@ceccec/millennium-solutions 9.3.3 → 9.3.5

package/src/prove/emit.ts

@@ -1,115 +0,0 @@
-// EMIT — write the mechanically translated claims as a Lean file, then let the gates judge it.
-//
-// Nothing here decides whether a theorem is true. It renders the claim the ledger already states, in Lean,
-// and hands it to the kernel. Four things must hold before anything is sealed, and they are checked by the
-// tools that own them rather than re-implemented here: it compiles, every theorem is axiom-free, the
-// ledger's own test still computes true at the same claim, and the emitted statement contains no construct
-// the translator refuses. A claim that fails any of them is left in the queue with its reason.
-import { readFileSync, writeFileSync } from 'node:fs'
-import { execSync } from 'node:child_process'
-import { queue } from './index.ts'
-import { translate, PREAMBLE, importsFor } from './translate.ts'
-
-const OUT = 'src/proof/mechanical.lean'
-
-export function emit(): { written: number; skipped: number; file: string } {
-  const q = queue()
-  const rendered = q.map((p) => ({ p, t: translate(p.body) })).filter((x) => x.t.ok) as
-    { p: { key: string; name: string }; t: { ok: true; lean: string } }[]
-
-  // IMPORT THE PORT, NEVER RESTATE IT. A rendered claim that needs toUuid uses address.lean's own definition,
-  // which is pinned to the shipped implementation by its agreement theorems. Copying that definition into the
-  // generated file would create a second toUuid to keep in step, which is the shape of every drift here.
-  const needed = [...new Set(rendered.flatMap((x) => importsFor(x.t.lean)))].sort()
-  // FRONTMATTER, because the page reads it. Regenerating this file used to strip the `-- title:` / `-- wing:`
-  // block that every hand-written proof carries, so the one file produced by a machine was the one file the
-  // documentation could not describe. A generator that cannot introduce its own output is not finished.
-  let body = needed.map((m) => `import ${m}\n`).join('') + `set_option maxRecDepth 400000\n`
-  body += `-- title: Mechanically translated\n-- wing: the machine\n-- prior_art: unclassified\n`
-  body += `-- Generated by src/prove/emit.ts from the ledger's own tests — do not hand-edit; re-run the prover.\n`
-  body += `--\n`
-  body += `-- Each theorem below is a claim the ledger already asserts, rendered into Lean by a whitelist\n`
-  body += `-- translation of the deposit's test vocabulary. The rendering is mechanical: no construct outside the\n`
-  body += `-- vocabulary is translated, because a guess would produce a theorem that compiles and states something\n`
-  body += `-- else. What the kernel adds is what a test cannot give — the proposition checked over its whole domain.\n\n`
-  body += `namespace Mechanical\n\n${PREAMBLE}\n\n`
-  for (const { p, t } of rendered) {
-    body += `-- ${p.name.replace(/\n/g, ' ').slice(0, 110)}\n`
-    body += `theorem ${p.key} : ${t.lean} := by decide\n\n`
-  }
-  body += `end Mechanical\n`
-  writeFileSync(OUT, body)
-
-  // QUARANTINE — a translator bug must never redden the build. Translation is a whitelist, not a proof that
-  // the output type-checks: a method chain rendered without brackets parsed as something else entirely and
-  // took the whole file down with an error that pointed nowhere near the cause. So the file is compiled here,
-  // and any theorem the kernel will not accept is REMOVED and reported as a refusal carrying the kernel's own
-  // words. A claim that cannot be rendered is not a failure of the build; it is the work list. What must never
-  // happen is the two being confused, because then a bad rendering looks like a broken deposit.
-  const compiles = (): string | null => {
-    try { execSync('cd src/proof && LEAN_PATH=. lean mechanical.lean', { encoding: 'utf8', stdio: 'pipe' }); return null }
-    catch (e) { return String((e as { stdout?: string; stderr?: string }).stdout ?? '') + String((e as { stderr?: string }).stderr ?? '') }
-  }
-  const quarantined: string[] = []
-  for (let pass = 0; pass < 12; pass++) {
-    const err = compiles()
-    if (!err) break
-    // A MISSING MODULE IS NOT A BAD THEOREM. `import Address` failing on line 1 yields no theorem position, so
-    // the attribution below finds nothing and the bisection starts deleting — removing innocent theorems and
-    // reporting them as kernel-rejected. The failure is environmental (the .olean is not built yet); say so
-    // and stop, rather than mutilating the file to make a build error go away.
