Independently audit P104 callers with explicit owned lifetimes

research/p104-caller-owned-interface/PACKAGE-INVENTORY.json

@@ -0,0 +1,22 @@
+{
+  "files": {
+    "code/adapter.py": "bc8fc77d3c8dbeec83f9c0cdf8084b507df68f5a5edcae943ba6a19b9b1496cb",
+    "code/guard.py": "7065977995a11aec919579031299d90bb2fb5f3a2fe45828997fb0f22004a221",
+    "code/interface.py": "b827ba3ec2c23b612fc031f8d086b275a7745ca18bce94e7e16df9005b2b95c2",
+    "evidence/candidate-guard.json": "de8f45986ce22ed661526e2f5c4b70bdc5b2960fad76533ce9dd94d225a465e9",
+    "evidence/candidate-receipt.json": "c768a58a8439cfdb42d7cbd8bcf885a3b684571ccf0a8270fe5f3a73eafaa7ed",
+    "evidence/historical-pr5684-binding.json": "6380e961dd45a58ef6b87d3c0421a94800102c4046ee1fe6c202d8827200e8a6",
+    "evidence/historical-pr5684-receipt.json": "6c899e52d1da5c94b0bc159378b11106ccc665c4f5780bd48bc75c6c0c674082",
+    "evidence/original-guard.json": "97d1ee64006f1d59cb816247359e3774ddd67dba8ed98c444c5735f3d2549f15",
+    "evidence/original-receipt.json": "777f92d67599486368c946a84170fbc410e95610c2cbb8d354889e5f377e033b",
+    "evidence/primary-prerequisite.log": "7e5afa9051fcd1b8856a443ef30a3e88437a80b7a6f4dcb1295dbc6d99b4c07d",
+    "expected/candidate.json.gz": "2f22c811a85f5a37a6658ba0a21705aee55fc848a8aa85ddd5fefced8e1f460b",
+    "source/BINDING.json": "aff998b6d3069cea1a0a10b2a2fcd3b8100d3c84e521ef54b679a5c996839a99",
+    "source/EXPORT.json": "24c2e769a55474476e0b038e7c211a5aa745cc9bd2a04aaa34eb182a9583767b",
+    "source/NOTICE-PR5713": "a252225cb4d9c61fc94b5b7f638600393a859e47750cfea7688c75b1f6610077",
+    "source/RESULT.json": "3ce2dfdd7ccb6b0d6d8d674bc7614a8302a0f2f9e23f16ece95dedb9d7ea561e",
+    "source/WORD.json.gz": "9fd67dd89ed24a644257cd9aef06934ed4c6fbe0441804684a968868f2ef66a8",
+    "source/selected-adapter.patch": "4cc4829764a7511251d5c632a209e666a1f4946fe1e2b43ec90bec456e360dba"
+  },
+  "schema_version": 1
+}

research/p104-caller-owned-interface/PROOF.md

@@ -0,0 +1,134 @@
+# Independent caller interface adaptation
+
+This is a source-bound extension of the selected PR5599 admission's independent
+caller adapter, not a new multiplication bound or a replacement for the primary
+native replay. The selected checker is pinned at SHA256
+`6fce1e331747aebee13ecc6e33ab2fd49b9383640c20546e245be3e624933b52`.
+The unchanged original PR5550 checker and its complete expected output are
+separately pinned; its positive control must reproduce all original output bytes.
+
+## Admission comparison
+
+The completed PR5599 review permits noncanonical helper endpoints and dirty
+independent inputs. Endpoint normalizers are placed before and after each fresh
+forward local call. All eighteen local calls remain forward: the main-pair
+signed swaps and translations are not a transpose of COPY/CLEAR. At finite
+precision, COPY is an ADD into an ideally initialized owned zero; its injected
+residual must survive later arithmetic. No overwrite of noisy state is justified.
+These facts cover the kind of scalar dependency changes in our shared relays,
+provided their complete arbitrary-input local identities are independently
+verified. They do not themselves establish any new candidate's identities.
+
+The old selected caller adapter has a narrower *inventory implementation*:
+`helpers = public - 208`, every public label productive, eight owned lifetimes,
+and a single scratch slot. That code cannot represent retired public role 573,
+eleven owned lifetimes, or two simultaneous lifetimes. This is an evidence gap
+in applying that independent adapter, not a counterexample to the primary local
+construction. The present extension closes this inventory gap without changing
+the spectral, Laurent, native-normalizer, target or negative-control equations.
+
+The five retained assumptions still apply: native all-width semantics, owned
+erasure, compiler closure, precision/tape realization, and analytic recovery.
+This adapter does not prove those assumptions. In particular it continues to
+report `paid_native_maps_replayed: false` and `machine_and_precision_admitted:
+false`; parent primary replay supplies the separate native-map evidence.
