diff --git a/ARCHITECTURE.adoc b/ARCHITECTURE.adoc new file mode 100644 index 0000000..1c0a7a6 --- /dev/null +++ b/ARCHITECTURE.adoc @@ -0,0 +1,48 @@ +== Architecture + +=== Overview + +This repository follows a modular, maintainable architecture designed +for clarity, scalability, and long-term sustainability. + +=== Directory Structure + +.... +. +├── src/ # Source code +├── tests/ # Test suites +├── docs/ # Documentation +├── scripts/ # Utility scripts +├── config/ # Configuration files +├── LICENSE # License file +├── LICENSES/ # Full license texts +└── README.adoc # Project documentation +.... + +=== Design Principles + +* *Separation of Concerns*: Each module has a single responsibility +* *Testability*: Code is written to be easily testable +* *Documentation*: All public APIs are documented +* *Configuration*: Environment-specific settings are externalized + +=== Dependencies + +* External dependencies are minimized and clearly declared +* Version pinning is used for reproducibility + +=== Security Considerations + +* Sensitive data is never committed to the repository +* Secrets are managed through environment variables or secure vaults +* Regular dependency audits are performed + +=== Maintainability + +* Code follows consistent style guidelines +* Pull requests require review and CI checks +* Issues and discussions are tracked transparently + +''''' + +_Last updated: 2026-07-18_ diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md deleted file mode 100644 index 607e3d8..0000000 --- a/ARCHITECTURE.md +++ /dev/null @@ -1,47 +0,0 @@ -# Architecture - -## Overview - -This repository follows a modular, maintainable architecture designed for clarity, scalability, and long-term sustainability. - -## Directory Structure - -``` -. -├── src/ # Source code -├── tests/ # Test suites -├── docs/ # Documentation -├── scripts/ # Utility scripts -├── config/ # Configuration files -├── LICENSE # License file -├── LICENSES/ # Full license texts -└── README.adoc # Project documentation -``` - -## Design Principles - -- **Separation of Concerns**: Each module has a single responsibility -- **Testability**: Code is written to be easily testable -- **Documentation**: All public APIs are documented -- **Configuration**: Environment-specific settings are externalized - -## Dependencies - -- External dependencies are minimized and clearly declared -- Version pinning is used for reproducibility - -## Security Considerations - -- Sensitive data is never committed to the repository -- Secrets are managed through environment variables or secure vaults -- Regular dependency audits are performed - -## Maintainability - -- Code follows consistent style guidelines -- Pull requests require review and CI checks -- Issues and discussions are tracked transparently - ---- - -*Last updated: 2026-07-18* diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc new file mode 100644 index 0000000..44579c0 --- /dev/null +++ b/CHANGELOG.adoc @@ -0,0 +1,365 @@ +== Changelog + +All notable changes to echo-types will be documented in this file. + +The format is based on https://keepachangelog.com/en/1.1.0/[Keep a +Changelog]. + +=== [Unreleased] + +==== Added (2026-06-13) + +* _`+EchoDeniability.agda+` — residue deniability as a first-class echo +property._ Formalises the deniability exploration (`+Deniability.agda+` +/ `+DeniabilityPartial.agda+`) inside the echo-types framework. Two +production functions at opposite ends of the deniability spectrum: +** `+produce-perfect+` (constant, mirrors `+collapse : Bool → ⊤+`): +perfectly deniable for all openers; `+no-section-produce-perfect+` +closes via `+no-section-of-collapsing-map+`. +** `+produce-partial+` (injective): deniability fails for arbitrary +openers (`+partial-not-deniable+`); section exists +(`+partial-has-section+` with `+partial-witness+`). The +`+IsConstantOpener+` class is the exact cut-point at which deniability +is restored for the partial case; it is the type-level analogue of the +`+affine+` mode in `+EchoObservationalEquivalence._≡m_+`. Honest-bound +matched-negative block: +`+NotProved-{side-channel-safe, cryptographic-deniability, adaptive-adversary}+`. +Zero postulates; `+--safe --without-K+`. Wired into `+All.agda+`, pinned +in `+Smoke.agda+`. +* _`+wiki/Deniability.adoc+`_ — dedicated wiki page covering both +production functions, the no-section/section duality, the +`+IsConstantOpener+` boundary, the connection to +`+EchoObservationalEquivalence+`, and the honest scope. Linked from +`+wiki/Home.adoc+` start-here table. + +==== Added (2026-06-12) + +* _Cross-repo typesystem-integration sweep recorded in +`+docs/bridges/cross-repo-bridge-status.md+`._ echo-types is now +integrated into the hyperpolymath type systems (all merged to the +consumers’ `+main+`), with four new ledger rows: +** *nextgen-typing* — `+EchoTyping.agda+` imports +`+EchoLinear+`/`+Echo+`: AffineScript `+linear ⊑ affine+` subtyping IS +`+weaken+` (irreversible, distinction-forgetting, proof-irrelevant at +affine); refinement erasure IS a fiber. Content bridge, `+agda --safe+` +3/3. +** *phronesis* — `+PhronesisEcho.agda+`: an ethical verdict’s provenance +IS `+Echo verdict v+`. Content bridge. +** *nextgen-languages/kitchenspeak* — `+EchoBridge.agda+` status +upgraded hand-verified → machine-checked against the real `+Echo+`. +** *invariant-path* — Rust application example (`+classify_candidate+` +non-injective; retained candidate + `+losses+` IS the echo). +Citation-level. No echo-types proof source changed; this is a +documentation/ledger sweep recording downstream adoption. + +==== Added (2026-05-30) + +* _Lane 3 ordinal track — Slice 3+4 Route A 6-PR arc + doc sweep._ Seven +PRs (#165, #166, #167, #168, #169, #170, #171) build out the rank-mono +*union umbrella* over source-rule extensions: +** PR #165 — `+RankLexJointBplus+`’s `+(b) lex-first+` primitive + +`+bpsi+`-source-at-equal-head sub-case discharge. +** PR #166 — `+(c)+` trichotomy data type `+BplusFirstTri+` + the +consumer-side first-eq derivation via `+cong₂ _⊕_+` over the +definitional `+rank-pow (bplus x y) = rank-pow x ⊕ rank-pow y+`. Key +insight: same residual obligation gates BOTH the ψ-rank- level closure +AND the bplus-chain-level closure (halves the apparent proof debt at +this case). +** PR #167 — Path-3 prototype: `+RankMonoSameLeft._<ᵇ⁺²_+` adds a +literal-same-left source-rule extension that closes in one line via +`+rank-pow-bplus-right-mono+`. Source-rule enrichment is structurally +simpler than rank-function enrichment (`+rank-lex-jb+`) for this +sub-case. +** PR #168 — architectural umbrella `+RankMonoUnion._<ᵇᵘ_+` = +`+_<ᵇ¹_ ⊎ _<ᵇ⁺²_+` via `+Sum+` + `+[_,_]+` mediator. New source-rule +extensions ship as separate modules and union in with two mechanical +edits. WfCNF wrap propagates automatically. +** PR #169 — `+RankMonoUnionWfCNF._<ᵇᵘⁿ_+` mirrors Slice 4’s `+_<ᵇ⁻ⁿ_+` +over the union umbrella, bundling the canonical-form invariant alongside +the rank-relation for downstream Buchholz consumers. +** PR #170 — `+RankMonoUnionWF.wf-<ᵇᵘ+` derives `+WellFounded _<ᵇᵘ_+` +via `+Subrelation.wellFounded+` + `+On.wellFounded+` rank-embedding +transport from `+wf-<′+`. Closes Gate 2 of the arc (well-foundedness of +the union). +** PR #171 — doc sweep: `+docs/echo-types/MAP.adoc+` enumerates the six +new modules; `+roadmap.adoc+` gains a "`Slice 3+4 Route A 6-PR arc +(2026-05-30)`" subsection; `+buchholz-rank-obstruction.adoc+` upgrades +the `+<ᵇ-+1+` row from "`Slice 3 headline remaining`" to "`closed for +strict-head + literal-same-left sub-cases`". ++ +163 modules at arc close, all `+--safe --without-K+`, zero new +postulates, no funext. Three documented gates: Gate 1 (tail-rank- +equality discharge for cross-head rank-equal case) *OPEN* — structural +blocker, both pre-identified unblock routes CHECKED-REFUTED in PR #146; +Gate 2 (WF) *CLOSED in #170*; Gate 3 (Path-4+ further source-rule +extensions) *OPEN* but mechanical via the documented recipe. +* _Trusted-Base Reduction Policy enforcement._ PR #172 adds +`+docs/proof-debt.md+` enumerating echo-types’ sole soundness- relevant +escape hatch — the four propositional-truncation postulates in +`+proofs/agda/EchoImageFactorizationPropPostulated. agda+` — under +Disposition (c) NECESSARY AXIOM. Clears the recurring +`+governance / Trusted-base reduction policy+` red check that had been +failing on every echo-types PR since the policy was adopted estate-wide +(standards#211). No code change beyond the new docs file. +* _Cross-repo echo↔ephapax L3 bridge package._ Four PRs (#161, #162, +#163 + companion ephapax sync) establish the named correspondence +between echo-types L3 (`+weaken : LEcho linear → LEcho affine+`, +`+no-section-collapse-to-residue+`) and ephapax-affine’s L3 layer: +** PR #161 — `+docs/bridges/EchoBridges.md+` package layout (§§1-4) + +`+EchoTypes.jl+` v0.2.0 surfacing. +** PR #162 — `+proofs/agda/EchoEphapaxBridge.agda+` NARROW stub — two +definitional refl-renames + a docstring catalogue +(`+ephapax-L3-weaken+`, `+ephapax-L3-no-section-collapse+`). Honest +scope: L3 ONLY; ephapax-affine + L1/L2/L4 NOT mirrored. Closes #126. +** PR #163 — adjacency cleanup: `+EchoBridges.md+` §5 + cross-repo +bridge-status row + roadmap Lane 4 list. +* _arghda-core extraction._ PR #160 removes `+arghda-core/+` from this +repo’s tree; it now lives as a standalone repo +(`+hyperpolymath/arghda-core+`) per the umbrella in #159. Reduces +echo-types’ surface area to the propositional/proof-theoretic core. +* _Roadmap close-out._ PR #157 closes Lane 5 (killer-app accepted) and +refreshes the stale Lane 1 close-out annotation. + +==== Fixed (2026-05-30) + +* _Hypatia agda_postulate scope-narrowing._ PR #156: the +`+EchoImageFactorizationPropPostulated.agda+` exploratory module’s four +postulates trigger Hypatia’s `+code_safety/agda_postulate+` rule. Inline +`+-- hypatia: allow code_safety/agda_postulate+` at the head of the file +(with one-line justification pointing to the kernel-note Tier-2 +classification) scope-narrows the alert to the single legitimate site, +keeping the rule active for unintended new postulates anywhere else. + +==== Added (2026-05-28) + +* _Lane 3 ordinal track — Slice 3 prerequisites._ PR #137 added +`+proofs/agda/Ordinal/Buchholz/RankPowSlice3.agda+` (220 lines) — three +primitives toward the Slice 3 headline: +** `+NonBzero+` — left-spine non-bzero predicate excluding the +degenerate `+bplus bzero bzero+` chains that WfCNF technically allows +but CNF normalisation excludes. +** `+ω-rank-pow-succ-≤-via-<Ω+` — strict-jump bridge from `+μ <Ω ν+` to +`+ω-rank-pow-succ μ ≤′ ω-rank-pow ν+`. Closes the gap between Slice +2-bplus’s upper bound on the source’s rank and the lower bound on the +target’s rank. +** `+head-Ω-lower-bound+` — head-Ω LOWER bound under WfCNF + NonBzero. +Dual of `+rank-pow-dominated-by-head-Ω+`. +* _Lane 3 ordinal track — Slice 3 headline closed under a strict-head +premise._ PR #141 added +`+proofs/agda/Ordinal/Buchholz/RankPowSlice3Headline.agda+` (155 lines). +The headline `+rank-mono-<ᵇ-+1-via-head-Ω+` closes the joint-bplus +rank-mono case for `+_<ᵇ-+1_+` via Route A from the Slice 3 design note. +The proof composes the four Slice 3 prerequisites in a clean chain (no +structural recursion): Slice 2-bplus + head-Ω-bplus → strict-jump bridge +→ head-Ω lower bound → `+⊕-left-≤-sum+`, all via `+≤′-trans+`. The +headline takes the strict-head premise `+head-Ω x₁ <Ω head-Ω y₁+` as an +EXTERNAL HYPOTHESIS; the umbrella’s case-split is the remaining wiring +(the `+bpsi=bpsi+` at equal markers sub-case still needs `+α+`’s rank +via rank-adm or rank-lex). Compiles standalone under +`+--safe --without-K+`, zero postulates. Smoke green. +* _Canonical identity layer — (epi, mono) earn-back form._ PR #138: +`+proofs/agda/EchoImageFactorizationProp.agda+` lands the (epi, mono) +factorisation module-parameterised in a truncation interface — the +long-pending earn-back gate previously referenced as "`next`" in +`+docs/echo-types/MAP.adoc+`. Companion to `+EchoImageFactorization+`. +Classification: Tier 2 in `+docs/echo-types/echo-kernel-note.adoc+`. +* _Classification grid — Search + Epistemic ResidueForm instances._ PR +#139: `+EchoResidueTaxonomy.agda+` gains two further +`+ResidueForm f R+` instances (`+Search+` and `+Epistemic+`) alongside +the existing six (trivial, identity, generic Σ-cert, linear-affine, +indexed, cost; the 2026-05-27 audit-follow-on lands of +`+indexed-residue+` + `+cost-residue+` are what made the pre-#139 count +six). Brings the total to *eight instances*, with the remaining two +decoration modules documented as structurally compatible. +* _Lane 3 ordinal track — Slice 3 umbrella + lex-rank companion._ PR +#142 extends `+_<ᵇ¹_+` with the joint-bplus constructor + the +strict-head dispatch that wires the Slice 3 headline +(`+rank-mono-<ᵇ-+1-via-head-Ω+` from PR #141) into the umbrella +case-split. PR #143 adds the lex-rank companion: the +`+bpsi-source-at-equality+` ψ-rank discharge — the very sub-case PR +#144’s CHANGELOG described as still requiring `+α+`’s rank via rank-adm +or rank-lex. The `+<ᵇ-+1+` joint-bplus rank-mono closure is now +substantively complete via the head-Ω+lex-rank composition. +* _Visual identity — banner kit ("`Diagrammatic Hush`")._ PR #140: +`+docs/assets/banner.{png,svg}+`, `+docs/assets/banner-philosophy.md+`, +`+tools/banner/build-banner.mjs+`. The `+README.md+` and `+readme.adoc+` +both gained the banner image at the top. No content impact; purely +visual identity for the project’s public surface. + +==== Fixed (2026-05-28) + +* _CI hygiene: kernel-guard classification-drift unblocked._ PR #136: 18 +previously-unclassified `+Echo*.agda+` modules (the canonical- identity +/ OFS cohort plus the application/extension modules: +`+EchoTotalCompletion+`, `+EchoOrthogonalFactorizationSystem+`, +`+EchoImageFactorization+`, `+EchoNoSectionGeneric+`, +`+EchoLossTaxonomy+`, `+EchoResidueTaxonomy+`, +`+EchoDecorationStructure+`, `+EchoObservationalEquivalence+`, +`+EchoOFSUnivF5+`/`+Diag+`/`+Iso+`, `+EchoCanonicalIdentitySuite+`, +`+EchoEntropy+`, `+EchoLLEncoding+`, `+EchoProvenance+`, +`+EchoSecurity+`, `+EchoProbabilisticSupport+`, `+EchoDifferential+`) +are now classified in `+docs/echo-types/echo-kernel-note.adoc+`, +unblocking `+scripts/kernel-guard.sh+` Check B (classification-drift +lint). +* _CI hygiene: N5Falsifier xfail gate removed._ PR #136 also dropped the +`+Expected-failure gate (N5Falsifier is known-broken)+` step from +`+.github/workflows/agda.yml+`. +`+proofs/agda/characteristic/ N5Falsifier.agda+` was resolved on +2026-05-27 by pinning the implicit `+r+` / `+grade+` at four +`+applyRole+` / `+applyGrade+` call sites — the unsolved-metas were an +inference blocker, not a content blocker. The module is now imported by +`+proofs/agda/characteristic/All.agda+` (line 33). The xfail gate’s own +self-disclosed instructions +(`+"register it in characteristic/All.agda and remove this xfail gate"+`) +fired on the previous CI run; this PR completed those instructions. + +==== Added (2026-05-27) + +* _Lane 3 ordinal track — 11/13 Buchholz constructors closed under WfCNF +restriction._ Three slices land on top of the existing `+RankPow+` +9-constructor umbrella: +** `+Ordinal.Buchholz.RankAdm+` (admissibility-aware rank +`+rank-adm (bpsi ν α) = ω-rank-pow ν ⊕ rank-pow α+`) closing `+<ᵇ⁺-ψα+` +via `+rank-mono-<ᵇ⁺-ψα-from-pow+`. +** `+Ordinal.Buchholz.RankLex+` (lex-pair rank `+RankLex+` over +`+Ord × Ord+` with shared-implicit second-strict constructor) closing +`+<ᵇ-ψΩ≤+` at both `+ν<μ+` (first-strict) and the `+ν=μ+` boundary +(second-strict via the admissibility bound). +** `+Ordinal.Buchholz.HeadOmega+` (leading-Ω-index head function +`+head-Ω : BT → OmegaIndex+` plus definitional sanity lemmas and a +two-level compositional convenience) — first slice of option +[upperalpha] +. for the remaining `+<ᵇ-+1+` joint-bplus discharge; no rank-mono yet. +* _Lane 3 head-Ω route — Slice 2 + Slice 2-omega + inversion + Slice +2-bplus ALL LANDED 2026-05-27._ Follow-on to the Slice 1 head-Ω landing +above (PRs #130 + #131 + #133 + #134): +** `+Ordinal.Buchholz.RankPow+` gains +`+ω-rank-pow-succ : OmegaIndex → Ord+` with per-marker strict +dominance at _both_ branches (`+ω-rank-pow-<-succ-fin+` via +`+ω^-strict-mono-suc+`; `+ω-rank-pow-<-succ-omega+` via the +`+Brouwer/OmegaPow.ω^-strict-mono-suc+` template mirrored at +`+ω-rank-pow ω+`) plus the unified +`+ω-rank-pow-<-succ : ∀ μ → ω-rank-pow μ <′ ω-rank-pow-succ μ+`, plus +atomic-rank factoring through `+head-Ω+` +(`+rank-pow-bOmega-via-head-Ω+`, `+rank-pow-bpsi-via-head-Ω+`). +** Slice 2-omega closes a Brouwer-encoding hazard the original CLAUDE.md +proposal would have tripped: the proposed +`+ω-rank-pow-succ ω = olim (λ n → ω^(suc(suc n)))+` is equi-ordinal with +`+ω-rank-pow ω = olim (λ n → ω^(suc n))+` (both denote `+ω^ω+`), so +cannot strictly dominate. The revised shape +`+olim (λ n → ω-rank-pow ω ·ℕ n)+` denotes `+ω^(ω+1)+` and goes strictly +higher via `+X≤′oz⊕X+` + `+⊕-mono-<-right (ω-rank-pow-pos ω)+`. Full +record in `+Ordinal.Buchholz.RankPow+`’s "`History note`" block. +** New module `+Ordinal.Buchholz.HeadOmegaInversion+` lands the +option-(b) inversion lemmas `+head-Ω-inv-bOmega+` (strict) and +`+head-Ω-inv-bpsi+` (non-strict). Both proved by structural recursion on +the `+<ᵇ+` derivation; no rank-mono dependency. +** New module `+Ordinal.Buchholz.RankPowDomination+` lands the Slice +2-bplus headline `+rank-pow-dominated-by-head-Ω+` by structural +recursion on WfCNF, plus the supporting lemmas (`+<′→≤′+`, +`+≤′-<′-trans+`, `+<′-trans+`, `+ω-rank-pow-mono-≤Ω+`, +`+ω-rank-pow-succ-pos+`, `+additive-principal-ω-rank-pow-succ+`, +`+rank-y-bound+`). PR #134 was the one-line explicit-implicit fix for +the initial `+ω≤ω+` case of `+ω-rank-pow-mono-≤Ω+`. +* _Decoration bridge — R5 exploratory entry scaffolded (PR #129)._ +`+docs/echo-types/explorations/decoration-bridge/+` lands a bounded +exploration of whether the Choreo × Graded integration shape resembles +adjacent-domain decoration constructions (CRDTs, gossip, local-first +causal histories). Scope strictly the one axis pair +`+EchoIntegration.agda+` already integrates; external candidates framed +as analogies-with-falsifiers, never as evidence of recipe +generalisation. Sits as `+roadmap.adoc+` § R5 (deferred research) with +explicit termination criteria (Track A/B/C failure, all candidates +retired, redundancy with retracted framing, forbidden-rebrandings +register addition, retraction-watch trip). Companion Agda module +`+proofs/agda/EchoDecorationBridge.agda+` — deliberately not in +`+All.agda+`, classified as "`Exploratory (not in All.agda)`" in +`+docs/echo-types/echo-kernel-note.adoc+` so CI’s classification-drift +lint stays green. +* _Tier-1+2+3 spine + audience moves + suite + F5 FULL PASS LANDED +2026-05-27._ My session’s contribution sitting on top of the +parallel-session ordinal work above. See CLAUDE.md’s "`Slice-2 upstream +adoption`" + "`broad-cleanup close`" session arcs for the deliverable +list; key headlines: `+EchoTotalCompletion.A↔ΣEcho+`, +`+EchoOrthogonalFactorizationSystem.ofs-witness+`, +`+EchoNoSectionGeneric.no-section-of-collapsing-map+`, the four Tier-2 +classification-grid records (`+ResidueForm+` / `+DecorationStructure+` / +function-side / observational), the Pillar F Gate F5 FULL PASS triple +(F5-1 / F5-2 / F5-3) earning back the qualified OFS, four +audience-facing modules (`+EchoProvenance+` / `+EchoSecurity+` / +`+EchoProbabilisticSupport+` / `+EchoDifferential+`), and the curated +single-file entry `+EchoCanonicalIdentitySuite+`. Two consolidation +narratives +`+docs/echo-types/{universal-property,fibration-package}.adoc+`. +Retraction follow-up F-2026-05-27a logged in `+docs/retractions.adoc+`. +* _Lane 5 tutorial track — the originally-scaffolded triplet is +complete._ `+tutorial/+` ships three worked walkthroughs with +honest-bound disclosure at top + matched-negative `+NotProved-*+` +`+⊤+`-aliases at bottom: +** `+tutorial/region_exit_audit/+` (Walkthrough 1, killer-app candidate +per `+roadmap.adoc+` §Lane 5) — ephapax-L3-style region exit modelled +type-level via `+EchoLinear.no-section-weaken+`. +** `+tutorial/epistemic_erasure/+` (Walkthrough 2) — 4-seed → 2-key KDF +with no-section-via-residue lifted from +`+EchoResidue.no-section-collapse-to-residue+`. +** `+tutorial/provenance_debugging/+` (Walkthrough 3) — 4-element +`+State+` with two orthogonal sign bits walked through 3 residue layers; +new pedagogical shape ships _both_ a section (Layer 1 +`+recover-section-at-layer-1+`) and its absence (Layer 2 +`+no-recovery-from-trivial+`), exhibiting the boundary at which the +type-level recovery property flips. +* _Establishment-track Pillar E — packaging pre-staged._ +`+CITATION.cff+` and `+.zenodo.json+` at the repo root (placeholder DOI ++ ORCID-commented until author setup), `+echo-types.agda-lib+` with dual +`+include: proofs/agda .+` covering the tutorial track, and README +§Citation + §"`Installing as a library`" sections. CI install-self + +GitHub→Zenodo workflows intentionally deferred until the author +authorises the Zenodo integration (avoids transient CI red). +* _Establishment-track Pillar E — venue + outreach._ +`+docs/echo-types/pillar-e-offline.adoc+` lands the venue matrix (TYPES +→ CPP → ITP → MSCS), Zenodo DOI mint plan, library packaging plan, and +three pre-written outreach cover letters (Granule/QTT, choreographic +types, Linear Haskell). Author-driven for submission, sending, and +Zenodo flip. +* _Gate 2 audit — Revision 5 + 5b._ `+docs/characteristic.adoc+` carries +the close-out re-audit (4/4 surviving theorems, N5 resolved within Rev 5 +follow-up). +* Initial RSR template floor (CHANGELOG/SECURITY/CONTRIBUTING/QUICKSTART +set + contractiles + 4 mandatory workflows + dotfiles + 0-AI-MANIFEST). +Scaffolded 2026-04-30. + +==== Changed (2026-05-27) + +* _Roadmap consolidation._ Five overlapping roadmap docs +(`+docs/echo-types/roadmap.md+`, `+docs/PRIORITIZED_PROOF_ROADMAP.md+`, +`+docs/ProofRoadmap.md+`, `+docs/WORK_PLAN.md+`, plus stragglers) +consolidated into the single canonical `+roadmap.adoc+` at repo root. +* _Per-constructor verdict on `+_<ᵇ_+`._ +`+docs/echo-types/buchholz-rank-obstruction.adoc+` score bumped 10/13 → +11/13; `+<ᵇ-ψΩ≤+` flipped from "`encoding mismatch`" to "`closed (Lane 3 +follow-on, lex pair)`". Only `+<ᵇ-+1+` joint-bplus remains in the +per-constructor matrix. +* _N5Falsifier promoted into characteristic CI green closure._ +`+proofs/agda/characteristic/N5Falsifier.agda+` no longer carries the +"`broken`" banner; the unsolved metas were diagnosed as an inference +blocker (Agda cannot recover the role from +`+RoleGEcho r keep = Echo (obs r) true+` because `+obs+` is not +injective), resolved by making the `+applyRole+` / `+applyGrade+` Role + +Grade parameters explicit at the four call sites. +* 6a2 metadata files migrated from `+*.scm+` at repo root to +`+.machine_readable/6a2/*.a2ml+` per the canonical hyperpolymath rule +(`+.a2ml+` is the canonical extension; `+.scm+` is reserved for Guix). +2026-04-30. + +=== [0.1.0+integration-pending] + +==== Added + +* Core echo / fiber theorems (`+echo-intro+`, `+map-over+`, +`+map-over-id+`, `+map-over-comp+`, `+map-square+`). +* Characteristic non-injectivity / no-section family. +* Bridges: `+EchoLinear+`, `+EchoGraded+`, `+EchoTropical+`, +`+EchoChoreo+`, `+EchoEpistemic+`, `+EchoCNOBridge+`, +`+EchoJanusBridge+`, `+DyadicEchoBridge+`, `+EchoOrdinal+`, +`+EchoIndexed+`, `+EchoRelational+`, `+EchoCategorical+`, `+EchoScope+`. +* Ordinal / Buchholz track artefacts (`+Ordinal.Buchholz.*+`). diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 18090ed..0000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,375 +0,0 @@ - - -# Changelog - -All notable changes to echo-types will be documented in this file. - -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - -## [Unreleased] - -### Added (2026-06-13) - -- *`EchoDeniability.agda` — residue deniability as a first-class echo - property.* Formalises the deniability exploration (`Deniability.agda` / - `DeniabilityPartial.agda`) inside the echo-types framework. Two production - functions at opposite ends of the deniability spectrum: - - `produce-perfect` (constant, mirrors `collapse : Bool → ⊤`): perfectly - deniable for all openers; `no-section-produce-perfect` closes via - `no-section-of-collapsing-map`. - - `produce-partial` (injective): deniability fails for arbitrary openers - (`partial-not-deniable`); section exists (`partial-has-section` with - `partial-witness`). - The `IsConstantOpener` class is the exact cut-point at which deniability is - restored for the partial case; it is the type-level analogue of the `affine` - mode in `EchoObservationalEquivalence._≡m_`. Honest-bound matched-negative - block: `NotProved-{side-channel-safe, cryptographic-deniability, - adaptive-adversary}`. Zero postulates; `--safe --without-K`. - Wired into `All.agda`, pinned in `Smoke.agda`. -- *`wiki/Deniability.adoc`* — dedicated wiki page covering both production - functions, the no-section/section duality, the `IsConstantOpener` boundary, - the connection to `EchoObservationalEquivalence`, and the honest scope. - Linked from `wiki/Home.adoc` start-here table. - -### Added (2026-06-12) - -- *Cross-repo typesystem-integration sweep recorded in - `docs/bridges/cross-repo-bridge-status.md`.* echo-types is now - integrated into the hyperpolymath type systems (all merged to the - consumers' `main`), with four new ledger rows: - - **nextgen-typing** — `EchoTyping.agda` imports `EchoLinear`/`Echo`: - AffineScript `linear ⊑ affine` subtyping IS `weaken` (irreversible, - distinction-forgetting, proof-irrelevant at affine); refinement - erasure IS a fiber. Content bridge, `agda --safe` 3/3. - - **phronesis** — `PhronesisEcho.agda`: an ethical verdict's - provenance IS `Echo verdict v`. Content bridge. - - **nextgen-languages/kitchenspeak** — `EchoBridge.agda` status - upgraded hand-verified → machine-checked against the real `Echo`. - - **invariant-path** — Rust application example - (`classify_candidate` non-injective; retained candidate + `losses` - IS the echo). Citation-level. - No echo-types proof source changed; this is a documentation/ledger - sweep recording downstream adoption. - -### Added (2026-05-30) - -- *Lane 3 ordinal track — Slice 3+4 Route A 6-PR arc + doc sweep.* - Seven PRs (#165, #166, #167, #168, #169, #170, #171) build out - the rank-mono **union umbrella** over source-rule extensions: - - PR #165 — `RankLexJointBplus`'s `(b) lex-first` primitive + - `bpsi`-source-at-equal-head sub-case discharge. - - PR #166 — `(c)` trichotomy data type `BplusFirstTri` + the - consumer-side first-eq derivation via `cong₂ _⊕_` over the - definitional `rank-pow (bplus x y) = rank-pow x ⊕ rank-pow y`. - Key insight: same residual obligation gates BOTH the ψ-rank- - level closure AND the bplus-chain-level closure (halves the - apparent proof debt at this case). - - PR #167 — Path-3 prototype: `RankMonoSameLeft._<ᵇ⁺²_` adds - a literal-same-left source-rule extension that closes in one - line via `rank-pow-bplus-right-mono`. Source-rule enrichment - is structurally simpler than rank-function enrichment - (`rank-lex-jb`) for this sub-case. - - PR #168 — architectural umbrella `RankMonoUnion._<ᵇᵘ_` = - `_<ᵇ¹_ ⊎ _<ᵇ⁺²_` via `Sum` + `[_,_]` mediator. New - source-rule extensions ship as separate modules and union in - with two mechanical edits. WfCNF wrap propagates automatically. - - PR #169 — `RankMonoUnionWfCNF._<ᵇᵘⁿ_` mirrors Slice 4's - `_<ᵇ⁻ⁿ_` over the union umbrella, bundling the canonical-form - invariant alongside the rank-relation for downstream Buchholz - consumers. - - PR #170 — `RankMonoUnionWF.wf-<ᵇᵘ` derives `WellFounded _<ᵇᵘ_` - via `Subrelation.wellFounded` + `On.wellFounded` rank-embedding - transport from `wf-<′`. Closes Gate 2 of the arc (well-foundedness - of the union). - - PR #171 — doc sweep: `docs/echo-types/MAP.adoc` enumerates the - six new modules; `roadmap.adoc` gains a "Slice 3+4 Route A 6-PR - arc (2026-05-30)" subsection; `buchholz-rank-obstruction.adoc` - upgrades the `<ᵇ-+1` row from "Slice 3 headline remaining" to - "closed for strict-head + literal-same-left sub-cases". - - 163 modules at arc close, all `--safe --without-K`, zero new - postulates, no funext. Three documented gates: Gate 1 (tail-rank- - equality discharge for cross-head rank-equal case) **OPEN** — - structural blocker, both pre-identified unblock routes - CHECKED-REFUTED in PR #146; Gate 2 (WF) **CLOSED in #170**; - Gate 3 (Path-4+ further source-rule extensions) **OPEN** but - mechanical via the documented recipe. - -- *Trusted-Base Reduction Policy enforcement.* PR #172 adds - `docs/proof-debt.md` enumerating echo-types' sole soundness- - relevant escape hatch — the four propositional-truncation - postulates in `proofs/agda/EchoImageFactorizationPropPostulated. - agda` — under Disposition (c) NECESSARY AXIOM. Clears the - recurring `governance / Trusted-base reduction policy` red - check that had been failing on every echo-types PR since the - policy was adopted estate-wide (standards#211). No code change - beyond the new docs file. - -- *Cross-repo echo↔ephapax L3 bridge package.* Four PRs - (#161, #162, #163 + companion ephapax sync) establish the - named correspondence between echo-types L3 (`weaken : LEcho - linear → LEcho affine`, `no-section-collapse-to-residue`) and - ephapax-affine's L3 layer: - - PR #161 — `docs/bridges/EchoBridges.md` package layout - (§§1-4) + `EchoTypes.jl` v0.2.0 surfacing. - - PR #162 — `proofs/agda/EchoEphapaxBridge.agda` NARROW stub — - two definitional refl-renames + a docstring catalogue - (`ephapax-L3-weaken`, `ephapax-L3-no-section-collapse`). - Honest scope: L3 ONLY; ephapax-affine + L1/L2/L4 NOT mirrored. - Closes #126. - - PR #163 — adjacency cleanup: `EchoBridges.md` §5 + cross-repo - bridge-status row + roadmap Lane 4 list. - -- *arghda-core extraction.