-    if (/unknown module prefix|no such file or directory.*olean|No directory .* or file .*\.olean/i.test(err)) {
-      console.error('✗ emit: a module this file imports is not built — run `node scripts/lean.ts` first so the .oleans exist.')
-      console.error('  ' + err.split('\n').filter(Boolean).slice(0, 2).join('\n  '))
-      console.error('  Nothing was quarantined: this is not a theorem failing, it is the import path.')
-      process.exit(1)
-    }
-    const lines = [...err.matchAll(/mechanical\.lean:(\d+):/g)].map((m) => Number(m[1]))
-    const src = readFileSync(OUT, 'utf8').split('\n')
-    const bad = new Set<string>()
-    // when the kernel reported positions we can name the offenders directly; otherwise bisect below
-    for (const ln of lines) {
-      for (let i = Math.min(ln, src.length) - 1; i >= 0; i--) {
-        const m = src[i].match(/^theorem ([A-Za-z_0-9]+) :/)
-        if (m) { bad.add(m[1]); break }
-      }
-    }
-    // NO LINE NUMBER, NO CULPRIT — bisect. A stack overflow aborts the kernel before it can say WHERE, so the
-    // error carries no position at all and the loop above has nothing to remove. Halving the file finds the
-    // offender in a handful of compiles instead of one per theorem, and it is the only method that works when
-    // the failure is the compiler dying rather than reporting.
-    if (!lines.length || !bad.size) {
-      const all = readFileSync(OUT, 'utf8')
-      const head = all.slice(0, all.indexOf('theorem '))
-      const blocks = all.slice(all.indexOf('theorem ')).split(/\n\n(?=(?:-- [^\n]*\n)?theorem )/)
-      const tail = blocks.length ? '' : ''
-      let lo = 0, hi = blocks.length
-      const tryRange = (a: number, b: number) => {
-        writeFileSync(OUT, head + blocks.slice(a, b).join('\n\n') + '\n' + tail)
-        return compiles() === null
-      }
-      while (hi - lo > 1) {
-        const mid = Math.floor((lo + hi) / 2)
-        if (!tryRange(lo, mid)) { hi = mid } else { lo = mid }
-      }
-      const culprit = blocks[lo]?.match(/^(?:-- [^\n]*\n)?theorem ([A-Za-z_0-9]+)/)?.[1]
-      blocks.splice(lo, 1)
-      writeFileSync(OUT, head + blocks.join('\n\n') + '\n' + tail)
-      if (culprit) quarantined.push(culprit + ' (kernel aborted — no position reported; found by bisection)')
-      continue
-    }
-    let out = readFileSync(OUT, 'utf8')
-    for (const name of bad) {
-      out = out.replace(new RegExp('(?:^-- [^\\n]*\\n)?^theorem ' + name + ' :[\\s\\S]*?:= by decide\\n\\n', 'm'), '')
-      quarantined.push(name)
-    }
-    writeFileSync(OUT, out)
-  }
-  if (quarantined.length) console.log('  quarantined ' + quarantined.length + ' theorem(s) the kernel would not accept: ' + quarantined.slice(0, 6).join(', ') + (quarantined.length > 6 ? ' …' : ''))
-  return { written: rendered.length, skipped: q.length - rendered.length, file: OUT }
-}
-
-if (process.argv[1]?.includes('emit')) {
-  const r = emit()
-  console.log(`✓ ${r.file} — ${r.written} claims rendered, ${r.skipped} left in the queue with a reason`)
-}

package/src/prove/index.ts

@@ -1,143 +0,0 @@
-#!/usr/bin/env node
-// THE PROVER — the deposit proving itself, without an author in the loop.
-//
-// Everything here was manual work: read the queue, pick a claim, write the Lean, compile it, audit the
-// axioms, seal it, check the chain. Each step was a place the process stopped and waited for a person. A step
-// that waits for a person is not part of the deposit; it is a habit of whoever was running it.
-//
-// What is AI-independent and what is not, stated plainly rather than blurred:
-//
-//   INDEPENDENT — the queue (which entries are portable, derived from their own test bodies), translation of
-//   MECHANICAL claim shapes to Lean, compilation, the axiom audit, agreement against the ledger's own test,
-//   sealing with a chained receipt, and the refusal to seal anything that fails any of those.
