Audit the complete G20 caller and exact port interfaces

research/g20-global-caller-audit/.gitattributes

@@ -0,0 +1 @@
+source/** -text

research/g20-global-caller-audit/NOTICE

@@ -0,0 +1,10 @@
+New G20 global boundary checker, rational port certificates and proof:
+Ali Romman with substantial OpenAI Codex assistance. No subagents. Apache-2.0.
+
+The construction is PR5708, building on PR5679, Dugongue PR5657/5665 and
+ai-nanachi PR5512. The local all-address proof is PR5782. Their complete source
+attribution and limitations remain in source/PROOF.md, source/NATIVE-README.md,
+source/NATIVE-PROOF.md and source/NOTICE-*.md. The controller, native involution,
+helper retirement/split, query accounting and positive finite-fee schema are
+source contributions. This package claims the separate global boundary audit
+and explicit port/interface witnesses, not those constructions.

research/g20-global-caller-audit/PROOF.md

@@ -0,0 +1,144 @@
+# The global caller boundary
+
+This proof concerns PR5708 at 829d01fc031f7323ffcfa423fdfd1f24dcbe3190.
+The local native theorem is the explicit dependency from PR5782 at
+50e19025f7efdb956bf3bb887da30470efc185ef. Four exact source hashes show that
+its word, frames, local result and normalizers are the same inputs. The new
+checker imports no predecessor Python implementation. It does not repeat the
+native audit's rational elimination or construction search.
+
+## Exact local interfaces
+
+The local native proof gives the action on arbitrary F2-valued functions. Let
+T_P denote transport by the paired-address involution H_P for projection P.
+For each of the 111 ports, the actual entry/exit frames are
+
+```
+source: full eight-dimensional space -> line L
+ target: seven-dimensional complement U -> zero frame.
+```
+
+The checker reads these frames from the emitted word. It checks L perpendicular
+to U and constructs an invertible matrix W whose first column spans L and whose
+other seven columns span U. It checks both inverse products and
+`P_L W = W diag(1,0,...,0)`. The 111 matrices and inverses are in RESULT.json.
+Their denominator least common multiple is 4. The full and zero frame identities
+are covered by the authenticated native theorem. Thus W sends the local line to
+one coordinate and its complement to the other seven coordinates.
+
+Use the same W on both paired address halves. The paired sums and differences
+then obey the same conjugation. Put the first coordinate in the common central
+line and the other seven in the block for this stage. Different full stages use
+disjoint blocks. The central line plus 18 blocks has dimension 127. Extend each
+map by the identity on unused coordinates. The maps remain invertible modulo
+any q coprime to 4. Together with the local theorem, q coprime to 12 suffices for
+these rational identities. This statement does not choose the compiler's prime
+or prove a physical tape tariff.
+
+Write tau for the central involution and sigma_s for the stage involution. The
+local theorem and these actual endpoints give
+
+```
+x' = T_L T_full x = sigma_s x
+y' = T_U y + T_full x = sigma_s y + sigma_s tau x.
+```
+
+The two address maps commute and square to the identity. Over F2 this block
+operator is itself an involution. Therefore the same released local word can
+serve either controller orientation; the direction only exchanges the two banks.
+This checks a required implication that a scalar RAW endpoint alone cannot give.
+The paid port-entry and return records specify the retained route placements.
+Their realizability on the retained ROW/spectator domain is still a framework
+contract. The explicit W matrices supply the finite algebraic normalizers.
+
+## Bind every emitted event
+
+The checker consumes the entire 317004-event stream against the controller and
+the exact 14794-event local word. It maps all 685 local roles injectively at each
+of 18 calls. The 396 retired originals are exactly 22 helper owners in each of
+18 distinct cohorts. There are 11004 retained old originals and 18 new split
+inputs, for 11022 independent public inputs. The 48 owned roles are separate.
+
+Every local ADD, query, free zero-frame map, initialization and erasure has its
+exact source position and geometric labels. Both route directions and every
+call boundary match. A thin call has one source copy, one paid rank-one query,
+one delivery and one owned clear. Its source is unchanged between acquisition
+and delivery. Each whole idle uses distinct actual stage blocks and costs seven
+times their count. All scalar bridges, swaps and boundary programs are consumed.
+No extra or missing stream suffix is allowed.
+
+A separate forward interpreter starts with 11070 independent scalar symbols,
+including arbitrary dirty owned inputs. It checks whole-zero preconditions and
+permits erasure only on owned roles. For every query it checks the complete
+preceding stream hash, current owner, version, erasure epoch, rank, geometric
+detail and RAW coefficient row. Every public output has its own input row;
+all owned outputs are zero and all dirty columns vanish. A reverse interpreter
+propagates transposed ADDs and erasures from the outputs and obtains the same
+complete endpoint. Each direction checks 122544900 binary coefficients through
+exact bitmaps. These are scalar checks; the physical argument uses the local
+native theorem and the controller calculation below.
+
+The lifetime census starts at the first ADD into an owned role after a clear and
+ends at its next clear. It matches all 2529 recorded episodes, with peak 48 live
+roles. There are 864 local episodes and 1665 thin episodes. All 48 banks are
+reserved; the peak is not reduced by sequential reuse across calls. The positive
+majorant is independently propagated with addition in place of XOR and equals
+the source's exact 384-bit integer.
+
+## Every physical controller coefficient
+
+Use the group algebra over F2 of commuting involutions tau and sigma_s. A
+monomial is the subset of generators that occur an odd number of times. The
+checker represents a coefficient by its monomial mask and output-bank index,
+and propagates the transpose of the controller in reverse order. A local call
+multiplies both adjoint rows by sigma_s, then adds tau times the second to the
+first. A thin shear, idle, scalar bridge and boundary have their literal actions.
+
+The result is exactly the declared diagonal on all 32 banks, with no other
+coefficient. This is a formal polynomial identity, not evaluation at sampled
+addresses. Substituting the commuting paired-address maps therefore gives the
+physical main endpoint on every input function, subject to the stated route and
+native contracts. Tensoring every map with a spectator identity preserves it.
+Each diagonal mask contains tau. A mask with k stage blocks has target rank
+1+7k. Repeating the identity on 111 ports gives all 3552 main targets.
+
+Every retained helper has actual endpoints full->zero, full->frame508 or
+frame508->zero. The local theorem gives their independent function identities;
+its normalizers give the two rank-four split halves. The checker derives every
+helper rank from those endpoints and verifies a bijection onto all 11022 public
+owners. Duplicate owners, missing debits and owned target credit are forbidden.
+The complete target/paid rank surplus is 753.
+
+## Complete finite primitive allowance
+
+The literal inventory gives 56223 paid queries. Its 253329 scan passes include
+all ADD, CLEAR and zero-header passes plus entry/exit allocation charges for all
+48 owned banks. Parent parking costs `4*11070*56223 = 2489554440` field passes.
+The native dimension allowance is `56223*(32*127^2+8*127^3) = 950348163816`.
+All 317004 emitted records are charged as well.
+
+There are 7548 internal port routes. The actual targets require 7176 external
+routes: two for each of 3552 main and 36 split targets. The retained external
+allowance is 7320, so it has 144 spare routes from retired partial helpers. This
+is a conservative overcharge. The checker derives the required set from actual
+target owners and verifies coverage instead of assuming the old constant fits.
+
+Both directions and both paired address halves of the actual matcher matrices
+give `38*72*2 + 76*36*2 = 10944` coefficient terms. Adding these charges gives
+952838314401 primitive invocations, exactly the source bound and less than 2^64.
+These invocations have positive retained costs. The count is not a machine-time
+measurement or a proof that each dense map has unit cost.
+
+## Limits and remaining work
+
+This resolves the finite global binding, owned-episode, operator-polynomial,
+target-owner and base-fee audit boundary. It does not independently prove the
+local native theorem, compiler recurrence, uniform stock allocation, precision
+and tape contracts, analytic recovery, or a compatible Gaussian/outer assembly.
+The source ordinary saving .003507719059749 is not re-admitted by this audit.
+No new kappa or selected-frontier change follows. Independent human scientific
+acceptance is pending.
+
+Ali Romman with substantial OpenAI Codex assistance, no subagents. Apache-2.0.
+The G20 construction, controller, native formulas, target splits and ordinary
+fee schema retain their original authorship; see NOTICE and frozen notices.