* PR #160 removes `arghda-core/` from - this repo's tree; it now lives as a standalone repo - (`hyperpolymath/arghda-core`) per the umbrella in #159. Reduces - echo-types' surface area to the propositional/proof-theoretic core. - -- *Roadmap close-out.* PR #157 closes Lane 5 (killer-app accepted) - and refreshes the stale Lane 1 close-out annotation. - -### Fixed (2026-05-30) - -- *Hypatia agda_postulate scope-narrowing.* PR #156: the - `EchoImageFactorizationPropPostulated.agda` exploratory module's - four postulates trigger Hypatia's `code_safety/agda_postulate` - rule. Inline `-- hypatia: allow code_safety/agda_postulate` at - the head of the file (with one-line justification pointing to - the kernel-note Tier-2 classification) scope-narrows the alert - to the single legitimate site, keeping the rule active for - unintended new postulates anywhere else. - -### Added (2026-05-28) - -- *Lane 3 ordinal track — Slice 3 prerequisites.* PR #137 added - `proofs/agda/Ordinal/Buchholz/RankPowSlice3.agda` (220 lines) — - three primitives toward the Slice 3 headline: - - `NonBzero` — left-spine non-bzero predicate excluding the - degenerate `bplus bzero bzero` chains that WfCNF technically - allows but CNF normalisation excludes. - - `ω-rank-pow-succ-≤-via-<Ω` — strict-jump bridge from `μ <Ω ν` - to `ω-rank-pow-succ μ ≤′ ω-rank-pow ν`. Closes the gap between - Slice 2-bplus's upper bound on the source's rank and the lower - bound on the target's rank. - - `head-Ω-lower-bound` — head-Ω LOWER bound under WfCNF + - NonBzero. Dual of `rank-pow-dominated-by-head-Ω`. - -- *Lane 3 ordinal track — Slice 3 headline closed under a strict-head - premise.* PR #141 added - `proofs/agda/Ordinal/Buchholz/RankPowSlice3Headline.agda` (155 - lines). The headline `rank-mono-<ᵇ-+1-via-head-Ω` closes the - joint-bplus rank-mono case for `_<ᵇ-+1_` via Route A from the - Slice 3 design note. The proof composes the four Slice 3 - prerequisites in a clean chain (no structural recursion): - Slice 2-bplus + head-Ω-bplus → strict-jump bridge → head-Ω lower - bound → `⊕-left-≤-sum`, all via `≤′-trans`. The headline takes - the strict-head premise `head-Ω x₁ <Ω head-Ω y₁` as an EXTERNAL - HYPOTHESIS; the umbrella's case-split is the remaining wiring - (the `bpsi=bpsi` at equal markers sub-case still needs `α`'s - rank via rank-adm or rank-lex). Compiles standalone under - `--safe --without-K`, zero postulates. Smoke green. - -- *Canonical identity layer — (epi, mono) earn-back form.* PR #138: - `proofs/agda/EchoImageFactorizationProp.agda` lands the - (epi, mono) factorisation module-parameterised in a truncation - interface — the long-pending earn-back gate previously referenced - as "next" in `docs/echo-types/MAP.adoc`. Companion to - `EchoImageFactorization`. Classification: Tier 2 in - `docs/echo-types/echo-kernel-note.adoc`. - -- *Classification grid — Search + Epistemic ResidueForm instances.* - PR #139: `EchoResidueTaxonomy.agda` gains two further `ResidueForm - f R` instances (`Search` and `Epistemic`) alongside the existing - six (trivial, identity, generic Σ-cert, linear-affine, indexed, - cost; the 2026-05-27 audit-follow-on lands of `indexed-residue` + - `cost-residue` are what made the pre-#139 count six). Brings the - total to **eight instances**, with the remaining two decoration - modules documented as structurally compatible. - -- *Lane 3 ordinal track — Slice 3 umbrella + lex-rank companion.* - PR #142 extends `_<ᵇ¹_` with the joint-bplus constructor + the - strict-head dispatch that wires the Slice 3 headline - (`rank-mono-<ᵇ-+1-via-head-Ω` from PR #141) into the umbrella - case-split. PR #143 adds the lex-rank companion: the - `bpsi-source-at-equality` ψ-rank discharge — the very sub-case - PR #144's CHANGELOG described as still requiring `α`'s rank via - rank-adm or rank-lex. The `<ᵇ-+1` joint-bplus rank-mono closure - is now substantively complete via the head-Ω+lex-rank composition. - -- *Visual identity — banner kit ("Diagrammatic Hush").* PR #140: - `docs/assets/banner.{png,svg}`, `docs/assets/banner-philosophy.md`, - `tools/banner/build-banner.mjs`. The `README.md` and `readme.adoc` - both gained the banner image at the top. No content impact; purely - visual identity for the project's public surface. - -### Fixed (2026-05-28) - -- *CI hygiene: kernel-guard classification-drift unblocked.* PR #136: - 18 previously-unclassified `Echo*.agda` modules (the canonical- - identity / OFS cohort plus the application/extension modules: - `EchoTotalCompletion`, `EchoOrthogonalFactorizationSystem`, - `EchoImageFactorization`, `EchoNoSectionGeneric`, - `EchoLossTaxonomy`, `EchoResidueTaxonomy`, - `EchoDecorationStructure`, `EchoObservationalEquivalence`, - `EchoOFSUnivF5`/`Diag`/`Iso`, `EchoCanonicalIdentitySuite`, - `EchoEntropy`, `EchoLLEncoding`, `EchoProvenance`, `EchoSecurity`, - `EchoProbabilisticSupport`, `EchoDifferential`) are now classified - in `docs/echo-types/echo-kernel-note.adoc`, unblocking - `scripts/kernel-guard.sh` Check B (classification-drift lint). - -- *CI hygiene: N5Falsifier xfail gate removed.* PR #136 also dropped - the `Expected-failure gate (N5Falsifier is known-broken)` step - from `.github/workflows/agda.yml`. `proofs/agda/characteristic/ - N5Falsifier.agda` was resolved on 2026-05-27 by pinning the - implicit `r` / `grade` at four `applyRole` / `applyGrade` call - sites — the unsolved-metas were an inference blocker, not a - content blocker. The module is now imported by - `proofs/agda/characteristic/All.agda` (line 33). The xfail gate's - own self-disclosed instructions (`"register it in - characteristic/All.agda and remove this xfail gate"`) fired on - the previous CI run; this PR completed those instructions. - -### Added (2026-05-27) - -- *Lane 3 ordinal track — 11/13 Buchholz constructors closed under - WfCNF restriction.* Three slices land on top of the existing - `RankPow` 9-constructor umbrella: - - `Ordinal.Buchholz.RankAdm` (admissibility-aware rank - `rank-adm (bpsi ν α) = ω-rank-pow ν ⊕ rank-pow α`) closing - `<ᵇ⁺-ψα` via `rank-mono-<ᵇ⁺-ψα-from-pow`. - - `Ordinal.Buchholz.RankLex` (lex-pair rank `RankLex` over - `Ord × Ord` with shared-implicit second-strict constructor) - closing `<ᵇ-ψΩ≤` at both `ν<μ` (first-strict) and the - `ν=μ` boundary (second-strict via the admissibility bound). - - `Ordinal.Buchholz.HeadOmega` (leading-Ω-index head function - `head-Ω : BT → OmegaIndex` plus definitional sanity lemmas and - a two-level compositional convenience) — first slice of option - (A) for the remaining `<ᵇ-+1` joint-bplus discharge; no - rank-mono yet. -- *Lane 3 head-Ω route — Slice 2 + Slice 2-omega + inversion + Slice 2-bplus - ALL LANDED 2026-05-27.* Follow-on to the Slice 1 head-Ω landing above - (PRs #130 + #131 + #133 + #134): - - `Ordinal.Buchholz.RankPow` gains `ω-rank-pow-succ : OmegaIndex → - Ord` with per-marker strict dominance at *both* branches - (`ω-rank-pow-<-succ-fin` via `ω^-strict-mono-suc`; - `ω-rank-pow-<-succ-omega` via the `Brouwer/OmegaPow.ω^-strict-mono-suc` - template mirrored at `ω-rank-pow ω`) plus the unified - `ω-rank-pow-<-succ : ∀ μ → ω-rank-pow μ <′ ω-rank-pow-succ μ`, - plus atomic-rank factoring through `head-Ω` - (`rank-pow-bOmega-via-head-Ω`, `rank-pow-bpsi-via-head-Ω`). - - Slice 2-omega closes a Brouwer-encoding hazard the original - CLAUDE.md proposal would have tripped: the proposed - `ω-rank-pow-succ ω = olim (λ n → ω^(suc(suc n)))` is - equi-ordinal with `ω-rank-pow ω = olim (λ n → ω^(suc n))` - (both denote `ω^ω`), so cannot strictly dominate. The - revised shape `olim (λ n → ω-rank-pow ω ·ℕ n)` denotes - `ω^(ω+1)` and goes strictly higher via `X≤′oz⊕X` + - `⊕-mono-<-right (ω-rank-pow-pos ω)`. Full record in - `Ordinal.Buchholz.RankPow`'s "History note" block. - - New module `Ordinal.Buchholz.HeadOmegaInversion` lands the - option-(b) inversion lemmas `head-Ω-inv-bOmega` (strict) and - `head-Ω-inv-bpsi` (non-strict). Both proved by structural - recursion on the `<ᵇ` derivation; no rank-mono dependency. - - New module `Ordinal.Buchholz.RankPowDomination` lands the - Slice 2-bplus headline `rank-pow-dominated-by-head-Ω` by - structural recursion on WfCNF, plus the supporting lemmas - (`<′→≤′`, `≤′-<′-trans`, `<′-trans`, `ω-rank-pow-mono-≤Ω`, - `ω-rank-pow-succ-pos`, `additive-principal-ω-rank-pow-succ`, - `rank-y-bound`). PR #134 was the one-line explicit-implicit - fix for the initial `ω≤ω` case of `ω-rank-pow-mono-≤Ω`. -- *Decoration bridge — R5 exploratory entry scaffolded (PR #129).* - `docs/echo-types/explorations/decoration-bridge/` lands a bounded - exploration of whether the Choreo × Graded integration shape - resembles adjacent-domain decoration constructions (CRDTs, gossip, - local-first causal histories). Scope strictly the one axis pair - `EchoIntegration.agda` already integrates; external candidates - framed as analogies-with-falsifiers, never as evidence of recipe - generalisation. Sits as `roadmap.adoc` § R5 (deferred research) - with explicit termination criteria (Track A/B/C failure, all - candidates retired, redundancy with retracted framing, - forbidden-rebrandings register addition, retraction-watch trip). - Companion Agda module `proofs/agda/EchoDecorationBridge.agda` — - deliberately not in `All.agda`, classified as "Exploratory (not in - All.agda)" in `docs/echo-types/echo-kernel-note.adoc` so CI's - classification-drift lint stays green. -- *Tier-1+2+3 spine + audience moves + suite + F5 FULL PASS - LANDED 2026-05-27.* My session's contribution sitting on top of - the parallel-session ordinal work above. See CLAUDE.md's - "Slice-2 upstream adoption" + "broad-cleanup close" session arcs - for the deliverable list; key headlines: `EchoTotalCompletion.A↔ΣEcho`, - `EchoOrthogonalFactorizationSystem.ofs-witness`, - `EchoNoSectionGeneric.no-section-of-collapsing-map`, the four - Tier-2 classification-grid records (`ResidueForm` / - `DecorationStructure` / function-side / observational), the - Pillar F Gate F5 FULL PASS triple (F5-1 / F5-2 / F5-3) earning - back the qualified OFS, four audience-facing modules - (`EchoProvenance` / `EchoSecurity` / `EchoProbabilisticSupport` - / `EchoDifferential`), and the curated single-file entry - `EchoCanonicalIdentitySuite`. Two consolidation narratives - `docs/echo-types/{universal-property,fibration-package}.adoc`. - Retraction follow-up F-2026-05-27a logged in `docs/retractions.adoc`. -- *Lane 5 tutorial track — the originally-scaffolded triplet is - complete.* `tutorial/` ships three worked walkthroughs with - honest-bound disclosure at top + matched-negative `NotProved-*` - `⊤`-aliases at bottom: - - `tutorial/region_exit_audit/` (Walkthrough 1, killer-app - candidate per `roadmap.adoc` §Lane 5) — ephapax-L3-style - region exit modelled type-level via - `EchoLinear.no-section-weaken`. - - `tutorial/epistemic_erasure/` (Walkthrough 2) — 4-seed → - 2-key KDF with no-section-via-residue lifted from - `EchoResidue.no-section-collapse-to-residue`. - - `tutorial/provenance_debugging/` (Walkthrough 3) — 4-element - `State` with two orthogonal sign bits walked through 3 residue - layers; new pedagogical shape ships *both* a section (Layer 1 - `recover-section-at-layer-1`) and its absence (Layer 2 - `no-recovery-from-trivial`), exhibiting the boundary at which - the type-level recovery property flips. -- *Establishment-track Pillar E — packaging pre-staged.* - `CITATION.cff` and `.zenodo.json` at the repo root (placeholder - DOI + ORCID-commented until author setup), `echo-types.agda-lib` - with dual `include: proofs/agda .` covering the tutorial track, - and README §Citation + §"Installing as a library" sections. CI - install-self + GitHub→Zenodo workflows intentionally deferred - until the author authorises the Zenodo integration (avoids - transient CI red). -- *Establishment-track Pillar E — venue + outreach.* - `docs/echo-types/pillar-e-offline.adoc` lands the venue matrix - (TYPES → CPP → ITP → MSCS), Zenodo DOI mint plan, library - packaging plan, and three pre-written outreach cover letters - (Granule/QTT, choreographic types, Linear Haskell). Author-driven - for submission, sending, and Zenodo flip. -- *Gate 2 audit — Revision 5 + 5b.* `docs/characteristic.adoc` - carries the close-out re-audit (4/4 surviving theorems, N5 - resolved within Rev 5 follow-up). -- Initial RSR template floor (CHANGELOG/SECURITY/CONTRIBUTING/QUICKSTART set + contractiles + 4 mandatory workflows + dotfiles + 0-AI-MANIFEST). Scaffolded 2026-04-30. - -### Changed (2026-05-27) - -- *Roadmap consolidation.* Five overlapping roadmap docs - (`docs/echo-types/roadmap.md`, `docs/PRIORITIZED_PROOF_ROADMAP.md`, - `docs/ProofRoadmap.md`, `docs/WORK_PLAN.md`, plus stragglers) - consolidated into the single canonical `roadmap.adoc` at repo - root. -- *Per-constructor verdict on `_<ᵇ_`.* - `docs/echo-types/buchholz-rank-obstruction.adoc` score bumped - 10/13 → 11/13; `<ᵇ-ψΩ≤` flipped from "encoding mismatch" to - "closed (Lane 3 follow-on, lex pair)". Only `<ᵇ-+1` joint-bplus - remains in the per-constructor matrix. -- *N5Falsifier promoted into characteristic CI green closure.* - `proofs/agda/characteristic/N5Falsifier.agda` no longer carries - the "broken" banner; the unsolved metas were diagnosed as an - inference blocker (Agda cannot recover the role from - `RoleGEcho r keep = Echo (obs r) true` because `obs` is not - injective), resolved by making the `applyRole` / `applyGrade` - Role + Grade parameters explicit at the four call sites. -- 6a2 metadata files migrated from `*.scm` at repo root to `.machine_readable/6a2/*.a2ml` per the canonical hyperpolymath rule (`.a2ml` is the canonical extension; `.scm` is reserved for Guix). 2026-04-30. - -## [0.1.0+integration-pending] - -### Added - -- Core echo / fiber theorems (`echo-intro`, `map-over`, `map-over-id`, `map-over-comp`, `map-square`). -- Characteristic non-injectivity / no-section family. -- Bridges: `EchoLinear`, `EchoGraded`, `EchoTropical`, `EchoChoreo`, `EchoEpistemic`, `EchoCNOBridge`, `EchoJanusBridge`, `DyadicEchoBridge`, `EchoOrdinal`, `EchoIndexed`, `EchoRelational`, `EchoCategorical`, `EchoScope`. -- Ordinal / Buchholz track artefacts (`Ordinal.Buchholz.*`). diff --git a/CODE_OF_CONDUCT.adoc b/CODE_OF_CONDUCT.adoc new file mode 100644 index 0000000..75c1d87 --- /dev/null +++ b/CODE_OF_CONDUCT.adoc @@ -0,0 +1,49 @@ +== Code of Conduct + +This project adopts the +https://www.contributor-covenant.org/version/2/1/code_of_conduct/[Contributor +Covenant 2.1]. The key obligations are summarised inline so they are +enforceable directly from this repository. + +=== Our Pledge + +We pledge to make participation in echo-types a *harassment*-free +experience for everyone, regardless of age, body size, visible or +invisible disability, ethnicity, sex characteristics, gender identity +and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity and +orientation. + +=== Unacceptable Behaviour + +Unacceptable behaviour includes: *harassment* in any form, public or +private; trolling, insulting, or derogatory comments; personal or +political attacks; publishing others’ private information without +explicit permission; and other conduct which could reasonably be +considered inappropriate in a professional setting. + +=== Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behaviour may +be reported confidentially to the maintainer at +`+j.d.a.jewell@open.ac.uk+`. All complaints will be reviewed and +investigated promptly and fairly. Reports are confidential by default. + +==== Enforcement procedures + +Maintainers follow these Community Impact Guidelines in determining the +consequences for any action they deem in violation of this Code of +Conduct: + +[arabic] +. *Correction* — a private, written warning for unprofessional conduct. +. *Warning* — a warning with consequences for continued behaviour; no +interaction with the people involved for a specified period. +. *Temporary ban* — a temporary ban from any interaction or public +communication with the community. +. *Permanent ban* — a permanent ban from any public interaction within +the community. + +Maintainers who do not follow or enforce this Code of Conduct in good +faith may face temporary or permanent repercussions as determined by the +project’s leadership. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md deleted file mode 100644 index 30b5d29..0000000 --- a/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,28 +0,0 @@ - - -# Code of Conduct - -This project adopts the [Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/). The key obligations are summarised inline so they are enforceable directly from this repository. - -## Our Pledge - -We pledge to make participation in echo-types a **harassment**-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. - -## Unacceptable Behaviour - -Unacceptable behaviour includes: **harassment** in any form, public or private; trolling, insulting, or derogatory comments; personal or political attacks; publishing others' private information without explicit permission; and other conduct which could reasonably be considered inappropriate in a professional setting. - -## Enforcement - -Instances of abusive, harassing, or otherwise unacceptable behaviour may be reported confidentially to the maintainer at `j.d.a.jewell@open.ac.uk`. All complaints will be reviewed and investigated promptly and fairly. Reports are confidential by default. - -### Enforcement procedures - -Maintainers follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: - -1. **Correction** — a private, written warning for unprofessional conduct. -2. **Warning** — a warning with consequences for continued behaviour; no interaction with the people involved for a specified period. -3. **Temporary ban** — a temporary ban from any interaction or public communication with the community. -4. **Permanent ban** — a permanent ban from any public interaction within the community. - -Maintainers who do not follow or enforce this Code of Conduct in good faith may face temporary or permanent repercussions as determined by the project's leadership. diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc new file mode 100644 index 0000000..64426cf --- /dev/null +++ b/CONTRIBUTING.adoc @@ -0,0 +1,84 @@ +== Contributing to echo-types + +Thank you for your interest. Echo-types is a constructive Agda +formalisation; contribution discipline reflects the proof-bearing nature +of the codebase. + +=== Sign-off + +All commits require Developer Certificate of Origin sign-off: + +.... +git commit -s -m "feat: ..." +.... + +=== Branches + +* `+main+` — protected; only fast-forward from approved PRs. +* `+feat/+` — feature branches, squash-merge. +* `+fix/+` — bug-fix branches. + +=== Pre-merge checklist + +[arabic] +. `+just verify+` passes (full Agda type-check pass against +`+proofs/agda/All.agda+` and the test suites). +. CHANGELOG.md updated under `+[Unreleased]+`. +. `+.machine_readable/6a2/STATE.a2ml+` `+last-updated+` bumped if the +change is significant. +. *Banned constructs.* No new `+believe_me+`, `+assert_total+`, +`+postulate+`, `+sorry+`, `+Admitted+`, `+unsafeCoerce+`, or +`+Obj.magic+` introduced. Estate-wide policy. +. *Guardrails are CI-enforced.* All `+.agda+` files under +`+proofs/agda/**+` must declare `+{-# OPTIONS --safe --without-K #-}+` +at the top. `+tools/check-guardrails.sh+` runs at CI time across every +file (regardless of `+All.agda+` membership) and fails on: missing +`+--safe+` / `+--without-K+`, escape pragmas (`+TERMINATING+`, +`+REWRITE+`, `+NO_POSITIVITY_CHECK+`, etc.), `+postulate+` in code, or +unsafe primitives (`+primTrustMe+`, `+primEraseEquality+`, `+trustMe+`). +The `+Exploratory+` classification in +`+docs/echo-types/echo-kernel-note.adoc+` only excuses `+All.agda+` +membership — it does NOT excuse the guardrail. If you need postulates +for a demo or earn-back-gate consumer, the file must live outside +`+proofs/agda/+` (no current non-guarded path exists; widening the +guardrail’s allowlist requires a separate design discussion). +. *EI-2 discipline.* Per `+.machine_readable/6a2/STATE.a2ml § ei-2+`, +the integration-recipe distinctness investigation is _terminated +negatively_ and is not to be reopened. If a change touches that +territory, read `+STATE.a2ml § ei-2+` first; the +`+forbidden-rebrandings+` list is a hard fence. +. *Naming traps.* `+ModeGraded+` (with trailing `+d+`) is canonical; +never `+ModeGrade+`. See `+STATE.a2ml § naming-traps+`. + +=== Reviews + +At least one maintainer review (see MAINTAINERS.adoc). Bridge-module +changes (the cross-system bridges in `+proofs/agda/Echo*Bridge*.agda+`) +need attention because they fix the load-bearing distinctness story; +flag them for explicit review. + +=== Contribution model — Tri-Perimeter Contribution Framework (TPCF) + +echo-types follows the estate-wide *Tri-Perimeter Contribution Framework +(TPCF)* — graduated trust without gatekeeping: + +* *Perimeter 1 — Core Systems (maintainers only).* The proof kernel: +`+proofs/agda/Echo.agda+`, the identity-claim spine, the bridge modules, +the `+All.agda+` / `+Smoke.agda+` wiring, and the guardrail tooling. +Direct commits by maintainers only. +* *Perimeter 2 — Expert Extensions (trusted contributors).* New proof +modules, decoration instances, and ordinal-track slices. Apply via issue +→ review → merge under the relevant `+proofs/agda/+` path with the build +invariant green. +* *Perimeter 3 — Community Sandbox (open to all).* Docs (`+.adoc+`), +tutorial walkthroughs, wiki pages, `+.well-known/+` content, and spec +proposals. + +==== Fork workflow + +External contributors use the standard *fork*-and-pull-request workflow: +fork the repository, branch from `+main+`, run `+just validate+` locally +(full Agda verify + kernel-guard), and open a PR. Maintainers (Perimeter +1) may commit directly to feature branches. Every PR must keep +`+All.agda+` + `+Smoke.agda+` green under `+--safe --without-K+` and +introduce no banned constructs (see the pre-merge checklist above). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index 600f447..0000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,45 +0,0 @@ - - -# Contributing to echo-types - -Thank you for your interest. Echo-types is a constructive Agda formalisation; contribution discipline reflects the proof-bearing nature of the codebase. - -## Sign-off - -All commits require Developer Certificate of Origin sign-off: - -``` -git commit -s -m "feat: ..." -``` - -## Branches - -* `main` — protected; only fast-forward from approved PRs. -* `feat/` — feature branches, squash-merge. -* `fix/` — bug-fix branches. - -## Pre-merge checklist - -1. `just verify` passes (full Agda type-check pass against `proofs/agda/All.agda` and the test suites). -2. CHANGELOG.md updated under `[Unreleased]`. -3. `.machine_readable/6a2/STATE.a2ml` `last-updated` bumped if the change is significant. -4. **Banned constructs.** No new `believe_me`, `assert_total`, `postulate`, `sorry`, `Admitted`, `unsafeCoerce`, or `Obj.magic` introduced. Estate-wide policy. -5. **Guardrails are CI-enforced.** All `.agda` files under `proofs/agda/**` must declare `{-# OPTIONS --safe --without-K #-}` at the top. `tools/check-guardrails.sh` runs at CI time across every file (regardless of `All.agda` membership) and fails on: missing `--safe` / `--without-K`, escape pragmas (`TERMINATING`, `REWRITE`, `NO_POSITIVITY_CHECK`, etc.), `postulate` in code, or unsafe primitives (`primTrustMe`, `primEraseEquality`, `trustMe`). The `Exploratory` classification in `docs/echo-types/echo-kernel-note.adoc` only excuses `All.agda` membership — it does NOT excuse the guardrail. If you need postulates for a demo or earn-back-gate consumer, the file must live outside `proofs/agda/` (no current non-guarded path exists; widening the guardrail's allowlist requires a separate design discussion). -6. **EI-2 discipline.** Per `.machine_readable/6a2/STATE.a2ml § ei-2`, the integration-recipe distinctness investigation is *terminated negatively* and is not to be reopened. If a change touches that territory, read `STATE.a2ml § ei-2` first; the `forbidden-rebrandings` list is a hard fence. -7. **Naming traps.** `ModeGraded` (with trailing `d`) is canonical; never `ModeGrade`. See `STATE.a2ml § naming-traps`. - -## Reviews - -At least one maintainer review (see MAINTAINERS.adoc). Bridge-module changes (the cross-system bridges in `proofs/agda/Echo*Bridge*.agda`) need attention because they fix the load-bearing distinctness story; flag them for explicit review. - -## Contribution model — Tri-Perimeter Contribution Framework (TPCF) - -echo-types follows the estate-wide **Tri-Perimeter Contribution Framework (TPCF)** — graduated trust without gatekeeping: - -* **Perimeter 1 — Core Systems (maintainers only).** The proof kernel: `proofs/agda/Echo.agda`, the identity-claim spine, the bridge modules, the `All.agda` / `Smoke.agda` wiring, and the guardrail tooling. Direct commits by maintainers only. -* **Perimeter 2 — Expert Extensions (trusted contributors).** New proof modules, decoration instances, and ordinal-track slices. Apply via issue → review → merge under the relevant `proofs/agda/` path with the build invariant green. -* **Perimeter 3 — Community Sandbox (open to all).