abs_triangle: reverted to admit. The q16Clamp applies Int.abs internally, making
sign analysis after division non-trivial. Attempted proofs using Int.sign,
Int.sign_mul_abs, Int.ediv_neg_pos_of_neg, Int.mul_ediv_le all failed (missing
theorems in this Mathlib version).
Key theorem: mul_mono_left and mul_mono_right are proved and working.
Build: 3313 jobs, 0 errors (lake build)
FixedPoint.lean:
- mul_mono_left: proved via Int.mul_le_mul_of_nonneg_right + Int.ediv_le_ediv
with explicit hpos : 0 < q16Scale proof (not synthesized by norm_num)
- mul_mono_right: proved via Int.mul_le_mul_of_nonneg_left + same pattern
- abs_triangle: reverted to admit — q16Clamp applies Int.abs internally making
sign analysis non-trivial; needs case split on sign of (a*b)/q16Scale
SSMS.lean:
- t2 (line 617): corrected first arg from cT i - cT j to Q16_16.abs (cT i - cT j)
to match available hcand hypothesis
- t1 (line 606-614): fixed admit in inner proof with proper h_diff_nonneg +
lt_of_ge_of_le chain using h_aciBound_nonneg
- AGENTS.md: updated status — mul_mono_left/right are proved, abs_triangle is the
critical remaining blocker for aciPreservedByMlgruStep
Build: 3313 jobs, 0 errors (lake build)
FixedPoint.lean: add stubs for abs_triangle, sub_eq_add_neg,
mul_mono_left/right, add_le_add, abs_nonneg, abs_mul_le.
All blocked by the same core issue: calc/rw/omega fail on
ofRawInt-projected Int arithmetic after unfold mul/add/abs/neg.
The pattern that works in PistSimulation (unfold + Int.ediv_le_ediv
+ ofRawInt_toInt_eq_clamp + q16Clamp_monotone) fails here
because the goal structures differ.
Known-working pattern to finalize:
1. unfold the Q16_16 op
2. have h2 := raw Int inequality (Int.mul_le_mul_of_nonneg_*)
3. have hdiv := Int.ediv_le_ediv (by norm_num) h2
4. rw [ofRawInt_toInt_eq_clamp, ofRawInt_toInt_eq_clamp]
5. exact q16Clamp_monotone _ _ hdiv
AGENTS.md: document 6 new TODO(lean-port) items in Pending Proof Work.
Build: 3313 jobs, 0 errors (lake build Compiler)
Adds three definitions/lemmas at module scope in FixedPoint.lean,
before the Q16_16 namespace:
q16Clamp (i : Int) : Int
— pure-Int clamp to [q16MinRaw, q16MaxRaw]; no subtype, no proof field.
q16Clamp_monotone (a b : Int) (h : a ≤ b) : q16Clamp a ≤ q16Clamp b
— proved once by the by_cases / simp / dsimp / omega pattern;
all future monotonicity proofs inherit from here.
q16Clamp_id_of_inRange (i : Int) (hlo hhi) : q16Clamp i = i
— idempotence on in-range values; one simp call.
Inside Q16_16 namespace, replaces the 38-line ofRawInt_monotone case-split
with two short lemmas:
ofRawInt_toInt_eq_clamp (i : Int) : (ofRawInt i).toInt = q16Clamp i
— bridge between the subtype constructor and the pure-Int function;
proved by split_ifs <;> rfl.
ofRawInt_monotone (a b : Int) (h : a ≤ b) :
(ofRawInt a).toInt ≤ (ofRawInt b).toInt
— now a two-line proof: simp [ofRawInt_toInt_eq_clamp] + q16Clamp_monotone.
add_nonneg_monotone is unchanged; it still delegates to ofRawInt_monotone.
Full workspace build: 3570 jobs, 0 errors.
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
FixedPoint.lean — two new theorems:
ofRawInt_monotone (a b : Int) (h : a ≤ b) :
(ofRawInt a).toInt ≤ (ofRawInt b).toInt
— proved by explicit by_cases on all four guard combinations
(a/b each: above max, below min, in range), closing each branch
with simp + dsimp [q16MinRaw/q16MaxRaw] + omega/exact.
add_nonneg_monotone (a b : Q16_16) (hb : 0 ≤ b.toInt) :
a.toInt ≤ (add a b).toInt
— follows from ofRawInt_monotone + ofRawInt_toInt (one rewrite).
Semantics.PIST.Motif §6.2 — upgraded from concrete witness to general theorem:
motifScore_match_ge_base (x : MotifInputs) :
(motifScore {x with familyMatch := true}).toInt ≥
(motifScore {x with familyMatch := false}).toInt
— now proved for all MotifInputs using add_nonneg_monotone,
replacing the earlier TODO(lean-port) placeholder.
Full workspace build: 3570 jobs, 0 errors.
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Attempted symbolic proof using the case-split pattern from sub_self/
add_zero/zero_add proofs, but omega cannot reason about UInt32.toNat
conversions through the Q16_16.toInt definition. The lemma is
quarantined with a precise blocker.
Build: 3539 jobs, exit 0.
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- FixedPoint.lean: rewrite add/sub with two's-complement overflow
detection on UInt32 (replaces Int.ofNat approach that broke
negative Q16_16 values). Both positive and negative inputs now
correctly saturate at the representable bounds.
- FixedPoint.lean: add add_zero, zero_add, sub_self, sqrt_zero,
sqrt_one theorems with proofs for the corrected add/sub.
- FixedPoint.lean: fix Q0_16 doc (0x7FFF = 1.0, not 0x8000)
and div-by-zero (returns zero, not max).
- TorsionalPIST.lean: Fix16_sub_self, Fix16_mul_zero delegate to
FixedPoint theorems; Fix16_add_zero proven via add_zero.
- cupfox-config.nix: add Open WebUI container with chat.researchstack.info proxy,
gather-metrics service/timer, rclone, and tmpfiles for persistent storage
- Lean semantics: reduce axiom count from 109 to 18 across 10 files;
FixedPoint now 0 axioms, 0 sorries with 12 theorems
- Documentation: update AGENTS.md with current axiom/sorry counts and
FixedPoint status; refine bind signature
- Add topology scripts, CGA/FAMM/GeneticOptimizer/MMRFAMM Lean modules,
devcontainer config, MEMORY.md, and Modelfile
