decisions.
Changes:
1-Distributed-Systems/ene/src/lib.rs
- CRITICAL: Remove 'Rust is the canonical implementation language for
operational components' — replace with correct extraction-target framing
1-Distributed-Systems/agents/claw/README.md
- Remove 'canonical implementation lives in rust/' and 'source of truth is
ultraworkers/claw-code' blanket claims — scope to CLI binary only;
add Research Stack domain-logic note (Lean is source of truth per AGENTS.md)
- 'canonical Rust workspace' → 'Rust workspace (I/O extraction target)'
1-Distributed-Systems/agents/claw/src/Tool.py
- 'Python-first porting summary' → 'Lean-to-Python extraction summary'
1-Distributed-Systems/agents/claw/src/projectOnboardingState.py
- python_first: bool = True → lean_first: bool = True (Lean always leads)
6-Documentation/docs/specs/ENE_MEMORY_ATLAS_SPEC.md
- CRITICAL: 'Python first (reference) ... Lean-formal next' → correct order:
Lean specification first, Python extraction shim, Verilog hardware extraction
6-Documentation/docs/recovered/geocognition_equation_types_map.mmd
- 'Lean owns logic; Rust owns boundary' → 'Lean owns all logic and decisions;
Rust is boundary shim only'
6-Documentation/docs/semantics/HYPER_DIMENSIONAL_PHYSICS_INTRO.md
- 'Python implementation ... Lean formalization' → 'Lean specification (source
of truth) ... Python extraction shim'
6-Documentation/docs/geometry/GEOMETRY_TAXONOMY_FOR_NLOCAL_ADAPTATION.md
- 'reference specification for the Python implementation' → 'source of truth;
Python is an extraction shim against this spec'
6-Documentation/docs/protocols/TM_MCP_SPECIFICATION.md
- 'Python reference implementation' → 'Python extraction shim' (×2)
5-Applications/scripts/snn/README.md
- 'deterministic Python reference' → 'Python extraction shim / golden-vector
harness'; add TODO(lean-port) note; RTL must match 'Python shim (pending
Lean golden vector)' not 'Python reference'
6-Documentation/docs/METAPROBE_APPROACH.md
- 'DeltaGCLCompression.lean — Lean implementation / scripts/delta_gcl_encoder.py
— Python reference implementation' → Lean is source of truth / Python is
extraction shim
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- label_canary_theorems.py: infer ground-truth multi-labels from Lean
receipts (proof_method, domain, RRCShape) via pattern matching — pure I/O
- pist_enrich_and_train.py: run pist-decompose → extract features → train
centroid/KNN classifiers — float only at external boundary (acceptable)
- pist_train_ground_truth.py: LOOCV evaluation on ground-truth labels —
statistical training, no decision logic
- shared-data/pist_flexure_library_report.json: updated flexure library report
All three shims: pure I/O, no admissibility/gating decisions, float only in
normalization (external boundary). Complies with AGENTS.md §Programming Choice
Flow. Outputs are regenerable from source receipts.
Build: Compiler 3311 jobs, 0 errors (no Lean changes).
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Adds .devin/config.json with a UserPromptSubmit hook that fires on every
user message and injects the programming choice flow + post-interaction
checklist into the agent's context via add_context.
.devin/hooks/programming-choice-reminder.sh:
Emits a JSON add_context block with the 7-branch decision tree:
1. Admissibility/gating → Lean only
2. Receipt minting / top-level JSON → AVMIsa.Emit only
3. Alignment classification → Lean (RRC.Emit)
4. Raw input features → Python shim OK with constraints
5. Float in compute path → STOP, use Q16_16
6. Promotion in shim space → STOP, not_promoted until Lean gate passes
7. Pure I/O → Python fine, route receipts through AVMIsa.Emit
Plus the 4-step post-interaction checklist (AGENTS.md / build / commit / status)
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Adds §5 Programming choice flow — a decision tree that runs before writing
any new code. Covers:
- Admissibility / gating / routing logic → Lean only
- Receipt minting / top-level JSON emission → AVMIsa.Emit only (sole boundary)
- Alignment classification → Lean (RRC.Emit or new Semantics.RRC.*)
- Raw input features → Python shim acceptable with strict constraints
(no admissibility logic, regenerable, TODO(lean-port) if portable)
- Float in compute paths → STOP, use Q16_16
- Promotion advancement in shim space → STOP, always not_promoted until
a Lean gate passes
- Pure I/O → Python shim fine, must route receipt output through AVMIsa.Emit
Summary rule: Lean owns all decisions. Python owns all I/O.