** Docs (`.adoc`), tutorial walkthroughs, wiki pages, `.well-known/` content, and spec proposals. - -### Fork workflow - -External contributors use the standard **fork**-and-pull-request workflow: fork the repository, branch from `main`, run `just validate` locally (full Agda verify + kernel-guard), and open a PR. Maintainers (Perimeter 1) may commit directly to feature branches. Every PR must keep `All.agda` + `Smoke.agda` green under `--safe --without-K` and introduce no banned constructs (see the pre-merge checklist above). diff --git a/DOCUMENTATION_STATUS.adoc b/DOCUMENTATION_STATUS.adoc new file mode 100644 index 0000000..c964373 --- /dev/null +++ b/DOCUMENTATION_STATUS.adoc @@ -0,0 +1,165 @@ +== Documentation and Proof Status Summary + +=== Current State (April 2025) + +==== ✅ Completed Documentation + +[arabic] +. *Core Bridge Documentation* +* `+docs/EchoJanusBridge.md+` - Comprehensive explanation of echo types +→ JanusKey bridge +* `+roadmap.adoc+` §"`Deferred research track`" - Strategic proof +development roadmap (consolidated from former `+docs/ProofRoadmap.md+`) +* `+docs/COMPREHENSIVE_DOCUMENTATION.md+` - Complete 3-2-1 structured +documentation +. *Formal Proofs* +* `+proofs/agda/EchoJanusBridge.agda+` - Core bridging theorems +* `+proofs/agda/EchoCNOBridge.agda+` - CNO integration (existing) +* `+proofs/agda/EchoIntegration.agda+` - Integration proofs (existing) +. *Code Integration* +* Updated `+proofs/agda/All.agda+` to include new bridge modules +* Agda proofs compiled and verified + +==== 📝 Documentation Structure (3-2-1 Order) + +===== Section 3: Advanced Theoretical Foundations ✅ + +* Echo type theory overview +* Categorical semantics +* Temporal logic extensions +* Graded modal types for permissions +* Homotopy type theory connections + +===== Section 2: Practical Implementation Guide ✅ + +* JanusKey architecture overview +* Echo types in Rust implementation +* Integration patterns +* Performance considerations +* Debugging and troubleshooting + +===== Section 1: Core Proofs and Verification ✅ + +* Formal verification of JanusKey +* Distributed reversibility proofs +* Resource-bounded reversibility +* Transaction isolation proofs +* CRDT integration proofs + +==== 🔄 Integration Points + +[arabic] +. *Echo Types Repository* +* All Agda proofs in `+proofs/agda/+` +* Comprehensive documentation in `+docs/+` +* Updated `+All.agda+` module +. *JanusKey Repository* +* Existing formal proofs directory: `+docs/wiki/formal-proofs/+` +* Theory documentation: `+docs/wiki/theory/formal-model.adoc+` +* Ready for echo type integration +. *MAA Framework* +* Potential integration with absolute-zero proofs +* Connection to CNO formalization +* Unified reversibility theory + +==== 🎯 Next Steps for Completion + +===== Documentation Tasks: + +[arabic] +. *Final Review*: Ensure all cross-references are correct +. *Diagram Generation*: Add architecture diagrams for visual clarity +. *Example Code*: Add more concrete Rust/Agda examples +. *Glossary*: Create terminology reference +. *FAQ*: Add frequently asked questions section + +===== Proof Development Tasks: + +[arabic] +. *Rust Verification*: Implement formal verification of JanusKey Rust +code +. *Distributed Proofs*: Complete distributed reversibility theorems +. *Resource Bounds*: Finalize bounded reversibility proofs +. *Integration Tests*: Create test suite linking Agda specs to Rust + +===== Repository Tasks: + +[arabic] +. *Version Tagging*: Tag current state as v1.0-echo-bridge +. *Release Notes*: Document bridge capabilities +. *CI Integration*: Add Agda proof checking to CI pipeline +. *Dependency Management*: Ensure all Agda libraries are pinned + +==== 📋 Commit Checklist + +* [x] Create `+EchoJanusBridge.agda+` with core theorems +* [x] Update `+All.agda+` to include new module +* [x] Write `+EchoJanusBridge.md+` documentation +* [x] Consolidate `+ProofRoadmap.md+` into `+roadmap.adoc+` (single +canonical roadmap) +* [x] Develop `+COMPREHENSIVE_DOCUMENTATION.md+` (3-2-1 structure) +* [x] Verify Agda proofs compile successfully +* [ ] Add architecture diagrams +* [ ] Create integration tests +* [ ] Set up CI for proof verification +* [ ] Final cross-reference check + +==== 🚀 Strategic Recommendations + +[arabic] +. *Prioritize Tier 1 Proofs*: Focus on Rust verification, distributed +proofs, resource bounds +. *Enhance Integration*: Strengthen links between echo types and +JanusKey codebase +. *Community Engagement*: Publish bridge as academic paper + open source +release +. *Tooling Investment*: Develop better Agda-Rust integration tools +. *Performance Benchmarking*: Establish baseline metrics for echo +overhead + +==== 📊 Quality Metrics + +*Documentation Coverage*: 95% complete *Proof Completeness*: 70% +complete (core bridge done, advanced proofs pending) *Integration +Readiness*: 85% (ready for JanusKey integration) *Test Coverage*: 40% +(basic tests exist, comprehensive suite needed) + +==== 🎓 Academic Publication Potential + +The current work supports several publication venues: 1. *PLDI/POPL*: +Formal verification of JanusKey using echo types 2. *ICFP*: Advanced +echo type theory developments 3. *SOSP/OSDI*: Practical reversible file +system implementation 4. *LICS*: Theoretical foundations of echo types +5. *CAV*: Automated verification approaches + +==== 🔗 Cross-Repository Integration Plan + +[arabic] +. *JanusKey Integration*: +* Add echo type references to `+docs/wiki/formal-proofs/+` +* Update theory documentation with bridge explanations +* Create implementation guide for developers +. *MAA Framework Connection*: +* Link to absolute-zero CNO proofs +* Develop unified reversibility theory +* Create ecosystem documentation +. *Ecosystem Documentation*: +* Unified theory guide across repositories +* Developer onboarding materials +* Proof development tutorials + +=== Conclusion + +The echo types → JanusKey bridge is *substantially complete* at the +theoretical and documentation level. The core proofs exist, +comprehensive documentation is written, and integration points are +identified. The remaining work focuses on: + +[arabic] +. *Implementation verification* (proving Rust code matches specs) +. *Advanced proof development* (distributed, bounded, transactional) +. *Ecosystem integration* (JanusKey, MAA Framework, Absolute Zero) +. *Tooling and testing* (CI, verification infrastructure) + +The current state provides a solid foundation for both academic +publication and practical deployment. diff --git a/DOCUMENTATION_STATUS.md b/DOCUMENTATION_STATUS.md deleted file mode 100644 index ca97f03..0000000 --- a/DOCUMENTATION_STATUS.md +++ /dev/null @@ -1,147 +0,0 @@ - - -# Documentation and Proof Status Summary - -## Current State (April 2025) - -### ✅ Completed Documentation - -1. **Core Bridge Documentation** - - `docs/EchoJanusBridge.md` - Comprehensive explanation of echo types → JanusKey bridge - - `roadmap.adoc` §"Deferred research track" - Strategic proof development roadmap (consolidated from former `docs/ProofRoadmap.md`) - - `docs/COMPREHENSIVE_DOCUMENTATION.md` - Complete 3-2-1 structured documentation - -2. **Formal Proofs** - - `proofs/agda/EchoJanusBridge.agda` - Core bridging theorems - - `proofs/agda/EchoCNOBridge.agda` - CNO integration (existing) - - `proofs/agda/EchoIntegration.agda` - Integration proofs (existing) - -3. **Code Integration** - - Updated `proofs/agda/All.agda` to include new bridge modules - - Agda proofs compiled and verified - -### 📝 Documentation Structure (3-2-1 Order) - -#### Section 3: Advanced Theoretical Foundations ✅ -- Echo type theory overview -- Categorical semantics -- Temporal logic extensions -- Graded modal types for permissions -- Homotopy type theory connections - -#### Section 2: Practical Implementation Guide ✅ -- JanusKey architecture overview -- Echo types in Rust implementation -- Integration patterns -- Performance considerations -- Debugging and troubleshooting - -#### Section 1: Core Proofs and Verification ✅ -- Formal verification of JanusKey -- Distributed reversibility proofs -- Resource-bounded reversibility -- Transaction isolation proofs -- CRDT integration proofs - -### 🔄 Integration Points - -1. **Echo Types Repository** - - All Agda proofs in `proofs/agda/` - - Comprehensive documentation in `docs/` - - Updated `All.agda` module - -2. **JanusKey Repository** - - Existing formal proofs directory: `docs/wiki/formal-proofs/` - - Theory documentation: `docs/wiki/theory/formal-model.adoc` - - Ready for echo type integration - -3. **MAA Framework** - - Potential integration with absolute-zero proofs - - Connection to CNO formalization - - Unified reversibility theory - -### 🎯 Next Steps for Completion - -#### Documentation Tasks: -1. **Final Review**: Ensure all cross-references are correct -2. **Diagram Generation**: Add architecture diagrams for visual clarity -3. **Example Code**: Add more concrete Rust/Agda examples -4. **Glossary**: Create terminology reference -5. **FAQ**: Add frequently asked questions section - -#### Proof Development Tasks: -1. **Rust Verification**: Implement formal verification of JanusKey Rust code -2. **Distributed Proofs**: Complete distributed reversibility theorems -3. **Resource Bounds**: Finalize bounded reversibility proofs -4. **Integration Tests**: Create test suite linking Agda specs to Rust - -#### Repository Tasks: -1. **Version Tagging**: Tag current state as v1.0-echo-bridge -2. **Release Notes**: Document bridge capabilities -3. **CI Integration**: Add Agda proof checking to CI pipeline -4. **Dependency Management**: Ensure all Agda libraries are pinned - -### 📋 Commit Checklist - -- [x] Create `EchoJanusBridge.agda` with core theorems -- [x] Update `All.agda` to include new module -- [x] Write `EchoJanusBridge.md` documentation -- [x] Consolidate `ProofRoadmap.md` into `roadmap.adoc` (single canonical roadmap) -- [x] Develop `COMPREHENSIVE_DOCUMENTATION.md` (3-2-1 structure) -- [x] Verify Agda proofs compile successfully -- [ ] Add architecture diagrams -- [ ] Create integration tests -- [ ] Set up CI for proof verification -- [ ] Final cross-reference check - -### 🚀 Strategic Recommendations - -1. **Prioritize Tier 1 Proofs**: Focus on Rust verification, distributed proofs, resource bounds -2. **Enhance Integration**: Strengthen links between echo types and JanusKey codebase -3. **Community Engagement**: Publish bridge as academic paper + open source release -4. **Tooling Investment**: Develop better Agda-Rust integration tools -5. **Performance Benchmarking**: Establish baseline metrics for echo overhead - -### 📊 Quality Metrics - -**Documentation Coverage**: 95% complete -**Proof Completeness**: 70% complete (core bridge done, advanced proofs pending) -**Integration Readiness**: 85% (ready for JanusKey integration) -**Test Coverage**: 40% (basic tests exist, comprehensive suite needed) - -### 🎓 Academic Publication Potential - -The current work supports several publication venues: -1. **PLDI/POPL**: Formal verification of JanusKey using echo types -2. **ICFP**: Advanced echo type theory developments -3. **SOSP/OSDI**: Practical reversible file system implementation -4. **LICS**: Theoretical foundations of echo types -5. **CAV**: Automated verification approaches - -### 🔗 Cross-Repository Integration Plan - -1. **JanusKey Integration**: - - Add echo type references to `docs/wiki/formal-proofs/` - - Update theory documentation with bridge explanations - - Create implementation guide for developers - -2. **MAA Framework Connection**: - - Link to absolute-zero CNO proofs - - Develop unified reversibility theory - - Create ecosystem documentation - -3. **Ecosystem Documentation**: - - Unified theory guide across repositories - - Developer onboarding materials - - Proof development tutorials - -## Conclusion - -The echo types → JanusKey bridge is **substantially complete** at the theoretical and documentation level. The core proofs exist, comprehensive documentation is written, and integration points are identified. The remaining work focuses on: - -1. **Implementation verification** (proving Rust code matches specs) -2. **Advanced proof development** (distributed, bounded, transactional) -3. **Ecosystem integration** (JanusKey, MAA Framework, Absolute Zero) -4. **Tooling and testing** (CI, verification infrastructure) - -The current state provides a solid foundation for both academic publication and practical deployment. \ No newline at end of file diff --git a/FOUNDATIONS_BRIDGE.adoc b/FOUNDATIONS_BRIDGE.adoc new file mode 100644 index 0000000..2cf86ef --- /dev/null +++ b/FOUNDATIONS_BRIDGE.adoc @@ -0,0 +1,203 @@ +== Foundations bridge — consuming `+echo-types+` and `+tropical-resource-typing+` + +This is a downstream integration brief for `+my-lang+` or any other +consumer of the two foundations. It coordinates their outputs; it *adds +no new proofs*. Every theorem named below is already mechanised upstream +— this document only tells a downstream language _how to depend on the +two foundations without collapsing them into each other_. + +Source of truth: + +[width="100%",cols="25%,25%,25%,25%",options="header",] +|=== +|Foundation |Axis exported |Contract |Machine-checked in +|`+tropical-resource-typing+` |resource-grade axis +|`+FOUNDATION_CONTRACT.md+` |Lean 4 `+Resource.*+` + +|`+echo-types+` |residual-modality axis |`+FOUNDATION_CONTRACT.md+` +|Agda `+Echo.*+` (`+--safe --without-K+`) +|=== + +''''' + +=== 1. Two independent axes + +A consumer tracks *two orthogonal things*. They are not refinements of +one another and they meet only at the one-directional seam in §2. + +____ +The numbering (`+1+`, `+3+`) follows the upstream axis taxonomy. Only +these two axes are in scope for this brief; they are mutually +independent at the core. +____ + +==== Axis 1 — Resource algebra (`+tropical-resource-typing+`) + +* *What it is:* binder/resource _quantities_ — usage, cost, latency, +critical path, bottleneck — living in an ordered-semiring / +usage-algebra interface. +* *Interface:* `+Resource.ResourceAlgebra+` (= +`+Resource.ResourceSemiring+` + an order). `+⊞+` = choice/alternative, +`+⊠+` = sequential composition. +* *Instances:* +`+Resource.Instances.{Linear, Affine, MaxPlus, MinPlus, MinMax}+` — +i.e. linear / affine usage and the tropical (max-plus / min-plus / +min-max) algebras. The tropical instances double as an *infinite-carrier +stress test* (`+Resource.Stress+`, `+Resource.Infinite+`). +* *Used by:* QTT-style / quantitative *resource soundness*. Prove +soundness _parametrically_ over the interface via +`+Resource.ConsumerLawBundle+` (`+parametric_resource_transport+`, alias +`+resource_laws_sufficient_for_consumers+`), then instantiate at any +algebra above with no algebraic re-proof. + +==== Axis 3 — Echo modality (`+echo-types+`) + +* *What it is:* structured *residue / loss / forgetting / projection* — +the remainder of an information-losing map, +`+Echo f y := Σ (x : A), (f x ≡ y)+`. +* *Indexed by a thin poset:* `+Echo.Index.ThinPoset+`; the canonical +index is the three-point loss order `+keep ≤ residue ≤ forget+` +(`+grade-thinPoset+`). Thinness (order proofs are propositional) is +load-bearing, not cosmetic. +* *Proves residual metatheory:* `+Echo.Modality.Core+` / +`+Echo.Modality.Interface+` give `+degrade+`, the unit law +`+degrade-id+`, the path-independence law `+degrade-compose+`, and the +no-section theorem `+no-section-of-collapsing-map+`; the +downstream-instantiable record is `+EchoModality+` (canonical witness +`+grade-echoModality+`). +* *Independent of the resource algebra at the core:* +`+Echo.Modality.Core+`, `+Echo.Modality.Interface+`, and +`+Echo.Index.ThinPoset+` import *no* semiring / resource-algebra +machinery. The proof-relevant content of `+degrade+` is carried by the +thin order of the index, not by any semiring-valued grade. + +''''' + +=== 2. The seam + +The only sanctioned connection between the axes is a *measure*, pointing +in exactly one direction: + +.... +ResidueMeasure : Echo residue ──▶ ResourceAlgebra carrier +.... + +* *Direction:* a resource algebra is _consumed as a measure by_ Echo. +The residue carrier is opaque; only the codomain is a resource algebra. +* *Never the reverse:* Echo is *not* produced as a resource instance, +nor as a `+Soundness(R)+` instance. + +The seam is mechanised on both sides — pick whichever framing matches +your downstream proof obligation; both fix the same `+E → R+` direction: + +*echo-types side (order-monotone view)* — `+Echo.Measure.Interface+`: + +[source,agda] +---- +record ResidueMeasure (E : EchoModality P ℓc) (R : OrderedCarrier ℓm ℓo) where + field + measure : ∀ {i} → ⟦ i ⟧ → Carrier R + monotone : ∀ {i j} (p : i ≤ j) (x : ⟦ i ⟧) → + measure x ≤R measure (degrade p x) +---- + +*tropical side (monoid-homomorphism view)* — `+Resource.EchoBridge+`: + +[source,lean] +---- +structure ResidueMeasure (E : Type) (R : Type) [ResourceAlgebra R] where + combine : E → E → E -- Echo-side residue accumulation (opaque) + empty : E + measure : E → R -- the measurement into a resource grade + measure_empty : measure empty = one + measure_combine : ∀ e₁ e₂, measure (combine e₁ e₂) = measure e₁ ⊠ measure e₂ +---- + +In both, the residue carrier `+E+` carries *no* `+ResourceAlgebra+` +instance and nothing gives it one. `+echo-types+` and +`+tropical-resource-typing+` have *no dependency on each other*; the +seam is supplied downstream. + +''''' + +=== 3. Downstream import pattern + +A consuming language (e.g. `+my-lang+`) should expose: + +.... +Resource parameter R : ResourceAlgebra -- Axis 1 +Echo parameter E : EchoModality -- Axis 3 +Optional seam M : ResidueMeasure E R -- §2, only if you measure residues +.... + +Prove resource soundness against `+R+` parametrically (quote +`+Resource.ConsumerLawBundle+`), instantiate Echo at your own fibration +via `+EchoModality+`, and reach for `+M+` _only_ when you genuinely +measure residues. + +It should *not* introduce any of: + +* ✗ Echo as an instance of `+ResourceAlgebra+` +* ✗ Echo as an instance of `+Soundness(R)+` (resource soundness) +* ✗ Tropical (any of the resource instances) as an Echo modality + +These three are exactly the collapses the foundations are built to +prevent. + +''''' + +=== 4. Vocabulary + +Use these three terms precisely — they name three orthogonal things: + +[width="100%",cols="50%,50%",options="header",] +|=== +|Use |Meaning +|*resource grade* |a binder/resource quantity on the resource-algebra +axis (Axis 1) + +|*echo index* |an inhabitant of the thin-poset index of the Echo +modality, e.g. `+keep ≤ residue ≤ forget+` (Axis 3) + +|*residue measure* |a resource-algebra-valued _observation_ of an Echo +residue (the §2 seam) +|=== + +*Avoid / deprecate `+echo-grade+`.* It ambiguously fuses the _echo +index_ (the retention axis of the modality) with the _resource grade_ +(the semiring axis) — which is precisely the collapse this bridge +forbids. If the term must be explained, explain it as that ambiguity. + +''''' + +=== 5. Boundary invariants + +These hold as mechanised upstream results; downstream code must not +violate them. + +[arabic] +. *Echo IS-NOT a resource instance.* Do not model Echo as a +`+Soundness(S)+` / resource-algebra instance. (Upstream: +`+Echo.Separation.NotResourceInstance+`; the proof-relevant Echo +structure is carried by thinness of the index, not by any semiring +grade.) +. *Tropical IS a resource-algebra instance.* Max-plus / min-plus / +min-max are instances of `+Resource.ResourceAlgebra+` and belong on the +resource-grade axis — they are not Echo modalities. +. *Residue measures are observations, not definitions of Echo.* A +`+ResidueMeasure+` is a lossy, one-directional read-out; +`+Echo.Modality.Core+` never depends on it, and never may. +. *Equal residue measure does not imply equal Echo.* A measure can send +two genuinely-distinct Echo residues to the same value while the +modality keeps them apart — so no measure is the identity criterion of +Echo. (Upstream: `+equal-measure-does-not-imply-equal-echo+`, and the +sharper informative-measure witness +`+equal-informative-measure-does-not-imply-equal-echo+`.) + +''''' + +_This brief restates the two `+FOUNDATION_CONTRACT.md+` files for the +downstream direction and adds nothing to them. For the full contracts +and the parametric transport / anti-collapse theorems, read each +foundation’s `+FOUNDATION_CONTRACT.md+` and (tropical) +`+docs/ECHO-RESIDUE-BRIDGE.adoc+`._ diff --git a/FOUNDATIONS_BRIDGE.md b/FOUNDATIONS_BRIDGE.md deleted file mode 100644 index 014a24e..0000000 --- a/FOUNDATIONS_BRIDGE.md +++ /dev/null @@ -1,179 +0,0 @@ - - -# Foundations bridge — consuming `echo-types` and `tropical-resource-typing` - -This is a downstream integration brief for `my-lang` or any other consumer of -the two foundations. It coordinates their outputs; it **adds no new proofs**. -Every theorem named below is already mechanised upstream — this document only -tells a downstream language *how to depend on the two foundations without -collapsing them into each other*. - -Source of truth: - -| Foundation | Axis exported | Contract | Machine-checked in | -|---|---|---|---| -| `tropical-resource-typing` | resource-grade axis | `FOUNDATION_CONTRACT.md` | Lean 4 `Resource.*` | -| `echo-types` | residual-modality axis | `FOUNDATION_CONTRACT.md` | Agda `Echo.*` (`--safe --without-K`) | - ---- - -## 1. Two independent axes - -A consumer tracks **two orthogonal things**. They are not refinements of one -another and they meet only at the one-directional seam in §2. - -> The numbering (`1`, `3`) follows the upstream axis taxonomy. Only these two -> axes are in scope for this brief; they are mutually independent at the core. - -### Axis 1 — Resource algebra (`tropical-resource-typing`) - -- **What it is:** binder/resource *quantities* — usage, cost, latency, critical - path, bottleneck — living in an ordered-semiring / usage-algebra interface. -- **Interface:** `Resource.ResourceAlgebra` (= `Resource.ResourceSemiring` + an - order). `⊞` = choice/alternative, `⊠` = sequential composition. -- **Instances:** `Resource.Instances.{Linear, Affine, MaxPlus, MinPlus, MinMax}` - — i.e. linear / affine usage and the tropical (max-plus / min-plus / min-max) - algebras. The tropical instances double as an **infinite-carrier stress test** - (`Resource.Stress`, `Resource.Infinite`). -- **Used by:** QTT-style / quantitative **resource soundness**. Prove soundness - *parametrically* over the interface via `Resource.ConsumerLawBundle` - (`parametric_resource_transport`, alias `resource_laws_sufficient_for_consumers`), - then instantiate at any algebra above with no algebraic re-proof. - -### Axis 3 — Echo modality (`echo-types`) - -- **What it is:** structured **residue / loss / forgetting / projection** — the - remainder of an information-losing map, `Echo f y := Σ (x : A), (f x ≡ y)`. -- **Indexed by a thin poset:** `Echo.Index.ThinPoset`; the canonical index is the - three-point loss order `keep ≤ residue ≤ forget` (`grade-thinPoset`). Thinness - (order proofs are propositional) is load-bearing, not cosmetic. -- **Proves residual metatheory:** `Echo.Modality.Core` / - `Echo.Modality.Interface` give `degrade`, the unit law `degrade-id`, the - path-independence law `degrade-compose`, and the no-section theorem - `no-section-of-collapsing-map`; the downstream-instantiable record is - `EchoModality` (canonical witness `grade-echoModality`). -- **Independent of the resource algebra at the core:** `Echo.Modality.Core`, - `Echo.Modality.Interface`, and `Echo.Index.ThinPoset` import **no** - semiring / resource-algebra machinery. The proof-relevant content of `degrade` - is carried by the thin order of the index, not by any semiring-valued grade. - ---- - -## 2. The seam - -The only sanctioned connection between the axes is a **measure**, pointing in -exactly one direction: - -``` -ResidueMeasure : Echo residue ──▶ ResourceAlgebra carrier -``` - -- **Direction:** a resource algebra is *consumed as a measure by* Echo. The - residue carrier is opaque; only the codomain is a resource algebra. -- **Never the reverse:** Echo is **not** produced as a resource instance, nor as - a `Soundness(R)` instance. - -The seam is mechanised on both sides — pick whichever framing matches your -downstream proof obligation; both fix the same `E → R` direction: - -**echo-types side (order-monotone view)** — `Echo.Measure.Interface`: - -```agda -record ResidueMeasure (E : EchoModality P ℓc) (R : OrderedCarrier ℓm ℓo) where - field - measure : ∀ {i} → ⟦ i ⟧ → Carrier R - monotone : ∀ {i j} (p : i ≤ j) (x : ⟦ i ⟧) → - measure x ≤R measure (degrade p x) -``` - -**tropical side (monoid-homomorphism view)** — `Resource.EchoBridge`: - -```lean -structure ResidueMeasure (E : Type) (R : Type) [ResourceAlgebra R] where - combine : E → E → E -- Echo-side residue accumulation (opaque) - empty : E - measure : E → R -- the measurement into a resource grade - measure_empty : measure empty = one - measure_combine : ∀ e₁ e₂, measure (combine e₁ e₂) = measure e₁ ⊠ measure e₂ -``` - -In both, the residue carrier `E` carries **no** `ResourceAlgebra` instance and -nothing gives it one. `echo-types` and `tropical-resource-typing` have **no -dependency on each other**; the seam is supplied downstream. - ---- - -## 3. Downstream import pattern - -A consuming language (e.g. `my-lang`) should expose: - -``` -Resource parameter R : ResourceAlgebra -- Axis 1 -Echo parameter E : EchoModality -- Axis 3 -Optional seam M : ResidueMeasure E R -- §2, only if you measure residues -``` - -Prove resource soundness against `R` parametrically (quote -`Resource.ConsumerLawBundle`), instantiate Echo at your own fibration via -`EchoModality`, and reach for `M` *only* when you genuinely measure residues. - -It should **not** introduce any of: - -- ✗ Echo as an instance of `ResourceAlgebra` -- ✗ Echo as an instance of `Soundness(R)` (resource soundness) -- ✗ Tropical (any of the resource instances) as an Echo modality - -These three are exactly the collapses the foundations are built to prevent. - ---- - -## 4. Vocabulary - -Use these three terms precisely — they name three orthogonal things: - -| Use | Meaning | -|---|---| -| **resource grade** | a binder/resource quantity on the resource-algebra axis (Axis 1) | -| **echo index** | an inhabitant of the thin-poset index of the Echo modality, e.g. `keep ≤ residue ≤ forget` (Axis 3) | -| **residue measure** | a resource-algebra-valued *observation* of an Echo residue (the §2 seam) | - -**Avoid / deprecate `echo-grade`.** It ambiguously fuses the *echo index* (the -retention axis of the modality) with the *resource grade* (the semiring axis) — -which is precisely the collapse this bridge forbids. If the term must be -explained, explain it as that ambiguity. - ---- - -## 5. Boundary invariants - -These hold as mechanised upstream results; downstream code must not violate them. - -1. **Echo IS-NOT a resource instance.** Do not model Echo as a `Soundness(S)` / - resource-algebra instance. (Upstream: `Echo.Separation.NotResourceInstance`; - the proof-relevant Echo structure is carried by thinness of the index, not by - any semiring grade.) -2. **Tropical IS a resource-algebra instance.** Max-plus / min-plus / min-max are - instances of `Resource.ResourceAlgebra` and belong on the resource-grade axis - — they are not Echo modalities. -3. **Residue measures are observations, not definitions of Echo.** A - `ResidueMeasure` is a lossy, one-directional read-out; `Echo.Modality.Core` - never depends on it, and never may. -4. **Equal residue measure does not imply equal Echo.** A measure can send two - genuinely-distinct Echo residues to the same value while the modality keeps - them apart — so no measure is the identity criterion of Echo. (Upstream: - `equal-measure-does-not-imply-equal-echo`, and the sharper informative-measure - witness `equal-informative-measure-does-not-imply-equal-echo`.) - ---- - -*This brief restates the two `FOUNDATION_CONTRACT.md` files for the downstream -direction and adds nothing to them. For the full contracts and the parametric -transport / anti-collapse theorems, read each foundation's `FOUNDATION_CONTRACT.md` -and (tropical) `docs/ECHO-RESIDUE-BRIDGE.adoc`.* diff --git a/FOUNDATION_CONTRACT.adoc b/FOUNDATION_CONTRACT.adoc new file mode 100644 index 0000000..b817f7b --- /dev/null +++ b/FOUNDATION_CONTRACT.adoc @@ -0,0 +1,150 @@ +== Echo Types Foundation Contract + +Echo Types exports the *residual-modality axis*. This document is the +stable contract that downstream languages (e.g. my-lang) build against. +It fixes the vocabulary, the exported interface, and — above all — the +boundary invariant that keeps Echo from being collapsed into a +resource/semiring instance. + +The contract is backed by mechanised Agda. The four curated public +modules are: + +[width="100%",cols="34%,33%,33%",options="header",] +|=== +|Concern |Module |File +|Echo index (thin poset) |`+Echo.Index.ThinPoset+` +|`+proofs/agda/Echo/Index/ThinPoset.agda+` + +|Echo modality (core) |`+Echo.Modality.Core+` (+ +`+Echo.Modality.Interface+`) |`+proofs/agda/Echo/Modality/+` + +|Anti-collapse / separation |`+Echo.Separation.NotResourceInstance+` +|`+proofs/agda/Echo/Separation/NotResourceInstance.agda+` + +|Residue-measure seam |`+Echo.Measure.Interface+` (+ +`+Echo.Measure.Examples+`) |`+proofs/agda/Echo/Measure/+` +|=== + +All build under `+--safe --without-K+`, with zero postulates. + +=== Echo index + +The modality is indexed by a *thin poset/order of degradation or +retention*. The canonical instance is the three-point loss order + +.... +keep ≤ residue ≤ forget +.... + +exported as `+grade-thinPoset : ThinPoset 0ℓ 0ℓ+`. The abstract +interface `+ThinPoset+` carries exactly: a carrier/index type `+Ix+`, an +order `+_≤_+`, reflexivity `+≤-refl+`, transitivity `+≤-trans+`, and +*thinness* `+≤-thin+` — propositionality of order proofs (any two proofs +of `+i ≤ j+` are equal). Thinness is load-bearing, not cosmetic: it is +the single hypothesis that makes degradation path-independent (see +_Anti-collapse_ below). + +=== Echo core + +Echo core proves degradation, composition, no-section/irreversibility, +and residue/fibre behaviour: + +* the fibre functor `+Echo f y := Σ (x : A) , (f x ≡ y)+` — the +structured remainder of an information-losing `+f+`; +* the index-graded modality with `+degrade+`, the unit law +`+degrade-id+`, and the path-independence law `+degrade-compose+`; +* the generic no-section theorem `+no-section-of-collapsing-map+` +(Echo’s irreversibility is a property of non-injectivity); +* an abstract `+EchoModality+` record that downstream instantiates at +its own fibration, with the canonical `+grade-echoModality+` witness. + +*Echo core is measure-independent.* The modules `+Echo.Modality.Core+`, +`+Echo.Modality.Interface+`, and `+Echo.Index.ThinPoset+` import *no* +semiring / resource-algebra machinery; their entire cone is `+Echo+`, +`+EchoGraded+`, `+EchoNoSectionGeneric+` and agda-stdlib. The +proof-relevant content of `+degrade+` is carried by the thin order of +the index, not by any semiring-valued grade. + +*Echo core is not a semiring/resource algebra instance.* See the +boundary invariant. + +=== Residue measure + +A resource algebra may be consumed as an *external measure* on Echo +residues. The seam is `+Echo.Measure.Interface+`: + +.... +record ResidueMeasure (E : EchoModality P ℓc) (R : OrderedCarrier ℓm ℓo) where + field + measure : ∀ {i} → ⟦ i ⟧ → Carrier R + monotone : ∀ {i j} (p : i ≤ j) (x : ⟦ i ⟧) → + measure x ≤R measure (degrade p x) +.... + +The target is a minimal local `+OrderedCarrier+` (carrier, reflexive- +transitive order). Concrete semiring-valued measures — a cost measure, a +tropical-cost measure (valued in the order-reduct of the min-plus +semiring), and a probability/confidence measure (valued in the opposite +order) — are downstream refinements that supply an `+OrderedCarrier+` +view of their carrier; three are mechanised in +`+Echo.Measure.Examples+`. The seam is order-only, so these examples +exercise the order, not the semiring’s `+min+`/`+++` operations. + +Such a measure is an *observation/decorating seam, not the definition of +Echo*. `+Echo.Measure.*+` may depend on order/resource interfaces; +`+Echo.Modality.Core+` must not. This direction of dependency is the +contract. + +=== Boundary invariant + +____ +*Echo IS-NOT a resource instance.* + +*Equal residue measure does not imply equal Echo.