+
+## Exact scope of the extension
+
+`interface.py` partitions the literal local fields into independent public inputs
+and owned labels. For a compact word, these are consecutive public inputs and
+the declared `owned_fields`; for a legacy word, `independent_public` and
+`owned_roles` must form an exact disjoint partition, including any explicitly
+retired holes. All 104 main pairs must remain independent. Only the remaining
+independent fields receive helper targets. Their individual native endpoint
+normalizers are still checked by the original signed-Pauli and independent
+dense-phase routines.
+
+The interface walk checks every event's ownership, current chart, strict nested
+MOVE, active scalar sources and dyadic coefficient constraints. It does not
+replace the primary exact scalar endpoint replay. Each INIT allocates the lowest
+unused scratch slot and each CLEAR releases it. An explicit lifetime schedule
+is checked independently for overlap, label alias and balanced exits. A COPY
+is allowed only into an owned field with no scalar write since INIT; ideal zero
+is preserved by any preceding MOVE. Its numerical interpretation remains the
+residual-retaining ADD described above.
+
+For each of eighteen sequential LOCAL sites, the 208 local main inputs bind to
+that caller bank pair and every independent helper binds to its own fresh global
+field. Retired holes have no productive global ID. Owned lifetimes instead bind
+to the scratch slots immediately above the complete productive inventory.
+Distinct simultaneous lifetimes cannot share a slot. Every local lifetime ends
+before that LOCAL returns, so subsequent LOCALs and the intervening thin-query
+scratch may reuse these slots. This is checked using explicit hierarchical
+instruction addresses `(physical event, sequential port, local instruction)`.
+Each local INIT/CLEAR and each query INIT/CLEAR becomes an interval in that
+ordering; intervals sharing a global scratch slot must not overlap. Substituted
+LOCAL instructions have a single outer event index, while thin-query recipes
+have their own event index and execute by port. A mutation moves a query interval
+into a live local interval and must fail. Thin-query chronology and inverse-Q
+correction remain checked by the original routines.
+
+The recursive paid and productive histograms are rederived from literal MOVEs,
+the independently normalized helper endpoints, the unchanged main targets,
+queries and whole idles. Scalar allowance is recounted twice from literal
+coefficients. The local ordinary routing allowance is
+
+`1000 * (paid local jobs + 2*helpers + 208 + 4*104 + 4*owned lifetimes)`.
+
+The complete ordinary pass count then uses the original fixed controller census
+and must fit the source's finite raw allowance. This is still an abstract
+address/phase/scalar pass allowance under the retained tape contract, not a new
+machine-time estimate. Two owned scratch fields are explicitly recorded;
+constants for fixed inventories remain subject to the same compiler/storage
+assumptions and threshold argument as in the selected admission.
+
+All ten original fault controls remain present, including contact phase,
+exterior sign, missing idle, helper alias, main translation, owned query alias,
+missing inverse-Q correction and Laurent overflow. The extension adds deliberate
+overlap of simultaneous owned lifetimes and erroneous productive credit to an
+owned role. The productive-credit fault mutates the literal input inventory
+and reruns the interface audit; additional full audit mutations remove an
+independent field, stale the source lifetime count, and reuse a label before its
+first CLEAR. An original positive-control run uses the untouched PR5550 source
+and compares its entire scientific output byte-for-byte. On Windows only the
+unavailable operational RSS module is supplied with a nullable value; scientific
+code and output are unchanged. A separate guard samples the actual child RSS.
+
+## Source-specific lightweight checks
+
+For PR5713 head `a5348f7143f95fe0046b92b96172e30763c7d731`, the literal interface
+has 743 independent inputs, 535 helper targets, 9 owned labels, 11 lifetimes and
+peak 2. Eighteen fresh helper inventories plus 3,328 main fields give 12,958
+productive fields; owned slots are 12958 and 12959. The independently recounted
+local scalar and routing allowances are 220,326 and 5,164,000.
+
+The registered lightweight compatibility fixture exchanges helper label 573 with
+owned label 743 in this same frozen word. It permutes destinations and scalar
+sources, relocates the corresponding independent initial/final charts, and
+declares 573 a retired hole inside 744 public slots. There are still 743 independent
+inputs and 752 total local labels. This is a role permutation, not a new linear
+construction. The interface and full caller allocation must reproduce all
+profiles and allowances, give 573 no productive ID, retain one for relocated
+helper 743, and verify all 1,758 local/query lifetime intervals. Thus the public-hole
+branch is exercised without relying on an additional pending source.