research/g20-global-caller-audit/README.md

@@ -0,0 +1,46 @@
+# Independent G20 global caller audit
+
+The exact PR5708 global caller passes a separate audit of all 317004 events,
+11022 arbitrary public inputs, 48 arbitrary dirty owned inputs, 56223 query
+sources and 2529 owned episodes. The checker imports no source implementation.
+It complements the local native audit in PR5782.
+
+The new interface certificate gives all 111 rational port normalizers and their
+inverses, with denominator least common multiple 4. It proves that the actual
+local endpoints supply the full-stage/central-shear operator used by the global
+controller. Reverse propagation checks every coefficient of the controller's
+formal polynomial. Independent forward and transpose scalar passes each check
+122544900 endpoint coefficients through exact bitmaps. Every target has one
+public owner, and every retired target is debited.
+
+The positive finite bill is 952838314401 primitive invocations. It includes all
+parking, owned state, query dimension work, routes and 10944 actual matcher
+coefficients. The retained route allowance has 144 spare routes; it covers the
+actual target set. This is an audit of a conservative bound, not a speedup or a
+new kappa. The [proof](PROOF.md) states the exact dependencies and limitations.
+
+Run `python3.12 -B scripts/research_package.py --package research/g20-global-caller-audit`.
+The package registers normal and optimized checks. RESULT.json contains the
+exact receipt, complete port matrices and semantic rejection controls.
+VALIDATION.md records the executed validation and export checks.
+
+Exact construction source: PR5708 at
+829d01fc031f7323ffcfa423fdfd1f24dcbe3190. Native proof dependency: PR5782 at
+50e19025f7efdb956bf3bb887da30470efc185ef. All 22 frozen source files retain their
+bytes and original Git blob/SHA256 bindings. SOURCES.json also binds them to
+this branch's own retention commit. Selected frontier .00310045 stays unchanged.
+The source ordinary .003507719059749 is not re-admitted here.
+
+## Open next questions
+
+1. Can a separate audit prove the ordinary compiler and suspended-instance stock
+   bound for this exact caller? Use the complete owned reserve of 48 per instance.
+2. Can the finite port maps and route placements be lowered under the full
+   ROW/spectator and tape contract with explicit positive costs?
+3. Can a stronger Gaussian construction use this BIT component through a fully
+   checked outer assembly? A component saving alone does not increase kappa.
+
+Ali Romman with substantial OpenAI Codex assistance; no subagents. This separate
+implementation is not independent human acceptance. Credit Dugongue, ai-nanachi,
+the PR5679/5708 construction and all native, controller, compiler and ordinary
+predecessors in NOTICE. Apache-2.0.