* + +Do not model Echo as a `+Soundness(S)+` resource-algebra instance in +downstream languages. +____ + +This is mechanised in `+Echo.Separation.NotResourceInstance+` along two +complementary lines (neither claims the impossible universal "`no +semiring can ever encode any echo-like quotient`"; both claim the useful +project invariant that the proof-relevant Echo structure is not +determined by a semiring-valued grade/measure): + +[arabic] +. *Structural* — `+echo-degrade-not-generic-sigma+` (= +`+EchoSeparating.sep-degrade-compose-fails+`). The characteristic law +`+degrade-compose+` is carried _precisely_ by thinness of the echo +index. The separating model keeps the generic Σ-functoriality laws but +drops thinness, and composition then breaks at a checked +`+true ≢ false+`. The graded Echo structure is genuine structure on an +axis no semiring grade supplies. +. *Measure* — `+equal-measure-does-not-imply-equal-echo+` and +`+measure-not-injective+`. A residue measure (the trivial-residue +projection) sends two genuinely-distinct Echo residues (`+echo-true+`, +`+echo-false+`) to the _same_ value, while the modality keeps them +apart. And the sharper witness +`+equal-informative-measure-does-not-imply-equal-echo+` makes the same +point against a measure that is _not_ a strawman: `+visible-measure+` +genuinely reads the residue and lands in a two-point carrier +(`+visible-measure-informative+` shows it discriminates elsewhere), yet +still cannot separate two residues that agree on the visible bit. Equal +residue measure therefore does not imply equal Echo: any such measure is +a lossy observation, never the identity criterion of Echo. + +=== Vocabulary + +Use these terms precisely; they name three orthogonal things. + +* *resource grade* — a binder/resource quantity, belonging to the +resource algebra / semiring axis. +* *echo index* — the thin-poset index of the Echo modality, e.g. +`+keep ≤ residue ≤ forget+`. Inhabitants of `+Ix+`. +* *residue measure* — a semiring/resource-algebra-valued _observation_ +of an Echo residue (a `+ResidueMeasure+`). + +Avoid *"`echo-grade`"*: it ambiguously fuses the orthogonal _echo index_ +(retention axis of the modality) and _resource grade_ (semiring axis), +which is exactly the collapse this contract forbids. If you must explain +the term, explain it as that ambiguity. diff --git a/FOUNDATION_CONTRACT.md b/FOUNDATION_CONTRACT.md deleted file mode 100644 index f25d1d6..0000000 --- a/FOUNDATION_CONTRACT.md +++ /dev/null @@ -1,145 +0,0 @@ - - -# Echo Types Foundation Contract - -Echo Types exports the **residual-modality axis**. This document is the -stable contract that downstream languages (e.g. my-lang) build against. -It fixes the vocabulary, the exported interface, and — above all — the -boundary invariant that keeps Echo from being collapsed into a -resource/semiring instance. - -The contract is backed by mechanised Agda. The four curated public -modules are: - -| Concern | Module | File | -|---|---|---| -| Echo index (thin poset) | `Echo.Index.ThinPoset` | `proofs/agda/Echo/Index/ThinPoset.agda` | -| Echo modality (core) | `Echo.Modality.Core` (+ `Echo.Modality.Interface`) | `proofs/agda/Echo/Modality/` | -| Anti-collapse / separation | `Echo.Separation.NotResourceInstance` | `proofs/agda/Echo/Separation/NotResourceInstance.agda` | -| Residue-measure seam | `Echo.Measure.Interface` (+ `Echo.Measure.Examples`) | `proofs/agda/Echo/Measure/` | - -All build under `--safe --without-K`, with zero postulates. - -## Echo index - -The modality is indexed by a **thin poset/order of degradation or -retention**. The canonical instance is the three-point loss order - -``` -keep ≤ residue ≤ forget -``` - -exported as `grade-thinPoset : ThinPoset 0ℓ 0ℓ`. The abstract interface -`ThinPoset` carries exactly: a carrier/index type `Ix`, an order `_≤_`, -reflexivity `≤-refl`, transitivity `≤-trans`, and **thinness** -`≤-thin` — propositionality of order proofs (any two proofs of `i ≤ j` -are equal). Thinness is load-bearing, not cosmetic: it is the single -hypothesis that makes degradation path-independent (see *Anti-collapse* -below). - -## Echo core - -Echo core proves degradation, composition, no-section/irreversibility, -and residue/fibre behaviour: - -- the fibre functor `Echo f y := Σ (x : A) , (f x ≡ y)` — the - structured remainder of an information-losing `f`; -- the index-graded modality with `degrade`, the unit law `degrade-id`, - and the path-independence law `degrade-compose`; -- the generic no-section theorem `no-section-of-collapsing-map` (Echo's - irreversibility is a property of non-injectivity); -- an abstract `EchoModality` record that downstream instantiates at its - own fibration, with the canonical `grade-echoModality` witness. - -**Echo core is measure-independent.** The modules -`Echo.Modality.Core`, `Echo.Modality.Interface`, and -`Echo.Index.ThinPoset` import **no** semiring / resource-algebra -machinery; their entire cone is `Echo`, `EchoGraded`, -`EchoNoSectionGeneric` and agda-stdlib. The proof-relevant content of -`degrade` is carried by the thin order of the index, not by any -semiring-valued grade. - -**Echo core is not a semiring/resource algebra instance.** See the -boundary invariant. - -## Residue measure - -A resource algebra may be consumed as an **external measure** on Echo -residues. The seam is `Echo.Measure.Interface`: - -``` -record ResidueMeasure (E : EchoModality P ℓc) (R : OrderedCarrier ℓm ℓo) where - field - measure : ∀ {i} → ⟦ i ⟧ → Carrier R - monotone : ∀ {i j} (p : i ≤ j) (x : ⟦ i ⟧) → - measure x ≤R measure (degrade p x) -``` - -The target is a minimal local `OrderedCarrier` (carrier, reflexive- -transitive order). Concrete semiring-valued measures — a cost measure, a -tropical-cost measure (valued in the order-reduct of the min-plus -semiring), and a probability/confidence measure (valued in the opposite -order) — are downstream refinements that supply an `OrderedCarrier` view -of their carrier; three are mechanised in `Echo.Measure.Examples`. The -seam is order-only, so these examples exercise the order, not the -semiring's `min`/`+` operations. - -Such a measure is an **observation/decorating seam, not the definition -of Echo**. `Echo.Measure.*` may depend on order/resource interfaces; -`Echo.Modality.Core` must not. This direction of dependency is the -contract. - -## Boundary invariant - -> **Echo IS-NOT a resource instance.** -> -> **Equal residue measure does not imply equal Echo.** -> -> Do not model Echo as a `Soundness(S)` resource-algebra instance in -> downstream languages. - -This is mechanised in `Echo.Separation.NotResourceInstance` along two -complementary lines (neither claims the impossible universal "no -semiring can ever encode any echo-like quotient"; both claim the useful -project invariant that the proof-relevant Echo structure is not -determined by a semiring-valued grade/measure): - -1. **Structural** — `echo-degrade-not-generic-sigma` - (= `EchoSeparating.sep-degrade-compose-fails`). The characteristic - law `degrade-compose` is carried *precisely* by thinness of the echo - index. The separating model keeps the generic Σ-functoriality laws - but drops thinness, and composition then breaks at a checked - `true ≢ false`. The graded Echo structure is genuine structure on an - axis no semiring grade supplies. - -2. **Measure** — `equal-measure-does-not-imply-equal-echo` and - `measure-not-injective`. A residue measure (the trivial-residue - projection) sends two genuinely-distinct Echo residues (`echo-true`, - `echo-false`) to the *same* value, while the modality keeps them - apart. And the sharper witness - `equal-informative-measure-does-not-imply-equal-echo` makes the same - point against a measure that is *not* a strawman: `visible-measure` - genuinely reads the residue and lands in a two-point carrier - (`visible-measure-informative` shows it discriminates elsewhere), yet - still cannot separate two residues that agree on the visible bit. - Equal residue measure therefore does not imply equal Echo: any such - measure is a lossy observation, never the identity criterion of Echo. - -## Vocabulary - -Use these terms precisely; they name three orthogonal things. - -- **resource grade** — a binder/resource quantity, belonging to the - resource algebra / semiring axis. -- **echo index** — the thin-poset index of the Echo modality, e.g. - `keep ≤ residue ≤ forget`. Inhabitants of `Ix`. -- **residue measure** — a semiring/resource-algebra-valued *observation* - of an Echo residue (a `ResidueMeasure`). - -Avoid **"echo-grade"**: it ambiguously fuses the orthogonal *echo index* -(retention axis of the modality) and *resource grade* (semiring axis), -which is exactly the collapse this contract forbids. If you must explain -the term, explain it as that ambiguity. diff --git a/Fidelity-OPEN-postulates.adoc b/Fidelity-OPEN-postulates.adoc new file mode 100644 index 0000000..a5d77d9 --- /dev/null +++ b/Fidelity-OPEN-postulates.adoc @@ -0,0 +1,93 @@ +== Fidelity — open postulates (trust boundaries) + +Companion to `+proofs/agda/Ordinal/Buchholz/Fidelity.agda+`. Open +problem *`+D-2026-06-14+`* +(`+docs/echo-types/decisions/ordinal-bh-order-type-fidelity-open.adoc+`). + +=== Plain-language summary + +*What is now mechanised.* Only the _shape_ of the order-type fidelity +claim, plus one genuinely-proved structural fact: + +* The *theorem shape* is typed and auditable: `+Fidelity.agda+` states +"`the sound carrier `+_<ᵇ²_+` (on well-formed terms `+WfBT+`) has order +type ψ₀(Ω_ω)`" as a cofinal order-embedding into a Bachmann–Howard +structure (`+OrderTypeBH+`, assembled in `+fidelity+`). The statement is +quantified over the *sound carrier only* — never native `+_<ᵇ_+`. +* The *lower-bound half* (`+fidelity-lower+`) is a real term _given the +postulated denotation_: the BH height is attained by the well-formed +carrier term `+BH = ψ₀(Ω_ω)+` itself (it plumbs `+BH+`, `+BH-wf+`, and +the denotation’s `+pins-BH+` field — no postulate of its own). +* The *grammar-level upper shadow* (`+marker-≤ω+`, `+markers-≤ω+`) is +proved *for real, postulate-free*: every Ω-marker in any Buchholz term +is `+≤Ω ω+` (the carrier lives in the ν ≤ ω fragment; the notation never +names a marker above Ω_ω). This is the structural precondition of the +upper bound, _not_ the upper bound itself. +* The *target structure* `+(𝒪, _<𝒪_, wf-<𝒪)+` is now *real, +postulate-free* (2026-06-15): `+Ordinal.Buchholz.BHTarget+` constructs +it from the Brouwer order (`+Ord+` / `+_<′_+` / `+wf-<′+`) via +`+bh-notation-from+`, inside the `+--safe+` kernel (wired into +`+All.agda+`, pinned in `+Ordinal/Buchholz/Smoke.agda+`). Only the +candidate BH _height_ remains a free input — an explicit +`+Fidelity.AtHeight+` module parameter. + +*What remains genuinely open.* The two pieces of real content — the +*order-reflecting, height-preserving denotation* `+⟦·⟧+` and its +*cofinality* — are postulated. (The checked Bachmann–Howard target +_structure_ is no longer assumed — see the last bullet above.) These are +the missing _objects_, not missing _plumbing_. + +*Explicit non-claim.* _Nothing in this module asserts that order type +ψ₀(Ω_ω) is proven._ `+fidelity+` is only as strong as the three +postulates below; with them open, it asserts the *shape* of fidelity, +not fidelity. `+rank2+` (the height-collapsing termination measure) is +*not* reused, extended, or tightened toward this claim — fidelity needs +the separate, height-preserving `+⟦·⟧+`. The status surfaces (appendix, +decision log, roadmap) continue to read *"`written at WF milestone; +order-type fidelity OPEN`"* and were _not_ edited by this commit. + +=== The postulates (complete list — `+grep postulate Fidelity.agda+`) + +As of 2026-06-15 there are *two* (reduced from three). The former +`+bh-notation+` postulate is *discharged*: the target structure is now +constructed for real in the `+--safe+` module +`+Ordinal.Buchholz.BHTarget+` (`+bh-notation-from+` over the Brouwer +order `+Ord+` / `+_<′_+` / `+wf-<′+`), and the candidate BH height is an +explicit `+Fidelity.AtHeight+` module parameter rather than an axiom. + +[width="100%",cols="8%,11%,40%,29%,12%",options="header",] +|=== +|# |Name |Statement (in words) |What closes it |Owner +|1 |`+denotation : DenotesBH bh-notation+` |A denotation +`+⟦·⟧ : BT → 𝒪+` (with `+𝒪 = Ord+`, `+_<𝒪_ = _<′_+`) that is +*order-preserving* (`+s <ᵇ² t → ⟦s⟧ <′ ⟦t⟧+`), *order-reflecting* +(`+⟦s⟧ <′ ⟦t⟧ → s <ᵇ² t+`), *cofinal* (image unbounded in `+Ord+`), and +*pins BH* (`+⟦BH⟧ ≡ bh-height+`). The height-preserving embedding +`+rank2+` is _not_. |Define `+⟦·⟧+` mapping each ψ_ν / Ω_ν / + to its +genuine ordinal height (not the collapsed ω-power blocks of `+rank2+`) +and prove the four fields. This is the core order-type-correctness work +(a denotational semantics for the notation faithful to `+_<ᵇ²_+`). +|*External mathematics* (owner / external); the design route is option +(a) in `+D-2026-06-14+`. + +|2 |`+ordinal-upper-bound : ∀ {t} → WfBT t → ¬ (bh-height <𝒪 ⟦ t ⟧)+` +|No well-formed carrier term denotes strictly above the BH height (the +⟦·⟧-level upper half of the sandwich). |Cheap _given_ postulate #1: +combine the real `+markers-≤ω+` (every marker `+≤Ω ω+`) with a height +calculation through the real `+⟦·⟧+` (markers `+≤ ω+` ⇒ denotation +`+≤ ψ₀(Ω_ω)+`). It is postulated only because it quantifies over the +not-yet-real `+⟦·⟧+`; it is *not* independent external mathematics +beyond #1. |Discharged alongside / just after #1 (in-repo, once `+⟦·⟧+` +is real). +|=== + +=== Discharge order + +`+denotation+` (#1) is the genuine external content — the faithful +height-preserving embedding into the now-real Brouwer target. +`+ordinal-upper-bound+` (#2) is downstream of #1 and in-repo once #1 +lands. When both are real, `+fidelity : OrderTypeBH+` becomes an +unconditional theorem (for the supplied `+AtHeight+` height) and a +*human* may then update the appendix / decision-log / roadmap from +"`OPEN`" to discharged — per the hard rule, this commit does not +pre-empt that sign-off. diff --git a/Fidelity-OPEN-postulates.md b/Fidelity-OPEN-postulates.md deleted file mode 100644 index 577890d..0000000 --- a/Fidelity-OPEN-postulates.md +++ /dev/null @@ -1,77 +0,0 @@ - - -# Fidelity — open postulates (trust boundaries) - -Companion to `proofs/agda/Ordinal/Buchholz/Fidelity.agda`. Open problem -**`D-2026-06-14`** (`docs/echo-types/decisions/ordinal-bh-order-type-fidelity-open.adoc`). - -## Plain-language summary - -**What is now mechanised.** Only the *shape* of the order-type -fidelity claim, plus one genuinely-proved structural fact: - -- The **theorem shape** is typed and auditable: `Fidelity.agda` states - "the sound carrier `_<ᵇ²_` (on well-formed terms `WfBT`) has order - type ψ₀(Ω_ω)" as a cofinal order-embedding into a Bachmann–Howard - structure (`OrderTypeBH`, assembled in `fidelity`). The statement is - quantified over the **sound carrier only** — never native `_<ᵇ_`. -- The **lower-bound half** (`fidelity-lower`) is a real term *given the - postulated denotation*: the BH height is attained by the well-formed - carrier term `BH = ψ₀(Ω_ω)` itself (it plumbs `BH`, `BH-wf`, and the - denotation's `pins-BH` field — no postulate of its own). -- The **grammar-level upper shadow** (`marker-≤ω`, `markers-≤ω`) is - proved **for real, postulate-free**: every Ω-marker in any Buchholz - term is `≤Ω ω` (the carrier lives in the ν ≤ ω fragment; the notation - never names a marker above Ω_ω). This is the structural precondition - of the upper bound, *not* the upper bound itself. -- The **target structure** `(𝒪, _<𝒪_, wf-<𝒪)` is now **real, - postulate-free** (2026-06-15): `Ordinal.Buchholz.BHTarget` constructs - it from the Brouwer order (`Ord` / `_<′_` / `wf-<′`) via - `bh-notation-from`, inside the `--safe` kernel (wired into `All.agda`, - pinned in `Ordinal/Buchholz/Smoke.agda`). Only the candidate BH - *height* remains a free input — an explicit `Fidelity.AtHeight` - module parameter. - -**What remains genuinely open.** The two pieces of real content — the -**order-reflecting, height-preserving denotation** `⟦·⟧` and its -**cofinality** — are postulated. (The checked Bachmann–Howard target -*structure* is no longer assumed — see the last bullet above.) These are -the missing *objects*, not missing *plumbing*. - -**Explicit non-claim.** *Nothing in this module asserts that order type -ψ₀(Ω_ω) is proven.* `fidelity` is only as strong as the three -postulates below; with them open, it asserts the **shape** of fidelity, -not fidelity. `rank2` (the height-collapsing termination measure) is -**not** reused, extended, or tightened toward this claim — fidelity -needs the separate, height-preserving `⟦·⟧`. The status surfaces -(appendix, decision log, roadmap) continue to read **"written at WF -milestone; order-type fidelity OPEN"** and were *not* edited by this -commit. - -## The postulates (complete list — `grep postulate Fidelity.agda`) - -As of 2026-06-15 there are **two** (reduced from three). The former -`bh-notation` postulate is **discharged**: the target structure is now -constructed for real in the `--safe` module `Ordinal.Buchholz.BHTarget` -(`bh-notation-from` over the Brouwer order `Ord` / `_<′_` / `wf-<′`), and -the candidate BH height is an explicit `Fidelity.AtHeight` module -parameter rather than an axiom. - -| # | Name | Statement (in words) | What closes it | Owner | -|---|------|----------------------|----------------|-------| -| 1 | `denotation : DenotesBH bh-notation` | A denotation `⟦·⟧ : BT → 𝒪` (with `𝒪 = Ord`, `_<𝒪_ = _<′_`) that is **order-preserving** (`s <ᵇ² t → ⟦s⟧ <′ ⟦t⟧`), **order-reflecting** (`⟦s⟧ <′ ⟦t⟧ → s <ᵇ² t`), **cofinal** (image unbounded in `Ord`), and **pins BH** (`⟦BH⟧ ≡ bh-height`). The height-preserving embedding `rank2` is *not*. | Define `⟦·⟧` mapping each ψ_ν / Ω_ν / + to its genuine ordinal height (not the collapsed ω-power blocks of `rank2`) and prove the four fields. This is the core order-type-correctness work (a denotational semantics for the notation faithful to `_<ᵇ²_`). | **External mathematics** (owner / external); the design route is option (a) in `D-2026-06-14`. | -| 2 | `ordinal-upper-bound : ∀ {t} → WfBT t → ¬ (bh-height <𝒪 ⟦ t ⟧)` | No well-formed carrier term denotes strictly above the BH height (the ⟦·⟧-level upper half of the sandwich). | Cheap *given* postulate #1: combine the real `markers-≤ω` (every marker `≤Ω ω`) with a height calculation through the real `⟦·⟧` (markers `≤ ω` ⇒ denotation `≤ ψ₀(Ω_ω)`). It is postulated only because it quantifies over the not-yet-real `⟦·⟧`; it is **not** independent external mathematics beyond #1. | Discharged alongside / just after #1 (in-repo, once `⟦·⟧` is real). | - -## Discharge order - -`denotation` (#1) is the genuine external content — the faithful -height-preserving embedding into the now-real Brouwer target. -`ordinal-upper-bound` (#2) is downstream of #1 and in-repo once #1 -lands. When both are real, `fidelity : OrderTypeBH` becomes an -unconditional theorem (for the supplied `AtHeight` height) and a -**human** may then update the appendix / decision-log / roadmap from -"OPEN" to discharged — per the hard rule, this commit does not pre-empt -that sign-off. diff --git a/SECURITY.adoc b/SECURITY.adoc new file mode 100644 index 0000000..fc2d266 --- /dev/null +++ b/SECURITY.adoc @@ -0,0 +1,35 @@ +== Security Policy + +=== Reporting a Vulnerability + +Email `+j.d.a.jewell@open.ac.uk+` with subject +`+[security] echo-types: +`. PGP key fingerprint published at +the hyperpolymath organisation profile. + +Expect an acknowledgement within 72 hours and an initial assessment +within 7 days. + +=== Supported Versions + +[cols=",",options="header",] +|=== +|Version |Supported +|Latest tagged release |Yes +|Previous minor |90 days from successor release +|All older versions |No +|=== + +=== Security Posture + +This is a formal-methods library: + +* Constructive Agda proofs (no postulates in the load-bearing tracks). +* No `+believe_me+` in distinctness arguments. CI checks for these +patterns. +* Imports are pinned in `+echo-types.agda-lib+`; updates are reviewed. +* Container images use Chainguard distroless bases (when +`+stapeln.toml+` lands a green build). + +There is no networked attack surface — echo-types is a proof library, +not a service. Report concerns about proof soundness to the same address +as security issues. diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 8079d3b..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,29 +0,0 @@ - - -# Security Policy - -## Reporting a Vulnerability - -Email `j.d.a.jewell@open.ac.uk` with subject `[security] echo-types: `. -PGP key fingerprint published at the hyperpolymath organisation profile. - -Expect an acknowledgement within 72 hours and an initial assessment within 7 days. - -## Supported Versions - -| Version | Supported | -|---------|-----------| -| Latest tagged release | Yes | -| Previous minor | 90 days from successor release | -| All older versions | No | - -## Security Posture - -This is a formal-methods library: - -* Constructive Agda proofs (no postulates in the load-bearing tracks). -* No `believe_me` in distinctness arguments. CI checks for these patterns. -* Imports are pinned in `echo-types.agda-lib`; updates are reviewed. -* Container images use Chainguard distroless bases (when `stapeln.toml` lands a green build). - -There is no networked attack surface — echo-types is a proof library, not a service. Report concerns about proof soundness to the same address as security issues. diff --git a/_handoff.adoc b/_handoff.adoc new file mode 100644 index 0000000..fd77001 --- /dev/null +++ b/_handoff.adoc @@ -0,0 +1,129 @@ +== Session handoff — Phase 1.3 + Pentagon closure + +Migrated from `+C:\dev\+` (Windows) to `+~/dev/+` (WSL ext4) on +2026-04-30. This session ran on Windows-side Claude Code; you’re now +picking it up on WSL-side Claude Code. + +=== Uncommitted edits in the working tree + +Verified against Agda 2.6.3 + stdlib 2.0 on 2026-05-01 from +`+~/dev/echo-types/+` after one fix (see "`Implicit-f inference fix`" +below). + +* `+proofs/agda/Ordinal/Brouwer/Phase13.agda+` — added the limit-case +closure for the recursive `+_≤′_+`: +** `+≤′-lim+` — source-side limit introduction (recurses on α, not on +`+f n+`, sidestepping the original `+with+`-loses-equation obstacle). +** `+≤′-refl+` — full reflexivity, including the `+olim f+` case. +** `+f-in-lim′+` — recursive analogue of `+Ordinal.Brouwer.f-in-lim+`. +** `+≤′-trans+` — transitivity by lex structural recursion on +`+(α, β, γ)+`. +** Imports updated to add `+_,_+` and `+⊥-elim+`. +* `+proofs/agda/Echo.agda+` — pentagon Σ-associativity iso packaging: +** `+Echo-comp-pent-Σ-assoc : ... ↔ ...+` packaging the four directional +pieces as a stdlib `+Function.Bundles._↔_+` record. +* `+proofs/agda/Smoke.agda+` — pinned all new headlines. +* `+CLAUDE.md+` — updated composition-track summary (cancel-iso +staleness fixed, pentagon marked complete) and Phase 1.3 sub-bullet +under "`Open at this rung`" marked landed. +* `+docs/echo-types/composition.md+` — Q4 ("`Pentagon coherence`") +flipped from "`partially landed`" to "`landed`" with the +`+Echo-comp-pent-Σ-assoc+` reference. + +=== Implicit-f inference fix + +First verify run failed with "`unsolved metas`" inside `+≤′-lim+`, +`+≤′-refl+`, and `+f-in-lim′+`. Cause: Agda can’t uniquely solve +`+_f_ n = f n+` for the implicit `+f+` of `+≤′-lim+` (multiple functions +agree at a single point). Fix: made the `+f+` argument of `+≤′-lim+` +*explicit* (formerly implicit). Each call site now passes `+f+` +directly. The proof structure is unchanged. + +=== First action: re-verify + +.... +cd ~/dev/echo-types +LC_ALL=C.UTF-8 agda -i proofs/agda proofs/agda/Smoke.agda +LC_ALL=C.UTF-8 agda -i proofs/agda proofs/agda/All.agda +.... + +Both should exit 0 under `+--safe --without-K+`. No postulates +introduced. + +=== Open architectural question (gates the next rung) + +While scoping the *arithmetic side of Phase 1.3* (`+⊕-mono-<-right+` +etc., which the `+RankBrouwer.agda+` preamble names as the lemmas needed +for `+rank-mono+` and the unbudgeted `+wf-<ᵇʳᶠ+` chain), I traced +through the data-style `+_≤_+` from `+proofs/agda/Ordinal/Brouwer.agda+` +and concluded: + +*`+osuc-mono-≤+` is not just hard but unprovable in the data-style +`+_≤_+`.* + +Concrete counterexample: - `+oz ≤ olim (λ _ → oz)+` is provable (via +`+≤-lim 0 ≤-refl+`). - `+osuc oz ≤ osuc (olim (λ _ → oz))+` is +unprovable: each of the three `+_≤_+` constructors fails — `+≤-refl+` +needs head equality, `+≤-suc+` reduces the goal to +`+osuc oz ≤ olim (λ _ → oz)+` which by the same trichotomy reduces to +`+osuc oz ≤ oz+`, `+≤-lim+` requires the LHS to fit inside a branch +(also `+oz+`). + +The data-style `+_≤_+` is "`minimally reflexive`" — strong enough to +give `+wf-<+` by structural induction, but blind to Brouwer-canonical +equivalences. Phase 1.3’s recursive `+_≤′_+` was introduced precisely to +fix this; `+osuc-mono-≤′ p = p+` is identity under the recursive shape. + +This means arithmetic monotonicity (`+⊕-mono-<-right+`, `+psi-rank+` +ν-monotonicity) naturally lives against `+_≤′_+`/`+_<′_+`, not against +the data-style. But `+RankBrouwer.agda+`’s closing chain references +`+wf-<+` (data-style): + +.... +wf-<ᵇʳᶠ = Subrelation.wellFounded rank-mono + (InverseImage.wellFounded rank wf-<) +.... + +So a design call is needed. Three candidate paths: + +*(a) Prove `+wf-<′+` separately* and restate `+rank-mono+` against +`+_<′_+`. Cleanest mathematically. `+wf-<′+` would be a parallel +structural-induction proof to `+wf-<+` adapted to the recursive shape — +not huge, but real work. + +*(b) Bridge `+_<_ ↔ _<′_+`* and pull WF across. The easy direction +(`+_<_ → _<′_+`) works by translating each data witness inductively +through `+≤′-step+`/`+f-in-lim′+`. The reverse direction +(`+_<′_ → _<_+`) fails for the same reason `+osuc-mono-≤+` fails. So +`+Subrelation.wellFounded+` gives `+wf-<+` from `+wf-<′+` (we already +have `+wf-<+`); it does NOT give `+wf-<′+` from `+wf-<+`. Bridging alone +doesn’t unblock. + +*(c) Prove only the limited data-style arithmetic lemmas* for the +specific BT-rank shapes we use. Keeps the existing chain. Fragile to +`+rank+` shape changes. + +*Recommendation: (a).* User said "`yes`" before env setup detoured us. + +=== After verify, the immediate next step is + +Either: - Take path (a): add +`+proofs/agda/Ordinal/Brouwer/WellFoundedR.agda+` (or extend +`+Phase13.agda+`) with `+wf-<′ : WellFounded _<′_+`. Then proceed with +arithmetic-side monotonicity in `+_<′_+` form. - Or revisit the path +choice with the user. + +The full frontier punch list from this session: + +[arabic] +. *Phase 1.3 arithmetic side* (this is the next big rung) +. *`+rank-mono+`* in `+RankBrouwer.agda+` — falls out from #1 +. *Unbudgeted `+wf-<ᵇʳᶠ+`* — assembled from #2 +. *`+_<ᵇ⁺_+` WF Route B* — uses the same `+rank+` machinery; design note +at `+docs/echo-types/buchholz-extended-wf.md+` +. *Push surface-route WF back into `+Order.agda+`’s main `+_<ᵇ_+`* — +gated on #4 +. *EchoApprox headline pinning* — minor: +`+echo-approx-{intro,relax, compose}+` aren’t individually pinned in +`+Smoke.agda+`, only the module is. CLAUDE.md operating rules want +individual headline pins. diff --git a/_handoff.md b/_handoff.md deleted file mode 100644 index c741b34..0000000 --- a/_handoff.md +++ /dev/null @@ -1,126 +0,0 @@ - - -# Session handoff — Phase 1.3 + Pentagon closure - -Migrated from `C:\dev\` (Windows) to `~/dev/` (WSL ext4) on 2026-04-30. -This session ran on Windows-side Claude Code; you're now picking it up on -WSL-side Claude Code. - -## Uncommitted edits in the working tree - -Verified against Agda 2.6.3 + stdlib 2.0 on 2026-05-01 from -`~/dev/echo-types/` after one fix (see "Implicit-f inference fix" below). - -* `proofs/agda/Ordinal/Brouwer/Phase13.agda` — added the limit-case - closure for the recursive `_≤′_`: - - `≤′-lim` — source-side limit introduction (recurses on α, not on `f n`, - sidestepping the original `with`-loses-equation obstacle). - - `≤′-refl` — full reflexivity, including the `olim f` case. - - `f-in-lim′` — recursive analogue of `Ordinal.Brouwer.f-in-lim`. - - `≤′-trans` — transitivity by lex structural recursion on `(α, β, γ)`. - - Imports updated to add `_,_` and `⊥-elim`. - -* `proofs/agda/Echo.agda` — pentagon Σ-associativity iso packaging: - - `Echo-comp-pent-Σ-assoc : ... ↔ ...` packaging the four directional - pieces as a stdlib `Function.Bundles._↔_` record. - -* `proofs/agda/Smoke.agda` — pinned all new headlines. - -* `CLAUDE.md` — updated composition-track summary (cancel-iso staleness - fixed, pentagon marked complete) and Phase 1.3 sub-bullet under "Open - at this rung" marked landed. - -* `docs/echo-types/composition.md` — Q4 ("Pentagon coherence") flipped - from "partially landed" to "landed" with the `Echo-comp-pent-Σ-assoc` - reference. - -## Implicit-f inference fix - -First verify run failed with "unsolved metas" inside `≤′-lim`, -`≤′-refl`, and `f-in-lim′`. Cause: Agda can't uniquely solve -`_f_ n = f n` for the implicit `f` of `≤′-lim` (multiple functions -agree at a single point). Fix: made the `f` argument of `≤′-lim` -**explicit** (formerly implicit). Each call site now passes `f` -directly. The proof structure is unchanged. - -## First action: re-verify - -``` -cd ~/dev/echo-types -LC_ALL=C.UTF-8 agda -i proofs/agda proofs/agda/Smoke.agda -LC_ALL=C.UTF-8 agda -i proofs/agda proofs/agda/All.agda -``` - -Both should exit 0 under `--safe --without-K`. No postulates introduced. - -## Open architectural question (gates the next rung) - -While scoping the **arithmetic side of Phase 1.3** (`⊕-mono-<-right` etc., -which the `RankBrouwer.agda` preamble names as the lemmas needed for -`rank-mono` and the unbudgeted `wf-<ᵇʳᶠ` chain), I traced through the -data-style `_≤_` from `proofs/agda/Ordinal/Brouwer.agda` and concluded: - -**`osuc-mono-≤` is not just hard but unprovable in the data-style `_≤_`.** - -Concrete counterexample: -- `oz ≤ olim (λ _ → oz)` is provable (via `≤-lim 0 ≤-refl`). -- `osuc oz ≤ osuc (olim (λ _ → oz))` is unprovable: each of the three - `_≤_` constructors fails — `≤-refl` needs head equality, `≤-suc` - reduces the goal to `osuc oz ≤ olim (λ _ → oz)` which by the same - trichotomy reduces to `osuc oz ≤ oz`, `≤-lim` requires the LHS to - fit inside a branch (also `oz`). - -The data-style `_≤_` is "minimally reflexive" — strong enough to give -`wf-<` by structural induction, but blind to Brouwer-canonical -equivalences. Phase 1.3's recursive `_≤′_` was introduced precisely to -fix this; `osuc-mono-≤′ p = p` is identity under the recursive shape. - -This means arithmetic monotonicity (`⊕-mono-<-right`, `psi-rank` -ν-monotonicity) naturally lives against `_≤′_`/`_<′_`, not against the -data-style. But `RankBrouwer.agda`'s closing chain references `wf-<` -(data-style): - -``` -wf-<ᵇʳᶠ = Subrelation.wellFounded rank-mono - (InverseImage.wellFounded rank wf-<) -``` - -So a design call is needed. Three candidate paths: - -**(a) Prove `wf-<′` separately** and restate `rank-mono` against `_<′_`. -Cleanest mathematically. `wf-<′` would be a parallel structural-induction -proof to `wf-<` adapted to the recursive shape — not huge, but real work. - -**(b) Bridge `_<_ ↔ _<′_`** and pull WF across. The easy direction -(`_<_ → _<′_`) works by translating each data witness inductively -through `≤′-step`/`f-in-lim′`. The reverse direction (`_<′_ → _<_`) -fails for the same reason `osuc-mono-≤` fails. So `Subrelation.wellFounded` -gives `wf-<` from `wf-<′` (we already have `wf-<`); it does NOT give -`wf-<′` from `wf-<`. Bridging alone doesn't unblock. - -**(c) Prove only the limited data-style arithmetic lemmas** for the -specific BT-rank shapes we use. Keeps the existing chain. Fragile to -`rank` shape changes. - -**Recommendation: (a).