+
+The literal original PR5550 interface also passes the same lightweight audit:
+735 public inputs, 527 helpers, eight lifetimes, peak 1. Full original and current
+candidate runs are explicitly separate, bounded serial commands. Their results
+are recorded only after successful completion; preparation is not a scientific
+caller pass. See the generated binding, patch, output, guard and receipt files.
+
+The unchanged original positive control and the current PR5713 candidate
+have completed in separate serial runs. The original output agrees with
+all frozen bytes (SHA256 `b51a7d19c10faea7d569a48e9536db8ba1e7418f8dd8dfb25646cc87cc9c4009`).
+The candidate verifies 7,488 contacts, 302 distinct signed-Pauli/independent-phase
+checks, 9,630 fresh helpers, 66,348 paid jobs, 12,958 productive fields and all 16
+negative controls. Its ordinary pass count 124,284,844 is below 184,647,552.
+The candidate full output SHA256 is
+`9fe876e5e74e878e691b0f9277ebbc39ce4610262526632db489816a4dd741ac`.
+Original/candidate elapsed times were 25.625/26.313 seconds, sampled child RSS
+peaks 73,019,392/76,578,816 bytes, under separate 120-second/512-MiB caps. These
+operational results are local evidence, not a guarantee on another host.
+
+Prepared for flyingviper with substantial OpenAI Codex assistance. Original
+PR5550/PR5599 contributor notices remain in the generated checker. Apache-2.0.

research/p104-caller-owned-interface/README.md

@@ -0,0 +1,144 @@
+# Independent P104 caller audit with explicit owned lifetimes
+
+The selected PR5599 independent caller adapter assumes every public label is
+productive, eight owned lifetimes, and one reusable scratch field. Newer P104
+constructions use retired public labels and overlapping owned lifetimes. This
+package supplies the missing inventory and scheduling adapter and checks it on
+[PR5713](https://github.com/CrocSwap/integer-mult-bounds/pull/5713), head
+`a5348f7143f95fe0046b92b96172e30763c7d731`.
+
+The source's recursive invoice is unchanged. **This is a scoped independent
+forward-caller audit: no new construction, kappa gain, selected-frontier update or
+complete supplier admission.** The old adapter's inventory restriction is an
+evidence gap for the newer interface, not a demonstrated flaw in the source's
+primary verifier.
+
+## Checked result
+
+| Obligation | Exact coverage |
+|---|---|
+| Unchanged original positive control | Complete PR5550 scientific output reproduced byte-for-byte |
+| Physical caller | 7,488 contacts; all eighteen forward LOCALs; exact 32-bank free-Laurent endpoint |
+| Native target binding | 535 helper normalizers and 208 intrinsic main adapters; 302 distinct signed-Pauli/independent-phase comparisons |
+| Productive inventory | 743 independent local inputs; 9,630 fresh caller helpers; 12,958 total productive fields |
+| Owned storage | Nine local owned labels, eleven lifetimes, peak two; explicit global interval schedule including thin queries |
+| Complete invoice | 66,348 paid jobs and 12,958 targets, equal to the pinned source |
+| Ordinary allowance | 124,284,844 abstract address/phase/scalar passes < retained 184,647,552 allowance |
+| Fault rejection | All ten original controls plus six inventory/lifetime/scratch controls |
+
+The actual source is compact. A separate exact role-permutation fixture swaps
+helper 573 with owned 743 to create a retired public hole while preserving every
+chart, coefficient, input count and lifetime. It verifies that the hole gets no
+productive ID, the relocated helper does, and all 1,758 local/query owned
+intervals remain nonoverlapping on their assigned scratch fields. This tests
+the general adapter without importing another construction or changing the
+candidate's scientific result.
+
+The exact candidate output is stored as `expected/candidate.json.gz`; replay
+compares its **complete decompressed bytes**. SHA256:
+`9fe876e5e74e878e691b0f9277ebbc39ce4610262526632db489816a4dd741ac`.
+Its inherited `reviewed_head` and `canonical_main` keys identify the original
+PR5550 checker capsule. The current candidate is separately and explicitly
+bound by `candidate_input.declared_source_head` to PR5713; those legacy keys
+are not its source revision.
+The original positive-control output remains the canonical PR5550 artifact,
+with SHA256
+`b51a7d19c10faea7d569a48e9536db8ba1e7418f8dd8dfb25646cc87cc9c4009`.
+
+## What changed in the checker
+
+[The explicit adapter patch](source/selected-adapter.patch) retains the selected
+checker's route, Laurent, signed-phase, native-normalizer and original fault
+equations. [The interface checker](code/interface.py) replaces numeric inventory
+assumptions with a disjoint independent/owned partition, literal INIT/CLEAR
+intervals and actual lifetime recount. It records two scratch fields above the
+productive inventory and proves query reuse is sequential by expanding their
+addresses as `(physical event, port, local instruction)`.