-//
-//   NOT INDEPENDENT — deciding what a NEW proposition should say when the claim has no mechanical shape.
-//   Cassini needed splitting into two theorems because naturals cannot carry an alternating sign; nothing
-//   here would have discovered that. Such claims are reported as needing an author, never faked.
-//
-// The honesty of this file rests on that second list being reported, not hidden. A prover that silently skips
-// what it cannot do looks complete and is not.
-import { readFileSync, writeFileSync, existsSync } from 'node:fs'
-import { ledger as loadLedger } from '../api/index.ts'
-import { execSync } from 'node:child_process'
-import { translate } from './translate.ts'
-
-const LEDGER = 'src/proof/discovered.json'
-const DISCOVER = 'scripts/discover.ts'
-
-export type Portable = { key: string; name: string; body: string; shape: Shape }
-export type Shape = 'modular-identity' | 'range-predicate' | 'exact-set' | 'unknown'
-
-/** Read each candidate entry's TEST BODY — the claim's own computation, not its prose.
- *
- *  THE QUEUE IS NOT A FLAG. It used to be `led.filter(e => e.portable)`, and that flag was written once and
- *  never recomputed: 176 entries carried it while 1688 withdrawn claims with perfectly runnable tests were
- *  never asked. A stale marker had become the thing deciding what could be proved, so a claim was outside the
- *  prover's reach for no reason anyone had checked — the same fault as revoking before folding, one level up.
- *
- *  Every entry with a test body is queued now, and the translator's refusal list does the filtering WITH A
- *  REASON. That is the only honest place for the decision: a refusal that names what it cannot read is a work
- *  list, where a missing flag is silence. Entries already superseded by a Lean theorem are skipped because
- *  they are done, not because they were filtered.
- */
-export function queue(): Portable[] {
-  const led = loadLedger()
-  const src = readFileSync(DISCOVER, 'utf8')
-  const bodies = new Map([...src.matchAll(/out\.push\(\{ key: '([a-z_0-9]+)'[\s\S]*?test: \(\) => ([\s\S]*?)\}\)\n/g)]
-    .map((m) => [m[1], m[2]] as [string, string]))
-  // A SUPERSEDED CLAIM STAYS IN THE QUEUE, and skipping it was circular. `supersededBy` means "a Lean
-  // theorem now carries this" — and for the mechanically rendered ones, that theorem IS the one emit writes
-  // into mechanical.lean. Filtering them out stopped emit rendering them, mechanical.lean shrank from 75
-  // theorems to 2, and 75 sealed keys instantly had no source: the successors were orphaned by the very
-  // link that recorded their success. Being done is not a reason to stop regenerating the artefact that
-  // makes it true.
-  return led
-    .filter((e) => bodies.has(e.key))
-    .map((e) => {
-      const body = bodies.get(e.key) ?? ''
-      return { key: e.key, name: e.name, body, shape: classify(body) }
-    })
-}
-
-/** The shape of a claim decides whether it can be translated without judgement. */
-export function classify(body: string): Shape {
-  const b = body.replace(/\s+/g, ' ')
-  if (/^[^=]*%\s*\d+\s*===\s*\d+\s*$/.test(b)) return 'modular-identity'
-  if (/Array\.from\(\{ ?length: ?\d+ ?\}[\s\S]*\.every\(/.test(b)) return 'range-predicate'
-  if (/JSON\.stringify\([^)]*\) === JSON\.stringify\(\[/.test(b)) return 'exact-set'
-  return 'unknown'
-}
-
-/** Run the whole loop: queue → translate what is mechanical → verify → seal. Reports what it could not do. */
-export function run(opts: { emit?: boolean } = {}): string {
-  const q = queue()
-
-  // Ask the TRANSLATOR, not the shape classifier. The classifier was a guess at what might be renderable and
-  // reported 173 needing an author when the translator renders 22 of them; a report that is confidently wrong
-  // is worse than no report, because it sets the work queue.