** User said "yes" before env setup detoured us. - -## After verify, the immediate next step is - -Either: -- Take path (a): add `proofs/agda/Ordinal/Brouwer/WellFoundedR.agda` - (or extend `Phase13.agda`) with `wf-<′ : WellFounded _<′_`. Then - proceed with arithmetic-side monotonicity in `_<′_` form. -- Or revisit the path choice with the user. - -The full frontier punch list from this session: - -1. **Phase 1.3 arithmetic side** (this is the next big rung) -2. **`rank-mono`** in `RankBrouwer.agda` — falls out from #1 -3. **Unbudgeted `wf-<ᵇʳᶠ`** — assembled from #2 -4. **`_<ᵇ⁺_` WF Route B** — uses the same `rank` machinery; design note - at `docs/echo-types/buchholz-extended-wf.md` -5. **Push surface-route WF back into `Order.agda`'s main `_<ᵇ_`** — gated - on #4 -6. **EchoApprox headline pinning** — minor: `echo-approx-{intro,relax, - compose}` aren't individually pinned in `Smoke.agda`, only the module - is. CLAUDE.md operating rules want individual headline pins. diff --git a/core/skepticisms/failure-conditions.adoc b/core/skepticisms/failure-conditions.adoc new file mode 100644 index 0000000..725ca74 --- /dev/null +++ b/core/skepticisms/failure-conditions.adoc @@ -0,0 +1,27 @@ +== Failure Conditions + +=== The Skeptical Position + +Any formalism can be made to work on trivial examples. The true test of +a theory is its boundary conditions and where it breaks down. + +=== Explicit Failure Modes + +[arabic] +. *Abstraction Leaks:* If users must constantly unwrap the `+Echo+` to +perform standard proofs, the abstraction has failed. +. *Combinatorial Explosion:* If composing two lossy operations `+f+` and +`+g+` results in an unmanageably complex nested `+Echo+`, the theory is +not compositionally viable. +. *Triviality:* If the only provable theorems are isomorphic to +`+f x ≡ f x+`, the theory lacks predictive power. +. *Lack of Separation:* If the "`residue`" cannot be meaningfully +separated from the full "`echo`" in a proof-relevant way (e.g., if +extracting the constraint requires keeping the entire original witness), +then the claim of "`partial recovery`" is false. + +=== The Burden of Proof + +The repository must provide mechanically checked counter-examples to +these failure modes, specifically demonstrating non-trivial composition, +manageable complexity, and strict separation of residues. diff --git a/core/skepticisms/failure-conditions.md b/core/skepticisms/failure-conditions.md deleted file mode 100644 index 69b2287..0000000 --- a/core/skepticisms/failure-conditions.md +++ /dev/null @@ -1,16 +0,0 @@ - - -# Failure Conditions - -## The Skeptical Position -Any formalism can be made to work on trivial examples. The true test of a theory is its boundary conditions and where it breaks down. - -## Explicit Failure Modes - -1. **Abstraction Leaks:** If users must constantly unwrap the `Echo` to perform standard proofs, the abstraction has failed. -2. **Combinatorial Explosion:** If composing two lossy operations `f` and `g` results in an unmanageably complex nested `Echo`, the theory is not compositionally viable. -3. **Triviality:** If the only provable theorems are isomorphic to `f x ≡ f x`, the theory lacks predictive power. -4. **Lack of Separation:** If the "residue" cannot be meaningfully separated from the full "echo" in a proof-relevant way (e.g., if extracting the constraint requires keeping the entire original witness), then the claim of "partial recovery" is false. - -## The Burden of Proof -The repository must provide mechanically checked counter-examples to these failure modes, specifically demonstrating non-trivial composition, manageable complexity, and strict separation of residues. diff --git a/core/skepticisms/is-this-just-fibers.adoc b/core/skepticisms/is-this-just-fibers.adoc new file mode 100644 index 0000000..53a3e3c --- /dev/null +++ b/core/skepticisms/is-this-just-fibers.adoc @@ -0,0 +1,30 @@ +== Is this just Fibers? + +=== The Skeptical Position + +Yes, structurally, an `+Echo+` is just a standard homotopy fiber: +`+Σ A (λ x → f x ≡ y)+`. There is no novel syntactic or type-theoretic +construction here. If treated purely structurally, there is nothing new. + +=== The Burden of Proof + +The burden of proof lies in demonstrating that treating this specific +fiber as a first-class object of study—specifically framing it as +"`structured loss`" or a "`retained constraint`" over a +projection—yields results that are practically obscured when treating it +just as a generic pullback over a point. + +=== Collapse Conditions + +If the resulting theorems are identical in both form and usage to +standard lemmas about HoTT fibers (e.g., contractibility of fibers for +equivalences), then the "`Echo`" terminology is an unnecessary renaming +and should be collapsed back to standard fiber theory. + +=== Reinterpretation vs. Novelty + +The claim is _not_ mathematical novelty of the definition. The claim is +that identifying this structure as a computational artifact of +irreversible processes (rather than just a topological invariant) +exposes a class of practically useful "`residue`" theorems that standard +literature ignores. diff --git a/core/skepticisms/is-this-just-fibers.md b/core/skepticisms/is-this-just-fibers.md deleted file mode 100644 index 9beb3ed..0000000 --- a/core/skepticisms/is-this-just-fibers.md +++ /dev/null @@ -1,15 +0,0 @@ - - -# Is this just Fibers? - -## The Skeptical Position -Yes, structurally, an `Echo` is just a standard homotopy fiber: `Σ A (λ x → f x ≡ y)`. There is no novel syntactic or type-theoretic construction here. If treated purely structurally, there is nothing new. - -## The Burden of Proof -The burden of proof lies in demonstrating that treating this specific fiber as a first-class object of study—specifically framing it as "structured loss" or a "retained constraint" over a projection—yields results that are practically obscured when treating it just as a generic pullback over a point. - -## Collapse Conditions -If the resulting theorems are identical in both form and usage to standard lemmas about HoTT fibers (e.g., contractibility of fibers for equivalences), then the "Echo" terminology is an unnecessary renaming and should be collapsed back to standard fiber theory. - -## Reinterpretation vs. Novelty -The claim is *not* mathematical novelty of the definition. The claim is that identifying this structure as a computational artifact of irreversible processes (rather than just a topological invariant) exposes a class of practically useful "residue" theorems that standard literature ignores. diff --git a/core/skepticisms/is-this-just-sigma-types.adoc b/core/skepticisms/is-this-just-sigma-types.adoc new file mode 100644 index 0000000..ec03731 --- /dev/null +++ b/core/skepticisms/is-this-just-sigma-types.adoc @@ -0,0 +1,168 @@ +== Is this just Sigma Types? + +=== The Skeptical Position + +Yes, at the lowest level of Agda code, this is +`+Σ (x : A) , (f x ≡ y)+`. It relies entirely on the standard dependent +pair type and propositional equality. + +=== The Burden of Proof + +Any claim of utility must show why working with the `+Echo+` wrapper is +better than directly pattern-matching on the Sigma type. If every proof +immediately unpacks the `+Echo+` and does standard Sigma-type +manipulation, the abstraction is leaky and pointless. + +=== Collapse Conditions + +If the `+Echo+` interface requires the user to manually manage the +underlying `+Σ+` structure to accomplish basic composition or mapping +tasks, the abstraction fails. + +=== Reinterpretation vs. Novelty + +The novelty must reside in the API and the categorical/compositional +properties exposed by the wrapper, demonstrating that `+Echo+` behaves +coherently under lossy operations in a way that bare Sigma types do not +automatically communicate. + +''''' + +=== Answer: the in-tree evidence + +This section is the index reviewers can walk to confirm Echo is not +"`renamed Σ`". It is organised under five demands a sceptic typically +makes. Each item points at a machine-checked Agda artefact (pinned in +`+proofs/agda/Smoke.agda+`), a doc, or both. Statements stay inside the +_narrowed_ claims of `+docs/retractions.adoc+` R-2026-05-18 — no "`full +universal property`", no "`graded comonad`", no "`model-independence`". + +==== 1. Irreversibility is a theorem family, not a property + +A raw `+Σ (x : A) (f x ≡ y)+` gives `+proj₁+` trivially; the user can +always extract the original `+x+`. The Echo programme proves that _no_ +section exists once specific lossy interfaces are applied. The witness +is a _family_ across five separate decoration layers: + +* `+EchoCharacteristic.no-section-collapse+` — no section of the +`+Bool → ⊤+` collapse map. +* `+EchoCharacteristic.no-section-visible+` — no section recovering the +pre-image from a visible output alone. +* `+EchoResidue.no-section-collapse-to-residue+` — weakening to a +residue is provably one-way. +* `+EchoLinear.no-section-weaken+` — the `+linear → affine+` mode shift +is one-way (defined as the residue lemma). +* `+EchoOrdinal.no-section-ordinal-collapse+` — ordinal collapse case. +* `+EchoEpistemicResidue.no-section-to-epistemic+` — epistemic-residue +case. + +All six are pinned in `+Smoke.agda+`. The family is what carries the +weight: each decoration _separately_ refuses the section that a raw Σ +would admit. See also `+docs/theorem-index.md+` and the prose write-up +at `+docs/characteristic.adoc+`. + +==== 2. Loss is graded, and downgrades cannot be reversed + +A raw Σ has no built-in notion of "`degrading from strict to loose`". +Echo equips the fibre with a lattice of grades and a monotone reindexing +along it. The two halves of the asymmetry are: + +* _Down-step is admissible._ `+EchoGraded.degrade-compose+` and +`+EchoGraded.degrade-via-join+` — the per-decoration composition law for +the loss-grade order. Same recipe lands at: +** `+EchoLinear.degradeMode-compose+` (linearity-mode order), +** `+EchoChoreo.applyChoreo-compose+` (role/reachability order), +** `+EchoAccess+` (graded access modality), +** `+EchoCost+` (cost-indexed refinement), +** `+EchoSearch+` (witness-search refinement). +* _Up-step is not._ `+no-section-weaken+` (item 1) is the same statement +on the other diagonal — once degraded, no inverse exists. + +Honest framing: this is a _thin-poset reindexing modality_, not a graded +comonad. The retraction at `+docs/retractions.adoc#R-2026-05-18+` +narrowed an earlier "`graded comonad`" claim. The reindexing modality is +the load-bearing structure and is the right answer to "`is Σ enough?`": +Σ alone gives neither the monotone reindex nor the no-section dual. + +==== 3. Echo is the homotopy fibre; bridges from other "`loss-tracker`" frameworks exist + +The categorical/identity claim is *deflationary* and owned in +`+docs/echo-types/establishment-plan.adoc+`: `+Echo f y+` is +_definitionally_ the homotopy fibre `+fib f y+` (HoTT book Def. 4.2.4). +The bridge is `+EchoFiberBridge.echo↔fib+`, both round-trips `+refl+` +(Pillar A; pinned in `+Smoke.agda+`). + +For the "`is this just a pullback`" question, +`+EchoPullback.echo-pullback-univ+` exhibits `+Echo f y+` as the +pullback of `+f+` along `+y : ⊤ → B+` with a _pointwise, +funext-relative_ mediator property. The retraction note in that module +is loud: this is *not* a full categorical universal property in the +absence of funext. Bridges from named neighbour frameworks land as +separate modules: + +* `+EchoFiberBridge.agda+` — homotopy fibre identity. +* `+EchoJanusBridge.agda+` — Janus-style reversible debugger bridge. +* `+EchoTropical.agda+` / `+AntiEchoTropical.agda+` — tropical semiring +/ argmin decomposition. +* `+EchoCNOBridge.agda+` — categorical neighbour bridge. +* `+EchoFiberCount.agda+` + `+EchoThermodynamics*.agda+` — finite-fibre +Landauer / Bennett correspondence. + +These are independent witnesses, not one universal theorem. The honest +verdict is "`Echo is _a_ canonical target with concrete bridges in`" +rather than "`Echo is _the_ terminal residue tracker by unique +mediator`". + +==== 4. The abstraction barrier (consumer-side) + +A raw `+Σ A (λ x → f x ≡ y)+` exposes `+proj₁+`, so a consumer can +always distinguish two preimages of the same output. The Echo interface +at the affine mode does not export that projection: the residue carrier +is contractible (`+EchoLinear.affine-canonical+`, `+affine-all-equal+`), +so any consumer assigns the same value to the weakened images of two +known-distinct linear echoes. + +*Status:* the consumer-side abstraction-barrier theorem is the one +genuine gap relative to the five demands. It is planned as +`+proofs/agda/EchoAbstractionBarrier.agda+` (Track B in the work plan). +The model-side counterpart — _carrier-parametricity_ over a fixed grade +poset — already lands as `+EchoRelModel+` (Pillar D, narrowed per +R-2026-05-18 from the original "`model-independence`" wording). + +==== 5. Canonical examples — what Σ would let through + +The example modules exhibit echo as the explanatory unit on real +artefacts: + +* `+EchoExampleParser+` — `+(())+` vs `+()()+` are two distinct echoes +at the same `+parses ≡ true+`. +* `+EchoExampleProvenance+` — distinct Bool-provenance rows collapse to +the same payload; the echo carries the lost annotation. +* `+EchoExampleAbsInt+` — `+{p1, p2}+` collapse to `+pos+` under sign +analysis; the echo retains which. +* `+EchoExampleSignAnalysis+`, `+EchoExampleTruncation+` — further +collapse-with-residue exhibits. +* `+EchoFiberCount+` + `+EchoThermodynamics*+` — finite-fibre Landauer +bound for the erasure cost. +* `+EchoEpistemicResidue+` — observation-discipline residue. + +Each is positive evidence. The matched _negative_ — a small raw-Σ +counter-program that would let the bug through — is planned as +`+proofs/agda/examples/EchoVsSigma.agda+` (Track C). Until that lands, +the "`raw Σ would leak`" claim is prose, not a checked artefact. + +''''' + +=== Cross-references + +* Gate 2 audit (closest reviewer touchpoint): +`+docs/characteristic.adoc+`. +* Theorem-by-theorem ledger: `+docs/theorem-index.md+`. +* Adjacency notes (per neighbour framework): `+docs/adjacency/+`. +* Honest scope of the establishment claim: +`+docs/echo-types/establishment-plan.adoc+` and +`+docs/echo-types/paper.adoc+` §"`Reframing note`". +* AsciiDoc reviewer companion to this file: +`+docs/echo-types/sigma-distinctness-map.adoc+`. +* Companion skepticisms: `+is-this-just-fibers.md+`, +`+what-is-actually-new.md+`, `+failure-conditions.md+`. diff --git a/core/skepticisms/is-this-just-sigma-types.md b/core/skepticisms/is-this-just-sigma-types.md deleted file mode 100644 index 282fd92..0000000 --- a/core/skepticisms/is-this-just-sigma-types.md +++ /dev/null @@ -1,164 +0,0 @@ - - -# Is this just Sigma Types? - -## The Skeptical Position -Yes, at the lowest level of Agda code, this is `Σ (x : A) , (f x ≡ y)`. -It relies entirely on the standard dependent pair type and propositional -equality. - -## The Burden of Proof -Any claim of utility must show why working with the `Echo` wrapper is -better than directly pattern-matching on the Sigma type. If every proof -immediately unpacks the `Echo` and does standard Sigma-type manipulation, -the abstraction is leaky and pointless. - -## Collapse Conditions -If the `Echo` interface requires the user to manually manage the -underlying `Σ` structure to accomplish basic composition or mapping -tasks, the abstraction fails. - -## Reinterpretation vs. Novelty -The novelty must reside in the API and the categorical/compositional -properties exposed by the wrapper, demonstrating that `Echo` behaves -coherently under lossy operations in a way that bare Sigma types do not -automatically communicate. - ---- - -## Answer: the in-tree evidence - -This section is the index reviewers can walk to confirm Echo is not -"renamed Σ". It is organised under five demands a sceptic typically -makes. Each item points at a machine-checked Agda artefact (pinned in -`proofs/agda/Smoke.agda`), a doc, or both. Statements stay inside the -*narrowed* claims of `docs/retractions.adoc` R-2026-05-18 — no "full -universal property", no "graded comonad", no "model-independence". - -### 1. Irreversibility is a theorem family, not a property - -A raw `Σ (x : A) (f x ≡ y)` gives `proj₁` trivially; the user can -always extract the original `x`. The Echo programme proves that *no* -section exists once specific lossy interfaces are applied. The witness -is a *family* across five separate decoration layers: - -- `EchoCharacteristic.no-section-collapse` — no section of the - `Bool → ⊤` collapse map. -- `EchoCharacteristic.no-section-visible` — no section recovering the - pre-image from a visible output alone. -- `EchoResidue.no-section-collapse-to-residue` — weakening to a residue - is provably one-way. -- `EchoLinear.no-section-weaken` — the `linear → affine` mode shift is - one-way (defined as the residue lemma). -- `EchoOrdinal.no-section-ordinal-collapse` — ordinal collapse case. -- `EchoEpistemicResidue.no-section-to-epistemic` — epistemic-residue - case. - -All six are pinned in `Smoke.agda`. The family is what carries the -weight: each decoration *separately* refuses the section that a raw Σ -would admit. See also `docs/theorem-index.md` and the prose write-up at -`docs/characteristic.adoc`. - -### 2. Loss is graded, and downgrades cannot be reversed - -A raw Σ has no built-in notion of "degrading from strict to loose". -Echo equips the fibre with a lattice of grades and a monotone reindexing -along it. The two halves of the asymmetry are: - -- *Down-step is admissible.* `EchoGraded.degrade-compose` and - `EchoGraded.degrade-via-join` — the per-decoration composition law - for the loss-grade order. Same recipe lands at: - - `EchoLinear.degradeMode-compose` (linearity-mode order), - - `EchoChoreo.applyChoreo-compose` (role/reachability order), - - `EchoAccess` (graded access modality), - - `EchoCost` (cost-indexed refinement), - - `EchoSearch` (witness-search refinement). -- *Up-step is not.* `no-section-weaken` (item 1) is the same - statement on the other diagonal — once degraded, no inverse exists. - -Honest framing: this is a *thin-poset reindexing modality*, not a -graded comonad. The retraction at `docs/retractions.adoc#R-2026-05-18` -narrowed an earlier "graded comonad" claim. The reindexing modality is -the load-bearing structure and is the right answer to "is Σ enough?": -Σ alone gives neither the monotone reindex nor the no-section dual. - -### 3. Echo is the homotopy fibre; bridges from other "loss-tracker" frameworks exist - -The categorical/identity claim is **deflationary** and owned in -`docs/echo-types/establishment-plan.adoc`: `Echo f y` is *definitionally* -the homotopy fibre `fib f y` (HoTT book Def. 4.2.4). The bridge is -`EchoFiberBridge.echo↔fib`, both round-trips `refl` (Pillar A; pinned -in `Smoke.agda`). - -For the "is this just a pullback" question, `EchoPullback.echo-pullback-univ` -exhibits `Echo f y` as the pullback of `f` along `y : ⊤ → B` with a -*pointwise, funext-relative* mediator property. The retraction note in -that module is loud: this is **not** a full categorical universal -property in the absence of funext. Bridges from named neighbour -frameworks land as separate modules: - -- `EchoFiberBridge.agda` — homotopy fibre identity. -- `EchoJanusBridge.agda` — Janus-style reversible debugger bridge. -- `EchoTropical.agda` / `AntiEchoTropical.agda` — tropical - semiring / argmin decomposition. -- `EchoCNOBridge.agda` — categorical neighbour bridge. -- `EchoFiberCount.agda` + `EchoThermodynamics*.agda` — finite-fibre - Landauer / Bennett correspondence. - -These are independent witnesses, not one universal theorem. The honest -verdict is "Echo is *a* canonical target with concrete bridges in" -rather than "Echo is *the* terminal residue tracker by unique mediator". - -### 4. The abstraction barrier (consumer-side) - -A raw `Σ A (λ x → f x ≡ y)` exposes `proj₁`, so a consumer can always -distinguish two preimages of the same output. The Echo interface at the -affine mode does not export that projection: the residue carrier is -contractible (`EchoLinear.affine-canonical`, `affine-all-equal`), so -any consumer assigns the same value to the weakened images of two -known-distinct linear echoes. - -**Status:** the consumer-side abstraction-barrier theorem is the one -genuine gap relative to the five demands. It is planned as -`proofs/agda/EchoAbstractionBarrier.agda` (Track B in the work plan). -The model-side counterpart — *carrier-parametricity* over a fixed -grade poset — already lands as `EchoRelModel` (Pillar D, narrowed per -R-2026-05-18 from the original "model-independence" wording). - -### 5. Canonical examples — what Σ would let through - -The example modules exhibit echo as the explanatory unit on real -artefacts: - -- `EchoExampleParser` — `(())` vs `()()` are two distinct echoes at the - same `parses ≡ true`. -- `EchoExampleProvenance` — distinct Bool-provenance rows collapse to - the same payload; the echo carries the lost annotation. -- `EchoExampleAbsInt` — `{p1, p2}` collapse to `pos` under sign - analysis; the echo retains which. -- `EchoExampleSignAnalysis`, `EchoExampleTruncation` — further - collapse-with-residue exhibits. -- `EchoFiberCount` + `EchoThermodynamics*` — finite-fibre Landauer - bound for the erasure cost. -- `EchoEpistemicResidue` — observation-discipline residue. - -Each is positive evidence. The matched *negative* — a small raw-Σ -counter-program that would let the bug through — is planned as -`proofs/agda/examples/EchoVsSigma.agda` (Track C). Until that lands, -the "raw Σ would leak" claim is prose, not a checked artefact. - ---- - -## Cross-references - -- Gate 2 audit (closest reviewer touchpoint): - `docs/characteristic.adoc`. -- Theorem-by-theorem ledger: `docs/theorem-index.md`. -- Adjacency notes (per neighbour framework): `docs/adjacency/`. -- Honest scope of the establishment claim: - `docs/echo-types/establishment-plan.adoc` and - `docs/echo-types/paper.adoc` §"Reframing note". -- AsciiDoc reviewer companion to this file: - `docs/echo-types/sigma-distinctness-map.adoc`. -- Companion skepticisms: `is-this-just-fibers.md`, `what-is-actually-new.md`, - `failure-conditions.md`. diff --git a/core/skepticisms/what-is-actually-new.adoc b/core/skepticisms/what-is-actually-new.adoc new file mode 100644 index 0000000..07b80bb --- /dev/null +++ b/core/skepticisms/what-is-actually-new.adoc @@ -0,0 +1,29 @@ +== What is actually new? + +=== The Skeptical Position + +Type theory has had fibers, sigma types, and pullbacks since its +inception. Categorical logic has well-understood models for +irreversibility. + +=== The Burden of Proof + +We must prove that "`Echo Types`" provide a formally verified vocabulary +for _partial recovery_ and _provenance_ that is significantly more +ergonomic or insightful than existing encodings. + +=== Collapse Conditions + +If the "`Echo`" approach does not scale to practical examples (like +lossy boolean classification or quotienting) without degenerating into +unreadable equality proofs, it is not a useful contribution. If it is +exactly isomorphic to a known, established approach (e.g., standard +refinement types) without offering new insights, it is redundant. + +=== Reinterpretation vs. Novelty + +The mathematical foundation is entirely standard. The potential novelty +is the formalisation of "`structured loss`"—treating the irreversible +destruction of information as a first-class object that leaves a +proof-relevant, computable residue, rather than merely a forgotten +input. diff --git a/core/skepticisms/what-is-actually-new.md b/core/skepticisms/what-is-actually-new.md deleted file mode 100644 index 255b1d6..0000000 --- a/core/skepticisms/what-is-actually-new.md +++ /dev/null @@ -1,15 +0,0 @@ - - -# What is actually new? - -## The Skeptical Position -Type theory has had fibers, sigma types, and pullbacks since its inception. Categorical logic has well-understood models for irreversibility. - -## The Burden of Proof -We must prove that "Echo Types" provide a formally verified vocabulary for *partial recovery* and *provenance* that is significantly more ergonomic or insightful than existing encodings. - -## Collapse Conditions -If the "Echo" approach does not scale to practical examples (like lossy boolean classification or quotienting) without degenerating into unreadable equality proofs, it is not a useful contribution. If it is exactly isomorphic to a known, established approach (e.g., standard refinement types) without offering new insights, it is redundant. - -## Reinterpretation vs. Novelty -The mathematical foundation is entirely standard. The potential novelty is the formalisation of "structured loss"—treating the irreversible destruction of information as a first-class object that leaves a proof-relevant, computable residue, rather than merely a forgotten input. diff --git a/docs/COMPREHENSIVE_DOCUMENTATION.adoc b/docs/COMPREHENSIVE_DOCUMENTATION.adoc new file mode 100644 index 0000000..d956dcf --- /dev/null +++ b/docs/COMPREHENSIVE_DOCUMENTATION.adoc @@ -0,0 +1,441 @@ +== Echo Types - JanusKey Comprehensive Documentation + +=== Table of Contents + +==== Section 3: Advanced Theoretical Foundations + +3.1 Echo Type Theory Overview 3.2 Categorical Semantics 3.3 Temporal +Logic Extensions 3.4 Graded Modal Types 3.5 Homotopy Type Theory +Connections + +==== Section 2: Practical Implementation Guide + +2.1 JanusKey Architecture Overview 2.2 Echo Types in Rust Implementation +2.3 Integration Patterns 2.4 Performance Considerations 2.5 Debugging +and Troubleshooting + +==== Section 1: Core Proofs and Verification + +1.1 Formal Verification of JanusKey 1.2 Distributed Reversibility Proofs +1.3 Resource-Bounded Reversibility 1.4 Transaction Isolation Proofs 1.5 +CRDT Integration Proofs + +''''' + +=== Section 3: Advanced Theoretical Foundations + +==== 3.1 Echo Type Theory Overview + +*Definition*: Echo types formalize fibers over functions: + +[source,agda] +---- +Echo f y = Σ (x : A) , (f x ≡ y) +---- + +*Key Properties*: - *Fiber Introduction*: +`+echo-intro : ∀ x → Echo f (f x)+` - *Action on Fibers*: +`+map-over : MapOver f f' → Echo f y → Echo f' y+` - *Composition*: +`+map-over-comp :+` composition preserves echo structure - *Identity*: +`+map-over-id :+` identity operation preserves echoes + +*Theoretical Significance*: - Provides constructive proof of +reversibility - Enables compositional reasoning about operations - Forms +foundation for formal verification + +==== 3.2 Categorical Semantics + +*Echo Category Definition*: + +[source,agda] +---- +echo-category : Category EchoCat where + Ob = FileSystem + Hom A B = Echo (some-op) B + id = echo-intro id + _∘_ = map-over +---- + +*Key Theorems*: - `+echo-functoriality+`: Echo types form a functor - +`+echo-monad+`: Echo types with appropriate bind/return form a monad - +`+echo-adjunction+`: Relationship with other categorical structures + +*Applications*: - Higher-level abstraction for operation composition - +Proof reuse through categorical properties - Integration with other +categorical frameworks + +==== 3.3 Temporal Logic Extensions + +*Temporal Operators*: + +[source,agda] +---- +□-reversible : ∀ {op} → (□ (Echo op s)) → (□ (∃ s' , undo op s ≡ s')) +⋄-reversible : ∀ {op} → (⋄ (Echo op s)) → (⋄ (∃ s' , undo op s ≡ s')) +---- + +*Key Concepts*: - *Always Reversible*: `+□ (Echo op s)+` - operation is +always reversible - *Eventually Reversible*: `+⋄ (Echo op s)+` - +operation becomes reversible - *Until Reversible*: +`+Echo op s U Echo op' s'+` - reversibility until condition + +*Proof Patterns*: - Inductive proofs over operation sequences - Temporal +logic model checking - Integration with linear temporal logic + +==== 3.4 Graded Modal Types for Permissions + +*Permission Grading*: + +[source,agda] +---- +Permission : Set where + Read : Permission + Write : Permission + Execute : Permission + None : Permission + +permission-lattice : Lattice Permission where + _∨_ = max-permission + _∧_ = min-permission +---- + +*Permission-Preserving Echoes*: + +[source,agda] +---- +permission-preserving-echo : ∀ {p} {op : PermissionAwareOp p} → + Echo op s → + (permissions (undo op s) ≡ permissions s) +---- + +*Applications*: - Fine-grained access control - Security policy +enforcement - Audit trail integrity + +==== 3.5 Homotopy Type Theory Connections + +*Higher Dimensional Echoes*: + +[source,agda] +---- +homotopy-echo : ∀ {A B} (f : A → B) (y : B) → + Echo f y → (x : A) → (f x ≡ y) → (x ≡ proj₁ (echo-witness)) +---- + +*Key Concepts*: - Proof relevance in reversibility - Higher inductive +types for complex operations - Univalence principle applications - +Homotopy levels of reversibility + +''''' + +=== Section 2: Practical Implementation Guide + +==== 2.1 JanusKey Architecture Overview + +*Core Components*: + +.... ++----------------------------+ +| JanusKey CLI | <-- jk delete, jk modify, jk move ++----------------------------+ +| Operation Layer | <-- Generates inverse metadata ++----------------------------+ +| Transaction Manager | <-- Groups ops, commit/rollback ++----------------------------+ +| Metadata Store | <-- Append-only operation log ++----------------------------+ +| Content-Addressed Storage | <-- SHA256, deduplication ++----------------------------+ +.... + +*Echo Type Integration Points*: - *Content Store* → Echo fiber elements +(original states) - *Metadata Store* → Echo witnesses (proofs of +transformation) - *Operation Log* → Sequence of echo types - *Undo +Operation* → Echo projection (extract original state) + +==== 2.2 Echo Types in Rust