+
+The new controls modify real inventories or schedules: promote an owned label
+to an independent input, remove an independent field, stale the source's
+lifetime receipt, INIT a reused label before its prior CLEAR, alias simultaneous
+local lifetimes, and place a thin query inside a live local interval. Each fails.
+See [PROOF.md](PROOF.md) for the exact boundary and accounting argument.
+
+## Prerequisites and limits
+
+The primary PR5713 verifier is a separate prerequisite. A fresh parent-side
+replay passed its complete 752-column scalar/transpose obligations, 2,917 native
+maps/phases, primary physical caller and complete pricing; the short output is
+retained in `evidence/primary-prerequisite.log`. This package does not rerun that
+primary science or turn its log into an independent proof. Its own native checks
+cover helper/main normalizers, not every paid native map.
+
+The five selected framework assumptions remain: native all-width semantics,
+owned erasure, compiler closure, precision/tape realization and analytic
+recovery. COPY is an ADD into an ideally initialized owned zero, with numerical
+residuals retained; overwrite of noisy state is not justified. The result keeps
+`paid_native_maps_replayed: false` and `machine_and_precision_admitted: false`.
+The ordinary count is a finite descriptor-pass allowance under the retained
+tape contract, not a new machine-runtime, precision or storage theorem.
+
+## Reproduction and source custody
+
+Python 3.12, standard library, no network. From an integrated checkout:
+
+```sh
+python3 -B scripts/research_package.py --package research/p104-caller-owned-interface --check-only
+python3 -B scripts/research_package.py --package research/p104-caller-owned-interface
+python3 -B scripts/check_research_commit.py --package research/p104-caller-owned-interface --check-source-history
+```
+
+Expected marker: `PASS_P104_EXPLICIT_OWNED_CALLER_AUDIT`.
+Each registered normal/optimized command runs the original and candidate
+serially, with separate 120-second and sampled 512-MiB child caps. Normal and
+optimized equality is reproducibility, not two independent implementations.
+The untouched original positive control passed in 25.625 seconds. The current
+candidate passed in 26.313 seconds with a sampled RSS peak of 76,578,816 bytes;
+portable registered replay and publication checks are reported separately.
+The earlier PR5684 compact receipt and binding are retained in `evidence/` as
+historical evidence; they are not substituted for the PR5713 replay.
+
+Main provenance is `df0137efd35e11b4445734bf612bdd4c7ebc330c`. Canonical PR5550
+capsule inputs and the selected PR5599 adapter are declared live inputs in
+`SOURCES.json` and `VERIFY.json`; their bytes are authenticated before imports.
+The original capsule is reused in place. Only the current pending word, result,
+notice, exact adaptation and new evidence are packaged here. Pending PR5713
+bytes have explicit hashes in `source/EXPORT.json`; their archival custody does
+not claim that its head is in main's ancestry. Fresh child bytecode namespaces
+prevent stale caches from replacing authenticated source.
+
+## Scope and overlap
+
+This is an explicit user-authorized independent verification checkpoint. It
+changes the historical `supplier-boundary-audit` card's subject from PR4088 to
+the current P104 caller, retaining the card's gate: pin one exact obligation and
+preserve rejection predicates. It does not claim the original complete
+ordinary/outer admission task is finished. The parent coordinates current PR
+and discussion overlap and any publication; unknown unpublished coverage is
+not evidence of novelty.
+
+## Open next questions
+
+- Rebind this adapter to a successor only after pinning its primary all-input
+  and native evidence and comparing its actual controller and helper ABI.
+- Independently map the full pending supplier to all selected compiler,
+  precision, storage and analytic premises before any frontier admission.
+
+Concrete first steps and blockers are recorded in `TASK.json`. No broader
+search or recurring run is started by this package.
+
+## Credit
+
+Chris R/Clear1nsight's PR5550 supplies the independent caller, spectral,
+Laurent and native-normalizer checker. The maintainer PR5599 review supplies
+the selected inventory adapter and admission analysis. Ali Romman supplies
+PR5713 with OpenAI Codex assistance, building on Joel Pulikkan/GamingPuzzled's
+PR5684 with Claude assistance and Ali Romman's PR5678. The predecessor
+attribution is retained verbatim in
+`source/NOTICE-PR5713`. This includes the work of flyingviper, Scratch-net,
+Pierre-Loic Doulcet, Joel Pulikkan, DreamingOfClouds, thu-nmrc, Gareth Davidson,
+David Arias, Cinna Davis, Jacob Alan Sussman, zxv and Cao Yifan.
+
+New explicit ownership adaptation, independent replay and package prepared for
+flyingviper with substantial OpenAI Codex assistance. Agent checks are not
+independent human or formal mathematical acceptance. Apache-2.0.