-  const attempted = q.map((p) => ({ p, t: translate(p.body) }))
-  const mechanical = attempted.filter((x) => x.t.ok).map((x) => x.p)
-  const needsAuthor = attempted.filter((x) => !x.t.ok).map((x) => x.p)
-  const reasons = attempted.filter((x) => !x.t.ok).reduce<Record<string, number>>((a, x) =>
-    ({ ...a, [(x.t as { why: string }).why.slice(0, 46)]: (a[(x.t as { why: string }).why.slice(0, 46)] ?? 0) + 1 }), {})
-
-  const lines: string[] = []
-  lines.push(`queue: ${q.length} portable entries`)
-  lines.push(`  mechanically translatable : ${mechanical.length}`)
-  lines.push(`  needs an author           : ${needsAuthor.length}  ← reported, never faked`)
-  lines.push('')
-  lines.push('why the rest are refused (by whitelist, never best-effort):')
-  for (const [why, n] of Object.entries(reasons).sort((a, b) => b[1] - a[1]).slice(0, 6)) lines.push(`  ${String(n).padStart(4)}  ${why}`)
-
-  if (opts.emit && mechanical.length) {
-    // translation is left to lean-gen, which owns emission and its five gates; this loop only drives it
-    try { lines.push('', execSync('node scripts/lean-gen.ts --emit', { encoding: 'utf8' }).trim()) }
-    catch (e) { lines.push('', 'lean-gen FAILED: ' + String((e as { stdout?: Buffer }).stdout ?? e).slice(0, 300)) }
-    try { lines.push(execSync('node scripts/lean.ts', { encoding: 'utf8' }).trim().split('\n').slice(-1)[0]) }
-    catch { lines.push('lean verification FAILED — nothing sealed') ; return lines.join('\n') }
-    try { lines.push(execSync('node scripts/seal-lean.ts --seal', { encoding: 'utf8' }).trim().split('\n').slice(-2).join('\n')) }
-    catch (e) { lines.push('seal FAILED: ' + String((e as { stdout?: Buffer }).stdout ?? e).slice(0, 200)) }
-  }
-  // SHAPE REFUSALS, BUCKETED. "not a chain of simple bindings" was reported as one number, and a single
-  // number is not a work list — it hides whether the blocker is one tractable pattern or a hundred different
-  // programs. Twice I read that number as a shape problem and was wrong both times: the early-return
-  // validation loop was hiding in it and needed no judgement at all. Bucketing is what surfaced it, so the
-  // buckets stay, and each names an example so the next reader can check rather than trust the label.
-  const shapes: Record<string, { n: number; eg: string }> = {}
-  for (const p of q) {
-    const t = translate(p.body)
-    const why = 'why' in t ? t.why : null
-    if (!why || !why.includes('simple bindings')) continue
-    const b = p.body.replace(/\s+/g, ' ').replace(/^\{\s*|\s*\}$/g, '')
-    const k =
-      /\w+\s*\[\s*\w+\s*\]\s*=/.test(b) ? 'builds a table by index assignment (a recurrence — needs the recurrence named)'
-      : /\bnew Map\b|\bmemo\b/.test(b) ? 'memoised closure (state across calls)'
-      : /const\s*\[/.test(b) ? 'array destructuring'
-      : /=>\s*\{/.test(b) ? 'binds a function with a statement body'
-      : /\bfor\s*\(\s*const\b/.test(b) ? 'for-of over a computed list'
-      : /\bwhile\b|\bdo\s*\{/.test(b) ? 'unbounded while/do'
-      : 'other'
-    shapes[k] = shapes[k] ?? { n: 0, eg: b.slice(0, 96) }
-    shapes[k].n++
-  }
-  const shapeTotal = Object.values(shapes).reduce((a, x) => a + x.n, 0)
-  if (shapeTotal) {
-    lines.push('')
-    lines.push(`the ${shapeTotal} refused on SHAPE, by what the body actually is:`)
-    for (const [k, v] of Object.entries(shapes).sort((a, b) => b[1].n - a[1].n))
-      lines.push(`  ${String(v.n).padStart(4)}  ${k}\n        e.g. ${v.eg}`)
-  }
-
-  return lines.join('\n')
-}
-
-/** report() — the deposit's convention: every module states its own measured condition. */
-export function report(): string {
-  const q = queue()
-  const ok = q.filter((p) => translate(p.body).ok).length
-  return `prover: ${q.length} portable · ${ok} mechanical · ${q.length - ok} need an author · integrity, not truth`
-}
-
-if (process.argv[1]?.endsWith('index.ts') && process.argv[1].includes('prove')) {
-  console.log(run({ emit: process.argv.includes('--emit') }))
-}