Implementation + +*Rust Implementation Pattern*: + +[source,rust] +---- +// Echo type representation in Rust +struct EchoWitness { + original: A, // Original state (x) + result: B, // Result state (y) + proof: Proof, // Proof that f(x) = y +} + +// JanusKey delete operation with echo witness +struct DeleteOperation { + path: PathBuf, + echo_witness: EchoWitness, +} +---- + +*Key Implementation Strategies*: - *Type-Level Encoding*: Use Rust +traits to encode echo type properties - *Runtime Verification*: Check +echo type invariants at runtime - *Zero-Cost Abstractions*: Ensure no +performance overhead - *FFI Integration*: Connect Agda proofs with Rust +implementation + +==== 2.3 Integration Patterns + +*Pattern 1: Direct Embedding* + +[source,rust] +---- +// Directly embed Agda-generated proofs in Rust +#[agda_proof] +fn delete_reversible_proof() -> Proof { + // Agda-generated proof code +} +---- + +*Pattern 2: Runtime Verification* + +[source,rust] +---- +// Verify echo type properties at runtime +fn verify_echo_witness(witness: &EchoWitness) -> Result<(), VerificationError> { + // Check that f(witness.original) == witness.result + // Verify proof structure +} +---- + +*Pattern 3: Hybrid Approach* + +[source,rust] +---- +// Use Agda for critical proofs, Rust for performance +struct HybridOperation { + agda_proof: AgdaProofHandle, // Opaque handle to Agda proof + rust_implementation: Box, // Rust implementation +} +---- + +==== 2.4 Performance Considerations + +*Performance Profile*: | Operation | Echo Overhead | Verification Time | +Memory Impact | |———–|—————|——————-|—————| | Delete | 1.05x | 2-5ms | +Content size | | Create | 1.02x | 1-3ms | Metadata size | | Modify | +1.10x | 3-8ms | Content size | | Move | 1.03x | 2-4ms | Minimal | + +*Optimization Strategies*: - *Lazy Verification*: Defer proof checking +until needed - *Caching*: Cache verification results for common +operations - *Incremental Proofs*: Build proofs incrementally for +transactions - *Parallel Verification*: Verify multiple operations in +parallel + +==== 2.5 Debugging and Troubleshooting + +*Common Issues and Solutions*: + +*Issue: Proof Verification Failure* + +.... +Error: Echo witness verification failed for operation Delete(/tmp/file.txt) +Cause: Content hash mismatch between original and stored content +Solution: Check content store integrity, verify SHA256 hashes +.... + +*Issue: Transaction Rollback Failure* + +.... +Error: Cannot rollback transaction TXN-123: missing echo witness for operation 2/5 +Cause: Incomplete echo witness chain in transaction +Solution: Rebuild transaction from operation log, regenerate witnesses +.... + +*Issue: Performance Degradation* + +.... +Warning: Echo verification taking >100ms for large transactions +Cause: Linear verification of operation sequence +Solution: Enable parallel verification, use incremental proofs +.... + +*Debugging Tools*: - `+jk verify --echo+`: Verify echo type properties - +`+jk debug witnesses+`: Inspect echo witnesses - +`+jk profile verification+`: Profile verification performance - +`+jk check consistency+`: Check filesystem consistency + +''''' + +=== Section 1: Core Proofs and Verification + +==== 1.1 Formal Verification of JanusKey + +*Verification Targets*: + +[source,agda] +---- +-- Rust function specification +rust-spec : ∀ (op : RustOperation) → Specification op + +-- Correspondence proof +rust-agda-correspondence : ∀ (op : RustOperation) → + rust-spec op ≡ agda-spec (echo-op op) +---- + +*Verification Approach*: 1. *Extract Specifications*: From +`+EchoJanusBridge.agda+` 2. *Annotate Rust Code*: With formal +specifications 3. *Automated Verification*: Using Prusti/Creusot 4. +*Manual Proofs*: For complex properties 5. *Integration Testing*: +End-to-end verification + +*Key Theorems*: + +[source,agda] +---- +rust-delete-correctness : ∀ (path : FilePath) → + rust-delete path ≡ agda-delete path + +rust-undo-correctness : ∀ (op : Operation) → + rust-undo op ≡ agda-undo (echo-op op) +---- + +==== 1.2 Distributed Reversibility Proofs + +*Distributed Model*: + +[source,agda] +---- +DistributedOp : Set where + Local : Operation → DistributedOp + Remote : NodeID → Operation → DistributedOp + Broadcast : Operation → DistributedOp +---- + +*Key Theorems*: + +[source,agda] +---- +distributed-echo-consistency : ∀ {N} → (nodes : Fin N → NodeState) → + (op : DistributedOp) → + Echo (distributed-execute op) (final-state nodes) + +distributed-undo-commutativity : ∀ {op1 op2} → + Echo op1 s1 → Echo op2 s2 → + undo op1 ∘ undo op2 ≡ undo op2 ∘ undo op1 + +network-partition-recovery : ∀ {op} → + Echo op s → + (∃ s' , recover-from-partition op s ≡ s') +---- + +*Applications*: - Fault-tolerant distributed operations - Conflict +resolution in partitioned networks - Eventual consistency with +reversibility + +==== 1.3 Resource-Bounded Reversibility + +*Bounded Operations*: + +[source,agda] +---- +BoundedOp : ℕ → Set where + StorageBound : (quota : ℕ) → Operation → BoundedOp quota + TimeBound : (timeout : ℕ) → Operation → BoundedOp timeout +---- + +*Key Theorems*: + +[source,agda] +---- +bounded-storage-reversibility : ∀ (quota : ℕ) → + (op : BoundedOp quota) → + (s : FileSystem) → + Echo (execute-op op) (op s) × + (storage-used (undo op) ≤ quota) + +time-bounded-reversibility : ∀ (timeout : ℕ) → + (op : BoundedOp timeout) → + Echo (execute-op op) (op s) × + (verification-time (undo op) ≤ timeout) +---- + +*Resource Management Strategies*: - *Quota Enforcement*: Prevent +operations exceeding bounds - *Priority-Based Reversal*: Reverse +critical operations first - *Incremental Storage*: Store deltas instead +of full content - *Compression*: Apply compression to stored content + +==== 1.4 Transaction Isolation Proofs + +*Isolation Levels*: + +[source,agda] +---- +IsolationLevel : Set where + ReadUncommitted : IsolationLevel + ReadCommitted : IsolationLevel + RepeatableRead : IsolationLevel + Serializable : IsolationLevel +---- + +*Key Theorems*: + +[source,agda] +---- +serializable-reversibility : ∀ {txn : Transaction} → + Serializable txn → + Echo (execute-txn txn) (final-state txn) + +repeatable-read-reversibility : ∀ {txn : Transaction} → + RepeatableRead txn → + Echo (execute-txn txn) (final-state txn) × + (∀ op ∈ txn , echo-witness op ≡ original-witness op) +---- + +*Isolation Properties*: | Level | Reversibility Guarantee | Echo Type +Property | |——-|————————|——————–| | Read Uncommitted | Basic reversal | +Simple echo witness | | Read Committed | Committed state reversal | +Stable echo witness | | Repeatable Read | Repeatable reversal | +Idempotent echo witness | | Serializable | Full serializability | +Composable echo witnesses | + +==== 1.5 CRDT Integration Proofs + +*CRDT Model*: + +[source,agda] +---- +CRDT : Set where + GSet : (A : Set) → CRDT -- Grow-only set + ORSet : (A : Set) → CRDT -- Observable-remove set + PNCounter : CRDT -- Positive-negative counter +---- + +*Key Theorems*: + +[source,agda] +---- +crdt-echo-correspondence : ∀ {C : CRDT} → + (op : CRDTOp C) → + Echo (crdt-apply op) (crdt-state-after op) + +crdt-undo-commutativity : ∀ {C : CRDT} → + (op1 op2 : CRDTOp C) → + undo op1 ∘ undo op2 ≡ undo op2 ∘ undo op1 + +crdt-convergence : ∀ {C : CRDT} → + (replica1 replica2 : Replica C) → + (∃ state , converge replica1 ≡ state ≡ converge replica2) +---- + +*Applications*: - Collaborative editing with undo - Distributed data +structures - Conflict-free merging - Offline-first applications + +''''' + +=== Conclusion + +This comprehensive documentation provides: + +*Section 3*: Advanced theoretical foundations for understanding echo +types at a deep level *Section 2*: Practical guidance for implementing +echo types in real-world systems like JanusKey *Section 1*: Core proofs +and verification strategies to ensure mathematical correctness + +The documentation is structured to support both theoretical exploration +and practical implementation, with clear connections between abstract +concepts and concrete code. diff --git a/docs/COMPREHENSIVE_DOCUMENTATION.md b/docs/COMPREHENSIVE_DOCUMENTATION.md deleted file mode 100644 index f0fcee0..0000000 --- a/docs/COMPREHENSIVE_DOCUMENTATION.md +++ /dev/null @@ -1,420 +0,0 @@ - - -# Echo Types - JanusKey Comprehensive Documentation - -## Table of Contents - -### Section 3: Advanced Theoretical Foundations -3.1 Echo Type Theory Overview -3.2 Categorical Semantics -3.3 Temporal Logic Extensions -3.4 Graded Modal Types -3.5 Homotopy Type Theory Connections - -### Section 2: Practical Implementation Guide -2.1 JanusKey Architecture Overview -2.2 Echo Types in Rust Implementation -2.3 Integration Patterns -2.4 Performance Considerations -2.5 Debugging and Troubleshooting - -### Section 1: Core Proofs and Verification -1.1 Formal Verification of JanusKey -1.2 Distributed Reversibility Proofs -1.3 Resource-Bounded Reversibility -1.4 Transaction Isolation Proofs -1.5 CRDT Integration Proofs - ---- - -## Section 3: Advanced Theoretical Foundations - -### 3.1 Echo Type Theory Overview - -**Definition**: Echo types formalize fibers over functions: -```agda -Echo f y = Σ (x : A) , (f x ≡ y) -``` - -**Key Properties**: -- **Fiber Introduction**: `echo-intro : ∀ x → Echo f (f x)` -- **Action on Fibers**: `map-over : MapOver f f' → Echo f y → Echo f' y` -- **Composition**: `map-over-comp :` composition preserves echo structure -- **Identity**: `map-over-id :` identity operation preserves echoes - -**Theoretical Significance**: -- Provides constructive proof of reversibility -- Enables compositional reasoning about operations -- Forms foundation for formal verification - -### 3.2 Categorical Semantics - -**Echo Category Definition**: -```agda -echo-category : Category EchoCat where - Ob = FileSystem - Hom A B = Echo (some-op) B - id = echo-intro id - _∘_ = map-over -``` - -**Key Theorems**: -- `echo-functoriality`: Echo types form a functor -- `echo-monad`: Echo types with appropriate bind/return form a monad -- `echo-adjunction`: Relationship with other categorical structures - -**Applications**: -- Higher-level abstraction for operation composition -- Proof reuse through categorical properties -- Integration with other categorical frameworks - -### 3.3 Temporal Logic Extensions - -**Temporal Operators**: -```agda -□-reversible : ∀ {op} → (□ (Echo op s)) → (□ (∃ s' , undo op s ≡ s')) -⋄-reversible : ∀ {op} → (⋄ (Echo op s)) → (⋄ (∃ s' , undo op s ≡ s')) -``` - -**Key Concepts**: -- **Always Reversible**: `□ (Echo op s)` - operation is always reversible -- **Eventually Reversible**: `⋄ (Echo op s)` - operation becomes reversible -- **Until Reversible**: `Echo op s U Echo op' s'` - reversibility until condition - -**Proof Patterns**: -- Inductive proofs over operation sequences -- Temporal logic model checking -- Integration with linear temporal logic - -### 3.4 Graded Modal Types for Permissions - -**Permission Grading**: -```agda -Permission : Set where - Read : Permission - Write : Permission - Execute : Permission - None : Permission - -permission-lattice : Lattice Permission where - _∨_ = max-permission - _∧_ = min-permission -``` - -**Permission-Preserving Echoes**: -```agda -permission-preserving-echo : ∀ {p} {op : PermissionAwareOp p} → - Echo op s → - (permissions (undo op s) ≡ permissions s) -``` - -**Applications**: -- Fine-grained access control -- Security policy enforcement -- Audit trail integrity - -### 3.5 Homotopy Type Theory Connections - -**Higher Dimensional Echoes**: -```agda -homotopy-echo : ∀ {A B} (f : A → B) (y : B) → - Echo f y → (x : A) → (f x ≡ y) → (x ≡ proj₁ (echo-witness)) -``` - -**Key Concepts**: -- Proof relevance in reversibility -- Higher inductive types for complex operations -- Univalence principle applications -- Homotopy levels of reversibility - ---- - -## Section 2: Practical Implementation Guide - -### 2.1 JanusKey Architecture Overview - -**Core Components**: -``` -+----------------------------+ -| JanusKey CLI | <-- jk delete, jk modify, jk move -+----------------------------+ -| Operation Layer | <-- Generates inverse metadata -+----------------------------+ -| Transaction Manager | <-- Groups ops, commit/rollback -+----------------------------+ -| Metadata Store | <-- Append-only operation log -+----------------------------+ -| Content-Addressed Storage | <-- SHA256, deduplication -+----------------------------+ -``` - -**Echo Type Integration Points**: -- **Content Store** → Echo fiber elements (original states) -- **Metadata Store** → Echo witnesses (proofs of transformation) -- **Operation Log** → Sequence of echo types -- **Undo Operation** → Echo projection (extract original state) - -### 2.2 Echo Types in Rust Implementation - -**Rust Implementation Pattern**: -```rust -// Echo type representation in Rust -struct EchoWitness { - original: A, // Original state (x) - result: B, // Result state (y) - proof: Proof, // Proof that f(x) = y -} - -// JanusKey delete operation with echo witness -struct DeleteOperation { - path: PathBuf, - echo_witness: EchoWitness, -} -``` - -**Key Implementation Strategies**: -- **Type-Level Encoding**: Use Rust traits to encode echo type properties -- **Runtime Verification**: Check echo type invariants at runtime -- **Zero-Cost Abstractions**: Ensure no performance overhead -- **FFI Integration**: Connect Agda proofs with Rust implementation - -### 2.3 Integration Patterns - -**Pattern 1: Direct Embedding** -```rust -// Directly embed Agda-generated proofs in Rust -#[agda_proof] -fn delete_reversible_proof() -> Proof { - // Agda-generated proof code -} -``` - -**Pattern 2: Runtime Verification** -```rust -// Verify echo type properties at runtime -fn verify_echo_witness(witness: &EchoWitness) -> Result<(), VerificationError> { - // Check that f(witness.original) == witness.result - // Verify proof structure -} -``` - -**Pattern 3: Hybrid Approach** -```rust -// Use Agda for critical proofs, Rust for performance -struct HybridOperation { - agda_proof: AgdaProofHandle, // Opaque handle to Agda proof - rust_implementation: Box, // Rust implementation -} -``` - -### 2.4 Performance Considerations - -**Performance Profile**: -| Operation | Echo Overhead | Verification Time | Memory Impact | -|-----------|---------------|-------------------|---------------| -| Delete | 1.05x | 2-5ms | Content size | -| Create | 1.02x | 1-3ms | Metadata size | -| Modify | 1.10x | 3-8ms | Content size | -| Move | 1.03x | 2-4ms | Minimal | - -**Optimization Strategies**: -- **Lazy Verification**: Defer proof checking until needed -- **Caching**: Cache verification results for common operations -- **Incremental Proofs**: Build proofs incrementally for transactions -- **Parallel Verification**: Verify multiple operations in parallel - -### 2.5 Debugging and Troubleshooting - -**Common Issues and Solutions**: - -**Issue: Proof Verification Failure** -``` -Error: Echo witness verification failed for operation Delete(/tmp/file.txt) -Cause: Content hash mismatch between original and stored content -Solution: Check content store integrity, verify SHA256 hashes -``` - -**Issue: Transaction Rollback Failure** -``` -Error: Cannot rollback transaction TXN-123: missing echo witness for operation 2/5 -Cause: Incomplete echo witness chain in transaction -Solution: Rebuild transaction from operation log, regenerate witnesses -``` - -**Issue: Performance Degradation** -``` -Warning: Echo verification taking >100ms for large transactions -Cause: Linear verification of operation sequence -Solution: Enable parallel verification, use incremental proofs -``` - -**Debugging Tools**: -- `jk verify --echo`: Verify echo type properties -- `jk debug witnesses`: Inspect echo witnesses -- `jk profile verification`: Profile verification performance -- `jk check consistency`: Check filesystem consistency - ---- - -## Section 1: Core Proofs and Verification - -### 1.1 Formal Verification of JanusKey - -**Verification Targets**: -```agda --- Rust function specification -rust-spec : ∀ (op : RustOperation) → Specification op - --- Correspondence proof -rust-agda-correspondence : ∀ (op : RustOperation) → - rust-spec op ≡ agda-spec (echo-op op) -``` - -**Verification Approach**: -1. **Extract Specifications**: From `EchoJanusBridge.agda` -2. **Annotate Rust Code**: With formal specifications -3. **Automated Verification**: Using Prusti/Creusot -4. **Manual Proofs**: For complex properties -5. **Integration Testing**: End-to-end verification - -**Key Theorems**: -```agda -rust-delete-correctness : ∀ (path : FilePath) → - rust-delete path ≡ agda-delete path - -rust-undo-correctness : ∀ (op : Operation) → - rust-undo op ≡ agda-undo (echo-op op) -``` - -### 1.2 Distributed Reversibility Proofs - -**Distributed Model**: -```agda -DistributedOp : Set where - Local : Operation → DistributedOp - Remote : NodeID → Operation → DistributedOp - Broadcast : Operation → DistributedOp -``` - -**Key Theorems**: -```agda -distributed-echo-consistency : ∀ {N} → (nodes : Fin N → NodeState) → - (op : DistributedOp) → - Echo (distributed-execute op) (final-state nodes) - -distributed-undo-commutativity : ∀ {op1 op2} → - Echo op1 s1 → Echo op2 s2 → - undo op1 ∘ undo op2 ≡ undo op2 ∘ undo op1 - -network-partition-recovery : ∀ {op} → - Echo op s → - (∃ s' , recover-from-partition op s ≡ s') -``` - -**Applications**: -- Fault-tolerant distributed operations -- Conflict resolution in partitioned networks -- Eventual consistency with reversibility - -### 1.3 Resource-Bounded Reversibility - -**Bounded Operations**: -```agda -BoundedOp : ℕ → Set where - StorageBound : (quota : ℕ) → Operation → BoundedOp quota - TimeBound : (timeout : ℕ) → Operation → BoundedOp timeout -``` - -**Key Theorems**: -```agda -bounded-storage-reversibility : ∀ (quota : ℕ) → - (op : BoundedOp quota) → - (s : FileSystem) → - Echo (execute-op op) (op s) × - (storage-used (undo op) ≤ quota) - -time-bounded-reversibility : ∀ (timeout : ℕ) → - (op : BoundedOp timeout) → - Echo (execute-op op) (op s) × - (verification-time (undo op) ≤ timeout) -``` - -**Resource Management Strategies**: -- **Quota Enforcement**: Prevent operations exceeding bounds -- **Priority-Based Reversal**: Reverse critical operations first -- **Incremental Storage**: Store deltas instead of full content -- **Compression**: Apply compression to stored content - -### 1.4 Transaction Isolation Proofs - -**Isolation Levels**: -```agda -IsolationLevel : Set where - ReadUncommitted : IsolationLevel - ReadCommitted : IsolationLevel - RepeatableRead : IsolationLevel - Serializable : IsolationLevel -``` - -**Key Theorems**: -```agda -serializable-reversibility : ∀ {txn : Transaction} → - Serializable txn → - Echo (execute-txn txn) (final-state txn) - -repeatable-read-reversibility : ∀ {txn : Transaction} → - RepeatableRead txn → - Echo (execute-txn txn) (final-state txn) × - (∀ op ∈ txn , echo-witness op ≡ original-witness op) -``` - -**Isolation Properties**: -| Level | Reversibility Guarantee | Echo Type Property | -|-------|------------------------|--------------------| -| Read Uncommitted | Basic reversal | Simple echo witness | -| Read Committed | Committed state reversal | Stable echo witness | -| Repeatable Read | Repeatable reversal | Idempotent echo witness | -| Serializable | Full serializability | Composable echo witnesses | - -### 1.5 CRDT Integration Proofs - -**CRDT Model**: -```agda -CRDT : Set where - GSet : (A : Set) → CRDT -- Grow-only set - ORSet : (A : Set) → CRDT -- Observable-remove set - PNCounter : CRDT -- Positive-negative counter -``` - -**Key Theorems**: -```agda -crdt-echo-correspondence : ∀ {C : CRDT} → - (op : CRDTOp C) → - Echo (crdt-apply op) (crdt-state-after op) - -crdt-undo-commutativity : ∀ {C : CRDT} → - (op1 op2 : CRDTOp C) → - undo op1 ∘ undo op2 ≡ undo op2 ∘ undo op1 - -crdt-convergence : ∀ {C : CRDT} → - (replica1 replica2 : Replica C) → - (∃ state , converge replica1 ≡ state ≡ converge replica2) -``` - -**Applications**: -- Collaborative editing with undo -- Distributed data structures -- Conflict-free merging -- Offline-first applications - ---- - -## Conclusion - -This comprehensive documentation provides: - -**Section 3**: Advanced theoretical foundations for understanding echo types at a deep level -**Section 2**: Practical guidance for implementing echo types in real-world systems like JanusKey -**Section 1**: Core proofs and verification strategies to ensure mathematical correctness - -The documentation is structured to support both theoretical exploration and practical implementation, with clear connections between abstract concepts and concrete code. \ No newline at end of file diff --git a/docs/STABILITY_ANALYSIS.adoc b/docs/STABILITY_ANALYSIS.adoc new file mode 100644 index 0000000..56e1e07 --- /dev/null +++ b/docs/STABILITY_ANALYSIS.adoc @@ -0,0 +1,317 @@ +== Echo Types Stability Analysis + +=== Executive Summary + +*Current Stability Rating: B+ (Stable but Evolving)* + +Echo types demonstrate *strong mathematical foundation* with +*comprehensive proof coverage* across multiple domains. The core theory +is stable, but the ecosystem is actively evolving with new applications +and integrations. + +=== Stability Assessment Framework + +==== 1. Core Theory Stability: A (Mature and Proven) + +*Foundational Proofs:* - ✅ Basic echo type definition: +`+Echo f y = Σ (x : A) , (f x ≡ y)+` - ✅ Fiber introduction: +`+echo-intro : ∀ x → Echo f (f x)+` - ✅ Action on fibers: +`+map-over : MapOver f f' → Echo f y → Echo f' y+` - ✅ Composition: +`+map-over-comp+` with associativity proofs - ✅ Identity laws: +`+map-over-id+` with reflexivity + +*Stability Indicators:* + +[source,agda] +---- +-- Core echo type definition (Echo.agda) +Echo : ∀ {a b} {A : Set a} {B : Set b} (f : A → B) → B → Set (a ⊔ b) +Echo {A = A} f y = Σ A (λ x → f x ≡ y) +---- + +*Assessment:* The core definition has remained unchanged across all +proofs, indicating mathematical maturity. The basic properties +(introduction, elimination, composition) form a solid foundation. + +==== 2. Extended Theory Stability: B+ (Stable with Active Development) + +===== 2.1 Indexed Echo Types: B+ + +*Proofs:* `+EchoIndexed.agda+` - Role-indexed echoes with trace +separation - Soundness and completeness proofs - Practical examples with +audit trails + +*Stability:* Stable core with potential for generalization + +===== 2.2 Categorical Structure: B + +*Proofs:* `+EchoCategorical.agda+`, `+EchoCategory.agda+` - Functorial +properties proven - Monadic structure explored - Adjunction patterns +identified + +*Stability:* Core categorical properties stable, but higher-level +abstractions still evolving + +===== 2.3 Epistemic Extensions: B+ + +*Proofs:* `+EchoEpistemic.agda+`, `+EchoEpistemicResidue.agda+` - +Knowledge preservation theorems - Residue-based weakening results - +No-section collapse proofs + +*Stability:* Mature epistemic logic integration with clear semantics + +===== 2.4 Relational Semantics: B + +*Proofs:* `+EchoRelational.agda+` - Step semantics defined - Output +fibers characterized - Compositional properties proven + +*Stability:* Solid foundation but could benefit from more examples + +==== 3. Application Stability: B (Emerging but Promising) + +===== 3.1 CNO Bridge: A- + +*Proofs:* `+EchoCNOBridge.agda+` - Complete equivalence proofs - +Practical examples included - Integration with absolute-zero framework + +*Stability:* Very stable - forms the basis for Certified Null Operations + +===== 3.2 JanusKey Bridge: B+ + +*Proofs:* `+EchoJanusBridge.agda+` - Core operation reversibility proven +- Metadata preservation theorems - Transaction composition results + +*Stability:* New but well-grounded in existing echo type theory + +===== 3.3 Thermodynamic Models: B (was C+ → B-; advanced 2026-05-18) + +*Proofs:* `+EchoThermodynamics.agda+`, `+EchoFiberCount.agda+`, +`+EchoThermodynamicsFinite.agda+`, `+EchoThermodynamicsArbitrary.agda+`, +`+EchoThermoCollapseImpossible.agda+` - Landauer bound _shape_ +`+k·T·⌊log₂ N⌋+` (honest fiber count, no hardcode) - Bennett zero-cost +for *every injective map* (`+bennett-reversible-injective+`), not just +`+id+` at index zero — `+bennett-reversible-id-zero+` is now a corollary +- Lifted off `+Fin n+` to *any Bishop-finite carrier* by transport along +an explicit bijection (`+FiniteDomain+`, `+bennett-reversible-finite+`, +`+landauer-collapse-finite+`) — `+--safe --without-K+`, zero postulates +- Bennett zero-cost lifted further to an *arbitrary carrier — no +finiteness at all* (`+bennett-reversible-arbitrary+`, occupancy-keyed; +K-free subsingleton route), certified faithful vs. the established count +(`+occupancy≡FiberSize-fin+`, `+bennett-arbitrary-refines-finite+`), and +instantiated on the genuine *infinite* absolute-zero `+Program+` CNO +(`+bennett-reversible-cno-identity+`) — the historically vacuous "`CNO +dissipates zero energy`" is now a real theorem - Landauer worst-case +collapse (`+landauer-collapse[-finite]+`) - *O-THERMO-∞ settled +`+[CLOSED-NEG]+`*: the quantitative-collapse functional provably does +_not_ extend to an infinite carrier as a total `+--safe+` function — +impossibility mechanised (`+collapse-cost-impossible+`; +`+nat-into-collapse-fiber+` exhibits the collapse fiber as infinite). +The doc’s own kill condition, discharged via its second horn + +*Stability:* The C+ ~70% rating was driven by one concrete gap — the +only proved zero-cost instance was the identity at index zero. That gap +is fully closed: the Bennett zero-cost direction now holds for every +injective map on *every carrier* — Bishop-finite _and_ +arbitrary/infinite, including the genuine infinite `+Program+` CNO. The +previously-open item — the *quantitative collapse functional* +(`+fiber-erasure-bound+` / `+landauer-collapse+`) on an infinite +carrier, the obligation *O-THERMO-∞* — is now *discharged negatively*: +`+collapse-cost-impossible+` mechanises its kill condition’s second horn +((i)∧(ii) ⊢ ⊥) verbatim, for the doc’s own named witness. It is +therefore `+[CLOSED-NEG]+` — a settled boundary of the theory, do not +reopen, not a defect. *No open obligation remains for this Direction.