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- lakefile.toml: add Compiler lean_lib with 5 blessed roots
(Semantics.RRC.Emit, Semantics.AVMIsa.Emit, Semantics.AVMIsa.Run,
Semantics.ReceiptCore, Semantics.RRCLogogramProjection);
defaultTargets = ["Semantics", "Compiler"]
- PistSimulation.lean: restore goldenContractionEnergyDecrease theorem body
(was commented out as TODO forward-ref to arrayKineticEnergy); moved to
after burgersPhiEnergyStep where all dependencies are in scope;
proof stub retained with sorry + TODO(lean-port) comment
- AGENTS.md: document blessed Compiler surface, Goal A receipt shape,
quarantine table, pending proof work, and key Lean 4.30 API notes
Build: 3566 jobs, 0 errors (lake build)
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Semantics.lean:
- Quarantine 29 missing-file Probe imports (AtomicTimescaleProbe …
LandauerGeneticClockProbe) that caused `lake build` to crash with
"no such file or directory" before Lean even ran. All 29 are commented out
with a TODO(lean-port) block; files don't exist yet.
- Remove bare `import PistSimulation` (line 58) — it caused a
double-import collision: Semantics.PistSimulation is already reachable via
Semantics.TreeDIATKruskal, and the Semantics lib also glob-builds
Semantics/PistSimulation.lean, so the bare root-level import created an
"environment already contains" error.
PistSimulation.lean:
- Fix fixtureSpectralWindow list literal: ⟨655360⟩ … → Q16_16.ofRawInt N
(same Subtype.mk two-field pattern fixed throughout this series)
- Quarantine goldenContractionEnergyDecrease theorem: it forward-references
arrayKineticEnergy (defined 240 lines later); commented out with
TODO(lean-port): move after arrayKineticEnergy definition
TreeDIATKruskal.lean:
- Fix treeNodeCountExact_pos and treeLeafCountExact_pos: in Lean 4.30
`simp [treeNodeCountExact/treeLeafCountExact, ihL, ihR]` now closes the
node case fully; trailing `omega` had "no goals to be solved"
Result: lake build → Build completed successfully (3557 jobs)
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Semantics/RRC/Emit.lean (new):
Ports the core decision logic of rrc_pist_shape_alignment.py into Lean.
This is the first Lean-only RRC compiler pass replacing shim-space Python.
Schema:
AlignmentStatus: aligned_exact | aligned_proxy |
compatible_structural_projection |
alignment_warning | missing_prediction
scores (integer/100): 100 | 86 | 72 | 35 | 0
Promotion: always not_promoted at this stage
RrcRow: {equation_id, name, shape, status, alignmentStatus, alignmentScore,
promotion, warnings, receipt}
determineAlignment ports determine_alignment verbatim:
1. no PIST label → missing_prediction
2. exact label == RRC shape → aligned_exact
3. proxy label == RRC shape → aligned_proxy
4. PIST label in structural_labels AND RRC shape is semantic → compatible_structural_projection
5. else → alignment_warning
Fixture corpus (6 rows, one per RRCShape, from rrc_equation_classifier_receipt.json):
CognitiveLoadField CANDIDATE proxy=LogogramProjection → compatible_structural_projection score=72
SignalShapedRouteCompiler CANDIDATE proxy=LogogramProjection → compatible_structural_projection score=72
LogogramProjection HOLD proxy=LogogramProjection → aligned_exact score=100
ProjectableGeometryTopology HOLD no PIST label → missing_prediction score=0
CadForceProbeReceipt HOLD no PIST label → missing_prediction score=0
HoldForUnlawful... HOLD no PIST label → missing_prediction score=0
#eval emitFixture.json → valid JSON (python3 -m json.tool passes):
schema: rrc_emit_fixture_v1
total: 6, passed_alignment: 3, all not_promoted
This faithfully encodes the current shim state: the PIST classifier has 0%
accuracy against CognitiveLoadField / SignalShapedRouteCompiler because it
predicts LogogramProjection for all rows. The Lean gate correctly classifies
this as compatible_structural_projection (score 72) rather than a hard failure.
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
AVMIsa.Emit (new, Semantics/AVMIsa/Emit.lean):
- Three canary programs: boolean NOT, AND, OR
- checkTopBool classifies Outcome State against expected value
- canaryReceipt mints a ReceiptCore.leanBuildReceipt keyed per-canary
- canaryLogogramReceipt maps allPassed → RRCLogogramProjection.LogogramReceipt
(uglyAsymmetricPruning / normal lane on pass; horribleManifoldTearing on fail)
- Minimal JSON serializer (no Float, no external deps, all ReceiptCore/RRC
fields faithfully encoded)
- emit : EmitResult collapses the whole pipeline into one call
- #eval output: valid JSON with schema avm_canary_emit_v1, all_canaries_passed
true, three receipts, rrc_logogram projectionAdmissible+mergeAdmissible true,
lane normalProjection — passes python3 -m json.tool
Adaptation.lean: replace ⟨UInt32_expr⟩ → ofRawInt N throughout
(Q16_16 is a Subtype {x:Int//...}; ⟨·⟩ needs both val + property;
ofRawInt handles clamping to range); same fix for inline let bindings
and Q16_16.mk literals in isLawful
TorsionalPIST.lean: replace { val := N } Fix16/Q16_16 struct literals with
Semantics.Q16_16.ofRawInt N (Fix16 is abbrev for Q16_16)
lakefile.toml: remove HybridTSMPISTTorus from PIST roots
(pre-existing sorry + property failures, zero importers, quarantined
pending Lean 4.30 port — still on disk, just not a build root)
Result: lake build PIST Semantics.AVMIsa.Emit → Build completed (3326 jobs)
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
lakefile.toml (PIST lib roots):
- Remove "PISTMachine" — PISTMachine.lean does not exist; dead root
would cause lake build PIST to fail with "unknown module" error
- "Trace" was already added in the prior dirty change; committed here
paired with the file it requires
2-Search-Space/PIST/Trace.lean (new):
- Lean 4 tactic `trace_state_json "tag"` for Tier 2 flexure recording
- Emits structured goal-state JSON (target, hypotheses, goal_count)
prefixed with @@PIST_TRACE_JSON@@ sentinel to logInfo stdout
- Python trace bridge parses the sentinel to capture mid-proof state
- Namespace: PIST.Trace; no sorry, no float, no external deps beyond Lean
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Edge Caddy now does exactly three things:
1. Terminate TLS for researchstack.info + *.researchstack.info via
Porkbun DNS-01 (wildcard cert covers all subdomains in one renewal)
2. 301-redirect legacy subdomains to canonical path equivalents:
status.* → /server/status/
dash.*, home.* → /
media.* → /apps/jellyfin/
books.* → /apps/books/
music.* → /apps/music/
vault.* → /server/vault/
pulse.* → /api/registry/
apps.* → /apps/
*.* (wildcard fallback) → /
3. Forward all other traffic to the internal router (host Caddy :80 on
k3s-server over Tailscale) with X-Forwarded-* headers preserved.
auth.* and mail/webmail.* are forwarded unchanged (stable subdomains).
No path routing logic on the edge. Traefik Ingress (k3s-server) owns
all path decisions. This commit has no effect until nixos-rebuild switch
is run on microvm-racknerd (deploy after k3s-server is verified).
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Port conflict resolution:
- Add HelmChartConfig to pin Traefik web entrypoint to NodePort 30080
(not host :80) so k3s Traefik and host Caddy do not race for the port
- Add host Caddy on :80 as a minimal pass-through to Traefik :30080;
carries X-Forwarded-* headers so Traefik sees the real client IP and
the correct Host. No TLS, no Porkbun, no subdomain logic — all of
that stays on the edge Caddy (k3s-edge.nix)
- Caddy after= k3s.service so Traefik NodePort is ready before proxying
Authentik port fix:
- Change authentik server + worker services from NodePort 30080 to
ClusterIP; Traefik reaches Authentik via the rs-auth Ingress and
cluster DNS, no NodePort required
New manifests (internal, no public-traffic impact):
- manifests/ingress/: Traefik Ingress resources + Middleware CRDs
(/apps/*, /server/* → forward_auth + strip-prefix; /api/* → strip only;
/ → Homer + forward_auth; auth.* → Authentik, no middleware)
- manifests/hermes/: placeholder chat/orchestrator service
- manifests/credential-server/: token-auth credential vault stub
- manifests/control-plane/: registry-api, jobs-api, blobs-api health stubs
- manifests/homer/configmap.yaml: updated dashboard links to canonical paths
Deploy order: rebuild k3s-server first, verify Traefik + Ingress
internally, then deploy k3s-edge (commit 3 / next step).
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Tests the full traffic path against live researchstack.info infrastructure:
Edge Caddy (TLS) → Tailscale → Traefik Ingress → k3s services
Coverage:
- edge-tls-redirects: HTTPS reachability, cert validity, legacy subdomain
301s (status/dash/home/media/books/music/vault/pulse/apps), stable
subdomains (auth, mail), wildcard fallback
- path-routing: /apps/*, /server/*, /api/* routes; prefix stripping; SSO
redirect vs token-auth isolation
- auth-integration: Authentik login page, OIDC discovery, forward_auth
gating on protected paths, /api/* bypass
19/40 tests pass against current live infrastructure (pre-deploy). The 21
failures are "not yet deployed" signals, not design errors. Run after each
phase of the deployment plan to use as a regression gate.
Run: cd 4-Infrastructure/k3s-flake/tests && npm test
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