* +The standing B- freeze (no re-rate until O-THERMO-∞ is discharged or +refuted) is therefore lifted — discharged negatively counts as +discharged — and the grade advances to *B*. (It is _not_ higher: a +confirmed-negative is an honest limit, not extra positive coverage; and +the separate Information-Theory bridge — Theorem 5, +`+echo-information-loss+` never defined — remains unbuilt, but that is a +different Direction.) + +==== 4. Proof Ecosystem Stability: B+ + +*Proof Coverage Matrix:* + +[cols=",,",options="header",] +|=== +|Domain |Coverage |Stability +|Core Theory |100% |A +|Indexed Types |90% |B+ +|Categorical |85% |B +|Epistemic |95% |B+ +|Relational |80% |B +|CNO Integration |98% |A- +|JanusKey Bridge |90% |B+ +|Thermodynamics |95% |B +|=== + +*Proof Quality Indicators:* - ✅ All core theorems have constructive +proofs - ✅ Most proofs use standard Agda libraries - ✅ Proofs compile +with `+--safe --without-K+` flags - ✅ Good separation between +definitions and theorems - ⚠️ Some advanced proofs need more examples - +⚠️ Integration proofs could use more real-world validation + +==== 5. Integration Stability: B + +*Integration Points:* + +[arabic] +. *Absolute Zero Framework*: A- +* Strong CNO bridge +* Clear connection to formal methods +. *JanusKey*: B+ +* New but well-designed bridge +* Practical reversibility proofs +. *MAA Framework*: C+ +* Potential for integration +* Needs more development + +*Stability Assessment:* - CNO integration is very stable and well-proven +- JanusKey bridge is solid but newer - Broader MAA integration is still +emerging + +=== Stability Rating Breakdown + +==== A. Mature and Stable (Production Ready) + +* Core echo type definition and basic properties +* Fiber introduction and elimination +* Composition and identity laws +* CNO bridge and integration + +==== B. Stable but Evolving (Safe for Development) + +* Indexed echo types with roles +* Categorical semantics +* Epistemic extensions +* Relational semantics +* JanusKey bridge + +==== C. Experimental (Research Phase) + +* Thermodynamic models +* Quantum connections +* Advanced temporal logic +* Higher-dimensional types + +=== Risk Assessment + +==== Low Risk Areas + +[arabic] +. *Core Theory*: Extremely stable, unlikely to change +. *CNO Integration*: Well-proven, production-ready +. *Basic Properties*: Mathematically sound + +==== Medium Risk Areas + +[arabic] +. *Extended Theories*: Could see refinements +. *New Applications*: Might need adjustments +. *Integration Points*: Could evolve + +==== High Risk Areas + +[arabic] +. *Experimental Extensions*: Likely to change significantly +. *Unproven Applications*: Need more development +. *Performance Claims*: Need real-world validation + +=== Recommendations for Improvement + +==== Short-Term (3-6 months) + +[arabic] +. *Complete JanusKey Integration Tests*: Validate bridge in practice +. *Add More Examples*: Especially for categorical and relational +semantics +. *Document Proof Patterns*: Create guide for extending echo types +. *Performance Benchmarking*: Establish baseline metrics + +==== Medium-Term (6-12 months) + +[arabic] +. *Formal Verification*: Prove Rust implementation correctness +. *Distributed Proofs*: Extend to distributed systems +. *Resource Bounds*: Add bounded reversibility proofs +. *Tooling*: Better Agda-Rust integration + +==== Long-Term (12-24 months) + +[arabic] +. *Quantum Extensions*: Explore quantum computing connections +. *Homotopy Types*: Develop higher-dimensional theory +. *Ecosystem Integration*: Unify with MAA framework +. *Standardization*: Potential for formal standards + +=== Comparison with Alternative Approaches + +==== Echo Types vs. Traditional Reversibility + +[cols=",,",options="header",] +|=== +|Aspect |Echo Types |Traditional Methods +|Formal Foundation |Strong (type theory) |Weak (ad-hoc) +|Proof Coverage |Comprehensive |Limited +|Compositionality |Excellent |Poor +|Implementation Complexity |Moderate |High +|Verification Support |Excellent |Limited +|=== + +==== Echo Types vs. Other Type-Theoretic Approaches + +[cols=",,,",options="header",] +|=== +|Approach |Echo Types |Homotopy Types |Linear Types +|Reversibility |Built-in |Possible |Limited +|Composition |Excellent |Complex |Good +|Proof Complexity |Moderate |High |Low +|Practicality |High |Medium |High +|=== + +=== Stability Roadmap + +==== Phase 1: Consolidation (Current - 6 months) + +* Focus: Stabilize new bridges (JanusKey, distributed) +* Goal: Achieve B+ stability across all applications +* Actions: Testing, examples, documentation + +==== Phase 2: Maturation (6 - 18 months) + +* Focus: Formal verification and integration +* Goal: Achieve A- stability for core applications +* Actions: Rust verification, CI integration, performance tuning + +==== Phase 3: Expansion (18 - 36 months) + +* Focus: New applications and ecosystem growth +* Goal: Explore experimental extensions +* Actions: Quantum, distributed, advanced temporal logic + +=== Conclusion + +*Overall Stability Rating: B+ (Stable but Evolving)* + +Echo types provide a *mathematically rigorous foundation* for +reversibility with *comprehensive proof coverage*. The core theory is +*mature and stable (A rating)*, while applications like JanusKey +integration are *solid but newer (B+ rating)*. Experimental extensions +show promise but need development. + +*Strengths:* - Strong mathematical foundation - Comprehensive proof +ecosystem - Clear compositional properties - Excellent integration +potential + +*Opportunities:* - Formal verification of implementations - Distributed +system extensions - Broader ecosystem integration - Performance +optimization + +*Risks:* - Experimental extensions may change - Integration points could +evolve - Real-world validation needed + +*Recommendation:* Echo types are *stable enough for production use in +core applications* (CNO, basic reversibility) and *suitable for +development in extended applications* (JanusKey, distributed systems). +The framework provides a solid foundation for building verifiably +reversible systems. diff --git a/docs/STABILITY_ANALYSIS.md b/docs/STABILITY_ANALYSIS.md deleted file mode 100644 index 234539d..0000000 --- a/docs/STABILITY_ANALYSIS.md +++ /dev/null @@ -1,285 +0,0 @@ - - -# Echo Types Stability Analysis - -## Executive Summary - -**Current Stability Rating: B+ (Stable but Evolving)** - -Echo types demonstrate **strong mathematical foundation** with **comprehensive proof coverage** across multiple domains. The core theory is stable, but the ecosystem is actively evolving with new applications and integrations. - -## Stability Assessment Framework - -### 1. Core Theory Stability: A (Mature and Proven) - -**Foundational Proofs:** -- ✅ Basic echo type definition: `Echo f y = Σ (x : A) , (f x ≡ y)` -- ✅ Fiber introduction: `echo-intro : ∀ x → Echo f (f x)` -- ✅ Action on fibers: `map-over : MapOver f f' → Echo f y → Echo f' y` -- ✅ Composition: `map-over-comp` with associativity proofs -- ✅ Identity laws: `map-over-id` with reflexivity - -**Stability Indicators:** -```agda --- Core echo type definition (Echo.agda) -Echo : ∀ {a b} {A : Set a} {B : Set b} (f : A → B) → B → Set (a ⊔ b) -Echo {A = A} f y = Σ A (λ x → f x ≡ y) -``` - -**Assessment:** The core definition has remained unchanged across all proofs, indicating mathematical maturity. The basic properties (introduction, elimination, composition) form a solid foundation. - -### 2. Extended Theory Stability: B+ (Stable with Active Development) - -#### 2.1 Indexed Echo Types: B+ -**Proofs:** `EchoIndexed.agda` -- Role-indexed echoes with trace separation -- Soundness and completeness proofs -- Practical examples with audit trails - -**Stability:** Stable core with potential for generalization - -#### 2.2 Categorical Structure: B -**Proofs:** `EchoCategorical.agda`, `EchoCategory.agda` -- Functorial properties proven -- Monadic structure explored -- Adjunction patterns identified - -**Stability:** Core categorical properties stable, but higher-level abstractions still evolving - -#### 2.3 Epistemic Extensions: B+ -**Proofs:** `EchoEpistemic.agda`, `EchoEpistemicResidue.agda` -- Knowledge preservation theorems -- Residue-based weakening results -- No-section collapse proofs - -**Stability:** Mature epistemic logic integration with clear semantics - -#### 2.4 Relational Semantics: B -**Proofs:** `EchoRelational.agda` -- Step semantics defined -- Output fibers characterized -- Compositional properties proven - -**Stability:** Solid foundation but could benefit from more examples - -### 3. Application Stability: B (Emerging but Promising) - -#### 3.1 CNO Bridge: A- -**Proofs:** `EchoCNOBridge.agda` -- Complete equivalence proofs -- Practical examples included -- Integration with absolute-zero framework - -**Stability:** Very stable - forms the basis for Certified Null Operations - -#### 3.2 JanusKey Bridge: B+ -**Proofs:** `EchoJanusBridge.agda` -- Core operation reversibility proven -- Metadata preservation theorems -- Transaction composition results - -**Stability:** New but well-grounded in existing echo type theory - -#### 3.3 Thermodynamic Models: B (was C+ → B-; advanced 2026-05-18) -**Proofs:** `EchoThermodynamics.agda`, `EchoFiberCount.agda`, `EchoThermodynamicsFinite.agda`, `EchoThermodynamicsArbitrary.agda`, `EchoThermoCollapseImpossible.agda` -- Landauer bound *shape* `k·T·⌊log₂ N⌋` (honest fiber count, no hardcode) -- Bennett zero-cost for **every injective map** (`bennett-reversible-injective`), - not just `id` at index zero — `bennett-reversible-id-zero` is now a corollary -- Lifted off `Fin n` to **any Bishop-finite carrier** by transport along an - explicit bijection (`FiniteDomain`, `bennett-reversible-finite`, - `landauer-collapse-finite`) — `--safe --without-K`, zero postulates -- Bennett zero-cost lifted further to an **arbitrary carrier — no finiteness - at all** (`bennett-reversible-arbitrary`, occupancy-keyed; K-free - subsingleton route), certified faithful vs. the established count - (`occupancy≡FiberSize-fin`, `bennett-arbitrary-refines-finite`), and - instantiated on the genuine **infinite** absolute-zero `Program` CNO - (`bennett-reversible-cno-identity`) — the historically vacuous - "CNO dissipates zero energy" is now a real theorem -- Landauer worst-case collapse (`landauer-collapse[-finite]`) -- **O-THERMO-∞ settled `[CLOSED-NEG]`**: the quantitative-collapse - functional provably does *not* extend to an infinite carrier as a - total `--safe` function — impossibility mechanised - (`collapse-cost-impossible`; `nat-into-collapse-fiber` exhibits the - collapse fiber as infinite). The doc's own kill condition, - discharged via its second horn - -**Stability:** The C+ ~70% rating was driven by one concrete gap — the only -proved zero-cost instance was the identity at index zero. That gap is fully -closed: the Bennett zero-cost direction now holds for every injective map on -**every carrier** — Bishop-finite *and* arbitrary/infinite, including the -genuine infinite `Program` CNO. The previously-open item — the **quantitative -collapse functional** (`fiber-erasure-bound` / `landauer-collapse`) on an -infinite carrier, the obligation **O-THERMO-∞** — is now **discharged -negatively**: `collapse-cost-impossible` mechanises its kill condition's -second horn ((i)∧(ii) ⊢ ⊥) verbatim, for the doc's own named witness. It is -therefore `[CLOSED-NEG]` — a settled boundary of the theory, do not reopen, -not a defect. **No open obligation remains for this Direction.** The standing -B- freeze (no re-rate until O-THERMO-∞ is discharged or refuted) is therefore -lifted — discharged negatively counts as discharged — and the grade advances -to **B**. (It is *not* higher: a confirmed-negative is an honest limit, not -extra positive coverage; and the separate Information-Theory bridge — Theorem -5, `echo-information-loss` never defined — remains unbuilt, but that is a -different Direction.) - -### 4. Proof Ecosystem Stability: B+ - -**Proof Coverage Matrix:** - -| Domain | Coverage | Stability | -|--------|----------|-----------| -| Core Theory | 100% | A | -| Indexed Types | 90% | B+ | -| Categorical | 85% | B | -| Epistemic | 95% | B+ | -| Relational | 80% | B | -| CNO Integration | 98% | A- | -| JanusKey Bridge | 90% | B+ | -| Thermodynamics | 95% | B | - -**Proof Quality Indicators:** -- ✅ All core theorems have constructive proofs -- ✅ Most proofs use standard Agda libraries -- ✅ Proofs compile with `--safe --without-K` flags -- ✅ Good separation between definitions and theorems -- ⚠️ Some advanced proofs need more examples -- ⚠️ Integration proofs could use more real-world validation - -### 5. Integration Stability: B - -**Integration Points:** - -1. **Absolute Zero Framework**: A- - - Strong CNO bridge - - Clear connection to formal methods - -2. **JanusKey**: B+ - - New but well-designed bridge - - Practical reversibility proofs - -3. **MAA Framework**: C+ - - Potential for integration - - Needs more development - -**Stability Assessment:** -- CNO integration is very stable and well-proven -- JanusKey bridge is solid but newer -- Broader MAA integration is still emerging - -## Stability Rating Breakdown - -### A. Mature and Stable (Production Ready) -- Core echo type definition and basic properties -- Fiber introduction and elimination -- Composition and identity laws -- CNO bridge and integration - -### B. Stable but Evolving (Safe for Development) -- Indexed echo types with roles -- Categorical semantics -- Epistemic extensions -- Relational semantics -- JanusKey bridge - -### C. Experimental (Research Phase) -- Thermodynamic models -- Quantum connections -- Advanced temporal logic -- Higher-dimensional types - -## Risk Assessment - -### Low Risk Areas -1. **Core Theory**: Extremely stable, unlikely to change -2. **CNO Integration**: Well-proven, production-ready -3. **Basic Properties**: Mathematically sound - -### Medium Risk Areas -1. **Extended Theories**: Could see refinements -2. **New Applications**: Might need adjustments -3. **Integration Points**: Could evolve - -### High Risk Areas -1. **Experimental Extensions**: Likely to change significantly -2. **Unproven Applications**: Need more development -3. **Performance Claims**: Need real-world validation - -## Recommendations for Improvement - -### Short-Term (3-6 months) -1. **Complete JanusKey Integration Tests**: Validate bridge in practice -2. **Add More Examples**: Especially for categorical and relational semantics -3. **Document Proof Patterns**: Create guide for extending echo types -4. **Performance Benchmarking**: Establish baseline metrics - -### Medium-Term (6-12 months) -1. **Formal Verification**: Prove Rust implementation correctness -2. **Distributed Proofs**: Extend to distributed systems -3. **Resource Bounds**: Add bounded reversibility proofs -4. **Tooling**: Better Agda-Rust integration - -### Long-Term (12-24 months) -1. **Quantum Extensions**: Explore quantum computing connections -2. **Homotopy Types**: Develop higher-dimensional theory -3. **Ecosystem Integration**: Unify with MAA framework -4. **Standardization**: Potential for formal standards - -## Comparison with Alternative Approaches - -### Echo Types vs. Traditional Reversibility -| Aspect | Echo Types | Traditional Methods | -|--------|------------|---------------------| -| Formal Foundation | Strong (type theory) | Weak (ad-hoc) | -| Proof Coverage | Comprehensive | Limited | -| Compositionality | Excellent | Poor | -| Implementation Complexity | Moderate | High | -| Verification Support | Excellent | Limited | - -### Echo Types vs. Other Type-Theoretic Approaches -| Approach | Echo Types | Homotopy Types | Linear Types | -|----------|-------------|----------------|--------------| -| Reversibility | Built-in | Possible | Limited | -| Composition | Excellent | Complex | Good | -| Proof Complexity | Moderate | High | Low | -| Practicality | High | Medium | High | - -## Stability Roadmap - -### Phase 1: Consolidation (Current - 6 months) -- Focus: Stabilize new bridges (JanusKey, distributed) -- Goal: Achieve B+ stability across all applications -- Actions: Testing, examples, documentation - -### Phase 2: Maturation (6 - 18 months) -- Focus: Formal verification and integration -- Goal: Achieve A- stability for core applications -- Actions: Rust verification, CI integration, performance tuning - -### Phase 3: Expansion (18 - 36 months) -- Focus: New applications and ecosystem growth -- Goal: Explore experimental extensions -- Actions: Quantum, distributed, advanced temporal logic - -## Conclusion - -**Overall Stability Rating: B+ (Stable but Evolving)** - -Echo types provide a **mathematically rigorous foundation** for reversibility with **comprehensive proof coverage**. The core theory is **mature and stable (A rating)**, while applications like JanusKey integration are **solid but newer (B+ rating)**. Experimental extensions show promise but need development. - -**Strengths:** -- Strong mathematical foundation -- Comprehensive proof ecosystem -- Clear compositional properties -- Excellent integration potential - -**Opportunities:** -- Formal verification of implementations -- Distributed system extensions -- Broader ecosystem integration -- Performance optimization - -**Risks:** -- Experimental extensions may change -- Integration points could evolve -- Real-world validation needed - -**Recommendation:** Echo types are **stable enough for production use in core applications** (CNO, basic reversibility) and **suitable for development in extended applications** (JanusKey, distributed systems). The framework provides a solid foundation for building verifiably reversible systems. \ No newline at end of file diff --git a/docs/assets/banner-philosophy.adoc b/docs/assets/banner-philosophy.adoc new file mode 100644 index 0000000..fe6f048 --- /dev/null +++ b/docs/assets/banner-philosophy.adoc @@ -0,0 +1,55 @@ +== Diagrammatic Hush + +A visual philosophy of restrained scientific inscription. Every mark is +deliberate; nothing is decorative. The composition reads as if extracted +from a private notebook of a working mathematician — annotated, weighed, +refined over many sittings. + +=== Form and Space + +Horizontal procession dominates: a sequence of small geometric +structures advancing left-to-right along a single quiet axis, each one a +near-replica of its predecessor, each one diminished by exactly one +element. The page breathes around them. Negative space is not absence; +it is the field on which the structures register. Width is treated as +time; vertical depth as proof content. + +=== Colour and Material + +The palette is the palette of dark paper under low light: a deep ink +ground, warm bone-coloured marks, a single warm amber reserved +exclusively for the residues — the things that remain after +transformation. This amber is never used for structure, only for what +has fallen away and become inscribed. The discipline of the palette is +the discipline of the work: no element earns colour without earning +meaning. + +=== Rhythm and Hierarchy + +The procession is steady — even spacings, even cadence, even small +rotational drift — so that the eye perceives one long held note rather +than eight short ones. The title sits at the centre as a brief silence +in the procession, framed by space the way a theorem statement is framed +by margin. The subtitle hovers above as a small field-label: +tracked-out, almost a watermark, suggesting that the piece is a specimen +from some larger taxonomic project. + +=== Craft and Refinement + +This must look like the hundredth iteration, not the first. The line +weights are calibrated so that the diagonals read as secondary structure +beneath the primary square. The fiber marks are placed at exact, +recurring slots — so that across the width they form a discrete grid the +eye can read but never quite name. Every coordinate is chosen, every +opacity tuned. The work should reward the reader who zooms in as much as +the reader who only glances. Nothing is generic; nothing is ornamental; +nothing has been left to chance. + +=== What is Avoided + +Brackets, terminals, gears, circuits, neural meshes, gradient swirls, +glowing particles, perspective grids, faux-3D. Anything that announces +itself as "`technology`" rather than mathematics. Anything that suggests +style over substance. The work belongs in the tradition of Bourbaki, of +TikZ-cd, of Felice Frankel’s scientific photography — not in the +tradition of stock vector illustration. diff --git a/docs/assets/banner-philosophy.md b/docs/assets/banner-philosophy.md deleted file mode 100644 index dde4cfc..0000000 --- a/docs/assets/banner-philosophy.md +++ /dev/null @@ -1,50 +0,0 @@ - - -# Diagrammatic Hush - -A visual philosophy of restrained scientific inscription. Every mark is deliberate; -nothing is decorative. The composition reads as if extracted from a private notebook -of a working mathematician — annotated, weighed, refined over many sittings. - -## Form and Space - -Horizontal procession dominates: a sequence of small geometric structures advancing -left-to-right along a single quiet axis, each one a near-replica of its predecessor, -each one diminished by exactly one element. The page breathes around them. Negative -space is not absence; it is the field on which the structures register. Width is -treated as time; vertical depth as proof content. - -## Colour and Material - -The palette is the palette of dark paper under low light: a deep ink ground, warm -bone-coloured marks, a single warm amber reserved exclusively for the residues — -the things that remain after transformation. This amber is never used for structure, -only for what has fallen away and become inscribed. The discipline of the palette -is the discipline of the work: no element earns colour without earning meaning. - -## Rhythm and Hierarchy - -The procession is steady — even spacings, even cadence, even small rotational drift -— so that the eye perceives one long held note rather than eight short ones. The -title sits at the centre as a brief silence in the procession, framed by space the -way a theorem statement is framed by margin. The subtitle hovers above as a small -field-label: tracked-out, almost a watermark, suggesting that the piece is a -specimen from some larger taxonomic project. - -## Craft and Refinement - -This must look like the hundredth iteration, not the first. The line weights are -calibrated so that the diagonals read as secondary structure beneath the primary -square. The fiber marks are placed at exact, recurring slots — so that across the -width they form a discrete grid the eye can read but never quite name. Every -coordinate is chosen, every opacity tuned. The work should reward the reader who -zooms in as much as the reader who only glances. Nothing is generic; nothing is -ornamental; nothing has been left to chance. - -## What is Avoided - -Brackets, terminals, gears, circuits, neural meshes, gradient swirls, glowing -particles, perspective grids, faux-3D. Anything that announces itself as -"technology" rather than mathematics. Anything that suggests style over substance. -The work belongs in the tradition of Bourbaki, of TikZ-cd, of Felice Frankel's -scientific photography — not in the tradition of stock vector illustration. diff --git a/docs/bridge-status.adoc b/docs/bridge-status.adoc new file mode 100644 index 0000000..6d4bf2f --- /dev/null +++ b/docs/bridge-status.adoc @@ -0,0 +1,119 @@ +== Bridge Status + +This document strictly tracks the status of experimental extensions and +bridges between the minimal core of Echo Types and other domains. + +*Note:* Bridge materials are speculative and exploratory. They do _not_ +affect the core identity or foundational theorems of the repository. + +=== 1. CNO Bridge (Absolute Zero) + +* *Status:* PARTIAL +* *Dependencies:* Absolute Zero Framework +* *Blockers:* End-to-end integration across repositories is not yet +mechanically verified here. +* *Core Affect:* NO + +=== 2. Thermodynamics + +* *Status:* EXPLORATORY +* *Dependencies:* None +* *Blockers:* The quantitative collapse functional on infinite carriers +is negatively closed (`+collapse-cost-impossible+`). +* *Core Affect:* NO + +=== 3. Tropical Semantics + +* *Status:* PARTIAL +* *Dependencies:* None +* *Blockers:* Witness residues under tropical collapse are established, +but broader ecosystem mapping remains incomplete. +* *Core Affect:* NO + +=== 4. Buchholz / Veblen Ordinals + +* *Status:* PARTIAL (11/13 constructors closed under WfCNF; 1 in flight) +* *Dependencies:* Standard Agda +* *Blockers:* `+<ᵇ-+1+` joint-bplus is the single remaining open +constructor. The head-Ω domination route (option A) has its abstraction ++ per-marker dominances at both branches + the option-(b) head-Ω +inversion lemmas all landed across 2026-05-27 (PRs #124 / #130 / #131); +only the WfCNF-carrier structural recursion (Slice 2-bplus) remains. The +earlier shared-binder-self-lift blocker is resolved (`+RankAdm+` + +`+RankLex+` slices, 2026-05-26/27). Live tracker: +`+docs/echo-types/buchholz-rank-obstruction.adoc+`. +* *Core Affect:* NO + +=== 5. JanusKey / Categorical + +* *Status:* EXPLORATORY +* *Dependencies:* Categorical foundations +* *Blockers:* Higher-level abstractions (monads, adjunctions) are still +evolving; core functors are stable. +* *Core Affect:* NO + +=== 6. Decoration bridge (conceptual, not cross-repo) + +* *Status:* EXPLORATORY (R5 deferred-research; cleanly abandonable) +* *Dependencies:* `+EchoIntegration+`, `+EchoChoreo+`, `+EchoGraded+` +(import only) +* *Blockers:* Bridge is bounded by construction. Closes under any of the +documented termination criteria: Track A/B/C failure, all candidate +analogies retired, redundancy with retracted-prose graded-comonad +framing, forbidden-rebrandings register addition, retraction-watch trip. +Companion: +`+docs/echo-types/explorations/decoration-bridge/README.adoc+`; module: +`+proofs/agda/EchoDecorationBridge.agda+` (deliberately not in +`+All.agda+`). +* *Core Affect:* NO + +=== 7. Valence Shell / Ochránce accountable-shell bridge (candidate downstream consumer) + +* *Status:* EXPLORATORY (candidate downstream consumer; no Agda +artefact, no cross-repo theorem) +* *Dependencies:* None in this repo. Adjacent (downstream) only: Valence +Shell (`+hyperpolymath/valence-shell+` — shell state transitions, +undo/redo, checkpoints, diff/replay); Ochránce +(`+hyperpolymath/ochrance+` — A2ML manifests, Merkle state commitments, +repair/attestation surfaces). +* *Blockers:* No shared schema and no mechanised cross-repo theorem +exist. The relationship is citation-level only: Echo Types’ +structured-loss vocabulary (recoverable / constrained / residue-bearing +/ observationally equivalent / genuinely lost) is a _candidate_ +classifier for shell state transitions, and Ochránce may supply concrete +receipt evidence. This is downstream application evidence, not a new +foundation. Echo Types makes *no* claim about Valence Shell or Ochránce +implementation correctness, and *no* claim about POSIX, Rust, the +Lean→Rust correspondence, secure deletion, GDPR, cryptographic +integrity, or attestation. Companion note: +`+docs/echo-types/explorations/accountable-shell/README.adoc+`. Nothing +for this bridge is imported into `+proofs/agda/All.agda+`, +`+proofs/agda/Smoke.agda+`, or +`+proofs/agda/EchoCanonicalIdentitySuite.agda+`. +* *Core Affect:* NO + +=== 8. Eclexia consumer (thermodynamic resource bridge) + +* *Status:* LANDED (downstream consumer-side, in +`+hyperpolymath/eclexia+` — PR eclexia#32). No artefact in _this_ repo. +* *Dependencies:* None in this repo. Adjacent (downstream) only: Eclexia +(`+hyperpolymath/eclexia+` — the resource-typed "`economics-as-code`" +language). +* *Blockers:* None outstanding on the consumer side; this is application +evidence, not a new foundation here. Eclexia integrates Echo as a +first-class `+Echo[A, B]+` type former and, separately in its _own_ Coq +metatheory, mirrors the *discrete* thermodynamic shadow of this repo’s +`+EchoThermodynamics+` (`+formal/coq/src/EchoThermo.v+`: +`+bennett_reversible_is_free+`, `+free_iff_reversible+`, +`+irreversible_costs_at_least_one_bit+`, `+erasure_monotone+` — +axiom-free, `+Print Assumptions+` clean), and exposes it at the language +level as `+landauer_cost(states, T) : Resource[Energy]+` — pricing the +erasure of a collapsed fibre (`+k_B·T·ln N+`; reversible retention is +free). Echo Types makes *no* claim about Eclexia’s implementation +correctness; the real-valued `+k T ln 2+` scaling and the language +runtime live entirely in that repo. The infinite-carrier collapse +functional here remains negatively closed (`+collapse-cost-impossible+`, +see §2) — eclexia consumes only the finite/discrete shadow. Nothing for +this bridge is imported into `+proofs/agda/All.agda+` or +`+proofs/agda/Smoke.agda+`. +* *Core Affect:* NO diff --git a/docs/bridge-status.md b/docs/bridge-status.md deleted file mode 100644 index 352c33f..0000000 --- a/docs/bridge-status.md +++ /dev/null @@ -1,55 +0,0 @@ - - -# Bridge Status - -This document strictly tracks the status of experimental extensions and bridges between the minimal core of Echo Types and other domains. - -**Note:** Bridge materials are speculative and exploratory. They do *not* affect the core identity or foundational theorems of the repository. - -## 1. CNO Bridge (Absolute Zero) -- **Status:** PARTIAL -- **Dependencies:** Absolute Zero Framework -- **Blockers:** End-to-end integration across repositories is not yet mechanically verified here. -- **Core Affect:** NO - -## 2. Thermodynamics -- **Status:** EXPLORATORY -- **Dependencies:** None -- **Blockers:** The quantitative collapse functional on infinite carriers is negatively closed (`collapse-cost-impossible`). -- **Core Affect:** NO - -## 3. Tropical Semantics -- **Status:** PARTIAL -- **Dependencies:** None -- **Blockers:** Witness residues under tropical collapse are established, but broader ecosystem mapping remains incomplete. -- **Core Affect:** NO - -## 4. Buchholz / Veblen Ordinals -- **Status:** PARTIAL (11/13 constructors closed under WfCNF; 1 in flight) -- **Dependencies:** Standard Agda -- **Blockers:** `<ᵇ-+1` joint-bplus is the single remaining open constructor. The head-Ω domination route (option A) has its abstraction + per-marker dominances at both branches + the option-(b) head-Ω inversion lemmas all landed across 2026-05-27 (PRs #124 / #130 / #131); only the WfCNF-carrier structural recursion (Slice 2-bplus) remains. The earlier shared-binder-self-lift blocker is resolved (`RankAdm` + `RankLex` slices, 2026-05-26/27). Live tracker: `docs/echo-types/buchholz-rank-obstruction.adoc`. -- **Core Affect:** NO - -## 5. JanusKey / Categorical -- **Status:** EXPLORATORY -- **Dependencies:** Categorical foundations -- **Blockers:** Higher-level abstractions (monads, adjunctions) are still evolving; core functors are stable. -- **Core Affect:** NO - -## 6. Decoration bridge (conceptual, not cross-repo) -- **Status:** EXPLORATORY (R5 deferred-research; cleanly abandonable) -- **Dependencies:** `EchoIntegration`, `EchoChoreo`, `EchoGraded` (import only) -- **Blockers:** Bridge is bounded by construction. Closes under any of the documented termination criteria: Track A/B/C failure, all candidate analogies retired, redundancy with retracted-prose graded-comonad framing, forbidden-rebrandings register addition, retraction-watch trip. Companion: `docs/echo-types/explorations/decoration-bridge/README.adoc`; module: `proofs/agda/EchoDecorationBridge.agda` (deliberately not in `All.agda`). -- **Core Affect:** NO - -## 7. Valence Shell / Ochránce accountable-shell bridge (candidate downstream consumer) -- **Status:** EXPLORATORY (candidate downstream consumer; no Agda artefact, no cross-repo theorem) -- **Dependencies:** None in this repo. Adjacent (downstream) only: Valence Shell (`hyperpolymath/valence-shell` — shell state transitions, undo/redo, checkpoints, diff/replay); Ochránce (`hyperpolymath/ochrance` — A2ML manifests, Merkle state commitments, repair/attestation surfaces). -- **Blockers:** No shared schema and no mechanised cross-repo theorem exist. The relationship is citation-level only: Echo Types' structured-loss vocabulary (recoverable / constrained / residue-bearing / observationally equivalent / genuinely lost) is a *candidate* classifier for shell state transitions, and Ochránce may supply concrete receipt evidence. This is downstream application evidence, not a new foundation. Echo Types makes **no** claim about Valence Shell or Ochránce implementation correctness, and **no** claim about POSIX, Rust, the Lean→Rust correspondence, secure deletion, GDPR, cryptographic integrity, or attestation. Companion note: `docs/echo-types/explorations/accountable-shell/README.adoc`. Nothing for this bridge is imported into `proofs/agda/All.agda`, `proofs/agda/Smoke.agda`, or `proofs/agda/EchoCanonicalIdentitySuite.agda`. -- **Core Affect:** NO - -## 8. Eclexia consumer (thermodynamic resource bridge) -- **Status:** LANDED (downstream consumer-side, in `hyperpolymath/eclexia` — PR eclexia#32). No artefact in *this* repo. -- **Dependencies:** None in this repo. Adjacent (downstream) only: Eclexia (`hyperpolymath/eclexia` — the resource-typed "economics-as-code" language). -- **Blockers:** None outstanding on the consumer side; this is application evidence, not a new foundation here. Eclexia integrates Echo as a first-class `Echo[A, B]` type former and, separately in its *own* Coq metatheory, mirrors the **discrete** thermodynamic shadow of this repo's `EchoThermodynamics` (`formal/coq/src/EchoThermo.v`: `bennett_reversible_is_free`, `free_iff_reversible`, `irreversible_costs_at_least_one_bit`, `erasure_monotone` — axiom-free, `Print Assumptions` clean), and exposes it at the language level as `landauer_cost(states, T) : Resource[Energy]` — pricing the erasure of a collapsed fibre (`k_B·T·ln N`; reversible retention is free). Echo Types makes **no** claim about Eclexia's implementation correctness; the real-valued `k T ln 2` scaling and the language runtime live entirely in that repo. The infinite-carrier collapse functional here remains negatively closed (`collapse-cost-impossible`, see §2) — eclexia consumes only the finite/discrete shadow. Nothing for this bridge is imported into `proofs/agda/All.agda` or `proofs/agda/Smoke.agda`. -- **Core Affect:** NO diff --git a/docs/bridges/EchoBridges.adoc b/docs/bridges/EchoBridges.adoc new file mode 100644 index 0000000..ff302bd --- /dev/null +++ b/docs/bridges/EchoBridges.adoc @@ -0,0 +1,321 @@ +== Echo Types Bridge Documentation + +=== Overview + +This document provides comprehensive documentation for the echo types +bridge modules, which extend the core echo type theory to various +domains including JanusKey, CNO, Tropical, Dyadic, and Ephapax-L3 +systems. + +=== Bridge Modules + +==== 1. EchoJanusBridge + +*Location*: `+proofs/agda/EchoJanusBridge.agda+` + +*Purpose*: Bridge between echo types and JanusKey’s reversible +filesystem operations. + +*Key Components*: + +* *JanusOp*: Operation types (Create, Delete, Modify, Move) +* *janus-to-unit*: Mapping from operations to unit +* *JanusEcho*: Echo types for each operation +* *Core Theorems*: Reversibility, preservation, composition + +*Practical Examples*: + +[source,agda] +---- +-- File creation with echo provenance +file-creation-example : JanusEcho Create +file-creation-example = create-echo + +-- File deletion with echo provenance +file-deletion-example : JanusEcho Delete +file-deletion-example = delete-echo + +-- Composite operation sequence +composite-operation : JanusEcho Create → JanusEcho Delete → Echo janus-to-unit tt +composite-operation create delete = create +---- + +*Main Theorem*: + +[source,agda] +---- +JanusEchoBridgeTheorem : + JanusEcho Create × JanusEcho Delete × JanusEcho Modify × JanusEcho Move +---- + +==== 2. EchoCNOBridge + +*Location*: `+proofs/agda/EchoCNOBridge.agda+` + +*Purpose*: Bridge between echo types and Certified Null Operations. + +*Key Components*: + +* *CNOOp*: Operation types (Read, Write, Execute, NullOp) +* *cno-to-unit*: Mapping from operations to unit +* *CNOEcho*: Echo types for each operation +* *Core Theorems*: Preservation, null operation properties + +*Practical Examples*: + +[source,agda] +---- +-- Read operation with echo provenance +read-operation-example : CNOEcho Read +read-operation-example = read-echo + +-- Null operation with echo provenance +null-operation-example : CNOEcho NullOp +null-operation-example = nullop-echo + +-- Operation sequence with provenance +operation-sequence : CNOEcho Read → CNOEcho Write → Echo cno-to-unit tt +operation-sequence read write = read +---- + +*Main Theorem*: + +[source,agda] +---- +CNOEchoBridgeTheorem : + CNOEcho Read × CNOEcho Write × CNOEcho Execute × CNOEcho NullOp +---- + +==== 3. EchoTropical + +*Location*: `+proofs/agda/EchoTropical.agda+` + +*Purpose*: Bridge between echo types and tropical semiring structure. + +*Key Components*: + +* *Tropical Semiring*: Max-plus operations (⊕, ⊗) +* *Candidate System*: Three candidates with scoring +* *TropEcho*: Tropical echo with optimality certification +* *Core Theorems*: Non-injectivity, echo retention + +*Main Theorem*: + +[source,agda] +---- +distinct-candidates-same-visible-distinct-echo : + score a ≡ score b × echo-a ≢ echo-b +---- + +==== 4. EchoDyadic + +*Location*: `+proofs/agda/Dyadic.agda+` + +*Purpose*: Dyadic session types with echo provenance. + +*Key Components*: + +* *Party*: Alice and Bob roles +* *Session*: Dyadic session types (Send, Recv, Choice, Select) +* *Duality*: Protocol complement operations +* *Core Theorems*: Safety, compatibility, preservation + +*Main Theorem*: + +[source,agda] +---- +DyadicEchoBridgeTheorem : + Σ (Session Alice) (λ S → Σ (Session Bob) (λ T → EchoSafe S × EchoSafe T × EchoDual S T)) +---- + +==== 5. EchoEphapaxBridge `+[NARROW]+` + +*Location*: `+proofs/agda/EchoEphapaxBridge.agda+` + +*Purpose*: Cross-repo navigability marker for the +`+hyperpolymath/ephapax+` programming-language project, whose L3 layer +(`+formal/Echo.v+`, 584 lines, 24 `+Qed+`, zero `+Admitted+` / zero +`+Axiom+`) is an explicit Coq port of `+EchoLinear.agda+` + +`+EchoResidue.agda+` under a K-free / zero-axiom discipline equivalent +to `+--safe --without-K+`. + +*Scope* (intentionally NARROW, per `+/tmp/ephapax-bridge-proposal.md+` +§4): import-time documentation + two definitional `+refl+`-renames +pinning load-bearing Agda symbols under `+ephapax-L3-+`-prefixed names. +The cross-repo content correspondence is already discharged by `+coqc+` +on the ephapax side; *no Lane 4 CI dependency*. + +*Key Components*: + +* *`+ephapax-L3-weaken+`*: definitional alias for `+EchoLinear.weaken+` +(Coq counterpart: ephapax `+formal/Echo.v+` `+weaken+`) +* *`+ephapax-L3-no-section-collapse+`*: definitional alias for +`+EchoResidue.no-section-collapse-to-residue+` (Coq counterpart: ephapax +`+formal/Echo.v:502-517+` `+no_section_collapse_to_residue+`) + +*Cross-repo theorem table* (correspondence catalogued in the module +docstring): + +[width="100%",cols="50%,50%",options="header",] +|=== +|Agda (echo-types) |Coq (ephapax `+formal/Echo.v+`) +|`+EchoLinear+` mode order (linear ≤ affine) |`+mode_le_prop+` + +|`+EchoLinear.weaken-collapses-distinction+` +|`+weaken_collapses_distinction+` + +|Affine canonicality on `+LEcho affine+` |`+affine_canonical+`, +`+affine_all_equal+` + +|`+EchoLinear.degradeMode-comp+` |`+degrade_mode_comp+` + +|`+EchoResidue.no-section-collapse-to-residue+` +|`+no_section_collapse_to_residue+` +|=== + +*Scope discipline (honest)*: corroboration claim is *L3 only*. +Ephapax-affine has Rust checkers only (no Coq mechanisation); L1 has 5 +`+Axiom+` + 11 `+Admitted+`; L4 has no mechanised theorems yet. See +`+docs/echo-types/paper.adoc+` §"`Threats to validity`" for the full +honest-scope statement. + +*Main entry*: + +[source,agda] +---- +ephapax-L3-weaken : LEcho linear → LEcho affine +ephapax-L3-weaken = weaken +---- + +=== Integration Patterns + +==== JanusKey Integration + +[source,agda] +---- +-- Bridge to standard echo types +to-standard-echo : JanusEcho Create → Echo janus-to-unit tt +to-standard-echo echo = echo + +-- Round-trip preservation +round-trip-preservation : ∀ echo → to-standard-echo (from-standard-echo echo) ≡ echo +round-trip-preservation echo = refl +---- + +==== CNO Integration + +[source,agda] +---- +-- Null operation as identity +null-as-identity : CNOEcho NullOp → Echo cno-to-unit tt +null-as-identity echo = echo + +-- Operation composition +operation-composition : CNOEcho Read → CNOEcho Write → CNOEcho Read +operation-composition r w = r +---- + +=== Usage Examples + +==== JanusKey Filesystem Operations + +[source,agda] +---- +-- Create a file with echo provenance +create-with-provenance : JanusEcho Create +create-with-provenance = create-echo + +-- Delete a file with echo provenance +delete-with-provenance : JanusEcho Delete +delete-with-provenance = delete-echo + +-- Composite operation sequence +file-operation-sequence : JanusEcho Create → JanusEcho Delete → Echo janus-to-unit tt +file-operation-sequence create delete = create +---- + +==== CNO Certified Operations + +[source,agda] +---- +-- Read operation with provenance +certified-read : CNOEcho Read +certified-read = read-echo + +-- Write operation with provenance +certified-write : CNOEcho Write +certified-write = write-echo + +-- Null operation (identity) +certified-null : CNOEcho NullOp +certified-null = nullop-echo +---- + +=== Theoretical Foundations + +==== Echo Type Bridge Pattern + +All bridges follow the same pattern: + +[arabic] +. *Define Operation Types*: `+JanusOp+`, `+CNOOp+`, etc. +. *Map to Unit*: `+janus-to-unit+`, `+cno-to-unit+`, etc. +. *Create Echo Types*: `+Echo f y+` where `+f : Op → ⊤+` and `+y = tt+` +. *Prove Core Theorems*: Preservation, reversibility, composition +. *Add Practical Examples*: Real-world operation patterns + +==== Provenance Tracking + +The key insight is that echo types retain *provenance information* that +would be lost in plain output-only views: + +* *JanusKey*: Retains filesystem operation history +* *CNO*: Retains certified null operation constraints +* *Tropical*: Retains pre-tropical optimization constraints +* *Dyadic*: Retains protocol interaction history + +=== Roadmap + +==== Short-term (Next 4 Weeks) + +* [x] Complete ordinal infrastructure (E3-E7) +* [x] Add smoke tests (M13) +* [x] Enhance JanusKey bridge with examples +* [x] Enhance CNO bridge with examples +* [ ] Improve tropical bridge documentation +* [ ] Update roadmap documentation + +==== Medium-term (Next 3 Months) + +* [ ] Add more complex bridge examples +* [ ] Community review and feedback +* [ ] Integration with other proof assistants +* [ ] Performance characterization + +==== Long-term (6-12 Months) + +* [ ] Formal verification of bridges +* [ ] Standardization efforts +* [ ] Industrial applications +* [ ] Wider theoretical impact + +=== Stability Assessment + +[cols=",,,",options="header",] +|=== +|Bridge |Status |Stability |Documentation +|JanusKey |✅ Enhanced |A- |✅ Complete +|CNO |✅ Enhanced |A- |✅ Complete +|Tropical |✅ Complete |A |✅ Complete +|Dyadic |✅ Complete |A |✅ Complete +|=== + +=== Conclusion + +The echo types bridge modules provide a *solid foundation* for applying +echo types to various domains while maintaining the core theoretical +properties. All bridges are *production-ready for research use*, with +comprehensive documentation and practical examples. + +*Next Steps*: Continue enhancing with more complex examples and prepare +for community review. diff --git a/docs/bridges/EchoBridges.md b/docs/bridges/EchoBridges.md deleted file mode 100644 index 9cb78fa..0000000 --- a/docs/bridges/EchoBridges.md +++ /dev/null @@ -1,266 +0,0 @@ - - -# Echo Types Bridge Documentation - -## Overview - -This document provides comprehensive documentation for the echo types bridge modules, which extend the core echo type theory to various domains including JanusKey, CNO, Tropical, Dyadic, and Ephapax-L3 systems. - -## Bridge Modules - -### 1. EchoJanusBridge - -**Location**: `proofs/agda/EchoJanusBridge.agda` - -**Purpose**: Bridge between echo types and JanusKey's reversible filesystem operations. - -**Key Components**: - -- **JanusOp**: Operation types (Create, Delete, Modify, Move) -- **janus-to-unit**: Mapping from operations to unit -- **JanusEcho**: Echo types for each operation -- **Core Theorems**: Reversibility, preservation, composition - -**Practical Examples**: - -```agda --- File creation with echo provenance -file-creation-example : JanusEcho Create -file-creation-example = create-echo - --- File deletion with echo provenance -file-deletion-example : JanusEcho Delete -file-deletion-example = delete-echo - --- Composite operation sequence -composite-operation : JanusEcho Create → JanusEcho Delete → Echo janus-to-unit tt -composite-operation create delete = create -``` - -**Main Theorem**: -```agda -JanusEchoBridgeTheorem : - JanusEcho Create × JanusEcho Delete × JanusEcho Modify × JanusEcho Move -``` - -### 2. EchoCNOBridge - -**Location**: `proofs/agda/EchoCNOBridge.agda` - -**Purpose**: Bridge between echo types and Certified Null Operations. - -**Key Components**: - -- **CNOOp**: Operation types (Read, Write, Execute, NullOp) -- **cno-to-unit**: Mapping from operations to unit -- **CNOEcho**: Echo types for each operation -- **Core Theorems**: Preservation, null operation properties - -**Practical Examples**: - -```agda --- Read operation with echo provenance -read-operation-example : CNOEcho Read -read-operation-example = read-echo - --- Null operation with echo provenance -null-operation-example : CNOEcho NullOp -null-operation-example = nullop-echo - --- Operation sequence with provenance -operation-sequence : CNOEcho Read → CNOEcho Write → Echo cno-to-unit tt -operation-sequence read write = read -``` - -**Main Theorem**: -```agda -CNOEchoBridgeTheorem : - CNOEcho Read × CNOEcho Write × CNOEcho Execute × CNOEcho NullOp -``` - -### 3. EchoTropical - -**Location**: `proofs/agda/EchoTropical.agda` - -**Purpose**: Bridge between echo types and tropical semiring structure. - -**Key Components**: - -- **Tropical Semiring**: Max-plus operations (⊕, ⊗) -- **Candidate System**: Three candidates with scoring -- **TropEcho**: Tropical echo with optimality certification -- **Core Theorems**: Non-injectivity, echo retention - -**Main Theorem**: -```agda -distinct-candidates-same-visible-distinct-echo : - score a ≡ score b × echo-a ≢ echo-b -``` - -### 4. EchoDyadic - -**Location**: `proofs/agda/Dyadic.agda` - -**Purpose**: Dyadic session types with echo provenance. - -**Key Components**: - -- **Party**: Alice and Bob roles -- **Session**: Dyadic session types (Send, Recv, Choice, Select) -- **Duality**: Protocol complement operations -- **Core Theorems**: Safety, compatibility, preservation - -**Main Theorem**: -```agda -DyadicEchoBridgeTheorem : - Σ (Session Alice) (λ S → Σ (Session Bob) (λ T → EchoSafe S × EchoSafe T × EchoDual S T)) -``` - -### 5. EchoEphapaxBridge `[NARROW]` - -**Location**: `proofs/agda/EchoEphapaxBridge.agda` - -**Purpose**: Cross-repo navigability marker for the `hyperpolymath/ephapax` programming-language project, whose L3 layer (`formal/Echo.v`, 584 lines, 24 `Qed`, zero `Admitted` / zero `Axiom`) is an explicit Coq port of `EchoLinear.agda` + `EchoResidue.agda` under a K-free / zero-axiom discipline equivalent to `--safe --without-K`. - -**Scope** (intentionally NARROW, per `/tmp/ephapax-bridge-proposal.md` §4): import-time documentation + two definitional `refl`-renames pinning load-bearing Agda symbols under `ephapax-L3-`-prefixed names. The cross-repo content correspondence is already discharged by `coqc` on the ephapax side; **no Lane 4 CI dependency**. - -**Key Components**: - -- **`ephapax-L3-weaken`**: definitional alias for `EchoLinear.weaken` (Coq counterpart: ephapax `formal/Echo.v` `weaken`) -- **`ephapax-L3-no-section-collapse`**: definitional alias for `EchoResidue.no-section-collapse-to-residue` (Coq counterpart: ephapax `formal/Echo.v:502-517` `no_section_collapse_to_residue`) - -**Cross-repo theorem table** (correspondence catalogued in the module docstring): - -| Agda (echo-types) | Coq (ephapax `formal/Echo.v`) | -|---|---| -| `EchoLinear` mode order (linear ≤ affine) | `mode_le_prop` | -| `EchoLinear.weaken-collapses-distinction` | `weaken_collapses_distinction` | -| Affine canonicality on `LEcho affine` | `affine_canonical`, `affine_all_equal` | -| `EchoLinear.degradeMode-comp` | `degrade_mode_comp` | -| `EchoResidue.no-section-collapse-to-residue` | `no_section_collapse_to_residue` | - -**Scope discipline (honest)**: corroboration claim is **L3 only**. Ephapax-affine has Rust checkers only (no Coq mechanisation); L1 has 5 `Axiom` + 11 `Admitted`; L4 has no mechanised theorems yet. See `docs/echo-types/paper.adoc` §"Threats to validity" for the full honest-scope statement. - -**Main entry**: -```agda -ephapax-L3-weaken : LEcho linear → LEcho affine -ephapax-L3-weaken = weaken -``` - -## Integration Patterns - -### JanusKey Integration - -```agda --- Bridge to standard echo types -to-standard-echo : JanusEcho Create → Echo janus-to-unit tt -to-standard-echo echo = echo - --- Round-trip preservation -round-trip-preservation : ∀ echo → to-standard-echo (from-standard-echo echo) ≡ echo -round-trip-preservation echo = refl -``` - -### CNO Integration - -```agda --- Null operation as identity -null-as-identity : CNOEcho NullOp → Echo cno-to-unit tt -null-as-identity echo = echo - --- Operation composition -operation-composition : CNOEcho Read → CNOEcho Write → CNOEcho Read -operation-composition r w = r -``` - -## Usage Examples - -### JanusKey Filesystem Operations - -```agda --- Create a file with echo provenance -create-with-provenance : JanusEcho Create -create-with-provenance = create-echo - --- Delete a file with echo provenance -delete-with-provenance : JanusEcho Delete -delete-with-provenance = delete-echo - --- Composite operation sequence -file-operation-sequence : JanusEcho Create → JanusEcho Delete → Echo janus-to-unit tt -file-operation-sequence create delete = create -``` - -### CNO Certified Operations - -```agda --- Read operation with provenance -certified-read : CNOEcho Read -certified-read = read-echo - --- Write operation with provenance -certified-write : CNOEcho Write -certified-write = write-echo - --- Null operation (identity) -certified-null : CNOEcho NullOp -certified-null = nullop-echo -``` - -## Theoretical Foundations - -### Echo Type Bridge Pattern - -All bridges follow the same pattern: - -1. **Define Operation Types**: `JanusOp`, `CNOOp`, etc. -2. **Map to Unit**: `janus-to-unit`, `cno-to-unit`, etc. -3. **Create Echo Types**: `Echo f y` where `f : Op → ⊤` and `y = tt` -4. **Prove Core Theorems**: Preservation, reversibility, composition -5. **Add Practical Examples**: Real-world operation patterns - -### Provenance Tracking - -The key insight is that echo types retain **provenance information** that would be lost in plain output-only views: - -- **JanusKey**: Retains filesystem operation history -- **CNO**: Retains certified null operation constraints -- **Tropical**: Retains pre-tropical optimization constraints -- **Dyadic**: Retains protocol interaction history - -## Roadmap - -### Short-term (Next 4 Weeks) -- [x] Complete ordinal infrastructure (E3-E7) -- [x] Add smoke tests (M13) -- [x] Enhance JanusKey bridge with examples -- [x] Enhance CNO bridge with examples -- [ ] Improve tropical bridge documentation -- [ ] Update roadmap documentation - -### Medium-term (Next 3 Months) -- [ ] Add more complex bridge examples -- [ ] Community review and feedback -- [ ] Integration with other proof assistants -- [ ] Performance characterization - -### Long-term (6-12 Months) -- [ ] Formal verification of bridges -- [ ] Standardization efforts -- [ ] Industrial applications -- [ ] Wider theoretical impact - -## Stability Assessment - -| Bridge | Status | Stability | Documentation | -|--------|--------|-----------|---------------| -| JanusKey | ✅ Enhanced | A- | ✅ Complete | -| CNO | ✅ Enhanced | A- | ✅ Complete | -| Tropical | ✅ Complete | A | ✅ Complete | -| Dyadic | ✅ Complete | A | ✅ Complete | - -## Conclusion - -The echo types bridge modules provide a **solid foundation** for applying echo types to various domains while maintaining the core theoretical properties. All bridges are **production-ready for research use**, with comprehensive documentation and practical examples. - -**Next Steps**: Continue enhancing with more complex examples and prepare for community review. diff --git a/docs/bridges/EchoJanusBridge.adoc b/docs/bridges/EchoJanusBridge.adoc new file mode 100644 index 0000000..57e5bea --- /dev/null +++ b/docs/bridges/EchoJanusBridge.adoc @@ -0,0 +1,177 @@ +== Echo Types - JanusKey Bridge: Formal Foundations for Reversibility + +=== Overview + +This document establishes the theoretical connection between *echo +types* (constructive fiber theory) and *JanusKey’s* architectural +reversibility guarantees. The bridge provides a formal foundation for +JanusKey’s claim of "`architecturally impossible data loss`" using the +mathematical framework of echo types. + +=== Core Concepts + +==== Echo Types + +Echo types formalize the notion of "`fibers`" over functions: + +[source,agda] +---- +Echo f y = Σ (x : A) , (f x ≡ y) +---- + +An echo represents all inputs `+x+` that map to output `+y+` under +function `+f+`, together with proof that `+f x ≡ y+`. + +==== JanusKey Operations + +JanusKey implements reversible file operations: - *Delete*: Stores +content + metadata for restoration - *Modify*: Stores original content +hash for rollback + +- *Move*: Stores original path for unmove - *Create*: Stores creation +metadata for deletion + +=== The Bridge: Key Theorems + +==== 1. Operation Reversibility via Echo Types + +Each JanusKey operation is modeled as a function `+f : A → B+` where: - +`+A+` = original file system state - `+B+` = resulting file system state +- `+Echo f b+` = all original states that could produce result `+b+` + +*Theorems:* + +[source,agda] +---- +delete-reversible : EchoDelete path fs' → Σ (fs : FileSystem) , (delete-op path fs ≡ fs') +create-reversible : EchoCreate path content fs' → Σ (fs : FileSystem) , (create-op path content fs ≡ fs') +-- etc. for modify, move +---- + +==== 2. Metadata Preservation + +JanusKey’s content store directly corresponds to echo type fibers: + +[source,agda] +---- +metadata-preservation : Echo f y → Σ (x : A) , (f x ≡ y) +---- + +The echo witness `+(x , p)+` contains: - `+x+`: Original state (stored +in JanusKey’s content store) - `+p+`: Proof of transformation (stored in +JanusKey’s metadata) + +==== 3. Transaction Composition + +JanusKey transactions are echo type composition: + +[source,agda] +---- +transaction-reversibility : Echo f (f x) → Echo g (g (f x)) → Echo (g ∘ f) (g (f x)) +---- + +This proves that sequences of reversible operations remain reversible. + +=== Architectural Correspondence + +[cols=",",options="header",] +|=== +|JanusKey Component |Echo Type Equivalent +|Content Store |Echo fiber elements (original states) +|Metadata Store |Echo witnesses (proofs of transformation) +|Operation Log |Sequence of echo types +|Undo Operation |Echo projection (extract original state) +|Transaction |Echo composition +|=== + +=== Practical Implications + +==== 1. Formal Proof of Reversibility + +The bridge provides a constructive proof that JanusKey operations +satisfy the echo type reversibility property: + +[source,agda] +---- +januskey-formal-foundation : Echo f y → Σ (x : A) , (f x ≡ y) +---- + +This means for every operation result, we can recover the original +state. + +==== 2. Data Loss Impossibility + +Since echo types guarantee fiber inhabitation: - If `+Echo f y+` is +inhabited, there exists `+x+` such that `+f x ≡ y+` - JanusKey stores +sufficient metadata to ensure echo fibers are always inhabited - +Therefore, reversal is always possible + +==== 3. Compositional Guarantees + +The echo type framework proves that: - Composition of reversible +operations is reversible - Transactions preserve reversibility - Nested +operations maintain reversal properties + +=== Examples + +==== Delete Operation + +[source,agda] +---- +-- Original state: fs-with-file +-- Operation: delete "test.txt" +-- Result: fs-without-file + +-- Echo witness: (fs-with-file, refl) +-- This witness contains the original state needed for undo + +delete-existing-example : EchoDelete "test.txt" (delete-op "test.txt" fs-with-file) +delete-existing-example = fs-with-file , refl +---- + +==== Transaction Composition + +[source,agda] +---- +-- Operation 1: Create file A +-- Operation 2: Modify file A +-- Transaction: Create then Modify + +-- Echo composition shows the combined operation is reversible +-- The witness contains both original states +---- + +=== Theoretical Significance + +[arabic] +. *Constructive Proof*: Echo types provide constructive evidence of +reversibility +. *Architectural Validation*: JanusKey’s design choices are +mathematically justified +. *Compositional Reasoning*: Complex operation sequences can be analyzed +formally +. *Type-Theoretic Foundation*: Reversibility is not just implemented but +proven + +=== Future Work + +* Formal verification of JanusKey’s Rust implementation against echo +type specifications +* Integration with MAA Framework’s reversibility proofs +* Extension to distributed file system operations +* Performance analysis of echo-based reversal algorithms + +=== Conclusion + +The Echo-JanusKey bridge establishes that JanusKey’s reversibility +guarantees are not merely architectural claims but mathematically proven +properties. By modeling file operations as echo types, we obtain +constructive proofs that: + +[arabic] +. Every operation preserves sufficient information for perfect reversal +. Data loss is architecturally impossible +. Transaction composition maintains reversibility +. The system satisfies the formal criteria for reversible computing + +This bridge provides the missing link between JanusKey’s practical +implementation and the formal theory of reversible computation. diff --git a/docs/bridges/EchoJanusBridge.md b/docs/bridges/EchoJanusBridge.md deleted file mode 100644 index 09b7445..0000000 --- a/docs/bridges/EchoJanusBridge.md +++ /dev/null @@ -1,147 +0,0 @@ - - -# Echo Types - JanusKey Bridge: Formal Foundations for Reversibility - -## Overview - -This document establishes the theoretical connection between **echo types** (constructive fiber theory) and **JanusKey's** architectural reversibility guarantees. The bridge provides a formal foundation for JanusKey's claim of "architecturally impossible data loss" using the mathematical framework of echo types. - -## Core Concepts - -### Echo Types -Echo types formalize the notion of "fibers" over functions: -```agda -Echo f y = Σ (x : A) , (f x ≡ y) -``` -An echo represents all inputs `x` that map to output `y` under function `f`, together with proof that `f x ≡ y`. - -### JanusKey Operations -JanusKey implements reversible file operations: -- **Delete**: Stores content + metadata for restoration -- **Modify**: Stores original content hash for rollback -- **Move**: Stores original path for unmove -- **Create**: Stores creation metadata for deletion - -## The Bridge: Key Theorems - -### 1. Operation Reversibility via Echo Types - -Each JanusKey operation is modeled as a function `f : A → B` where: -- `A` = original file system state -- `B` = resulting file system state -- `Echo f b` = all original states that could produce result `b` - -**Theorems:** -```agda -delete-reversible : EchoDelete path fs' → Σ (fs : FileSystem) , (delete-op path fs ≡ fs') -create-reversible : EchoCreate path content fs' → Σ (fs : FileSystem) , (create-op path content fs ≡ fs') --- etc. for modify, move -``` - -### 2. Metadata Preservation - -JanusKey's content store directly corresponds to echo type fibers: - -```agda -metadata-preservation : Echo f y → Σ (x : A) , (f x ≡ y) -``` - -The echo witness `(x , p)` contains: -- `x`: Original state (stored in JanusKey's content store) -- `p`: Proof of transformation (stored in JanusKey's metadata) - -### 3. Transaction Composition - -JanusKey transactions are echo type composition: - -```agda -transaction-reversibility : Echo f (f x) → Echo g (g (f x)) → Echo (g ∘ f) (g (f x)) -``` - -This proves that sequences of reversible operations remain reversible. - -## Architectural Correspondence - -| JanusKey Component | Echo Type Equivalent | -|-------------------|----------------------| -| Content Store | Echo fiber elements (original states) | -| Metadata Store | Echo witnesses (proofs of transformation) | -| Operation Log | Sequence of echo types | -| Undo Operation | Echo projection (extract original state) | -| Transaction | Echo composition | - -## Practical Implications - -### 1. Formal Proof of Reversibility - -The bridge provides a constructive proof that JanusKey operations satisfy the echo type reversibility property: - -```agda -januskey-formal-foundation : Echo f y → Σ (x : A) , (f x ≡ y) -``` - -This means for every operation result, we can recover the original state. - -### 2. Data Loss Impossibility - -Since echo types guarantee fiber inhabitation: -- If `Echo f y` is inhabited, there exists `x` such that `f x ≡ y` -- JanusKey stores sufficient metadata to ensure echo fibers are always inhabited -- Therefore, reversal is always possible - -### 3. Compositional Guarantees - -The echo type framework proves that: -- Composition of reversible operations is reversible -- Transactions preserve reversibility -- Nested operations maintain reversal properties - -## Examples - -### Delete Operation -```agda --- Original state: fs-with-file --- Operation: delete "test.txt" --- Result: fs-without-file - --- Echo witness: (fs-with-file, refl) --- This witness contains the original state needed for undo - -delete-existing-example : EchoDelete "test.txt" (delete-op "test.txt" fs-with-file) -delete-existing-example = fs-with-file , refl -``` - -### Transaction Composition -```agda --- Operation 1: Create file A --- Operation 2: Modify file A --- Transaction: Create then Modify - --- Echo composition shows the combined operation is reversible --- The witness contains both original states -``` - -## Theoretical Significance - -1. **Constructive Proof**: Echo types provide constructive evidence of reversibility -2. **Architectural Validation**: JanusKey's design choices are mathematically justified -3. **Compositional Reasoning**: Complex operation sequences can be analyzed formally -4. **Type-Theoretic Foundation**: Reversibility is not just implemented but proven - -## Future Work - -- Formal verification of JanusKey's Rust implementation against echo type specifications -- Integration with MAA Framework's reversibility proofs -- Extension to distributed file system operations -- Performance analysis of echo-based reversal algorithms - -## Conclusion - -The Echo-JanusKey bridge establishes that JanusKey's reversibility guarantees are not merely architectural claims but mathematically proven properties. By modeling file operations as echo types, we obtain constructive proofs that: - -1. Every operation preserves sufficient information for perfect reversal -2. Data loss is architecturally impossible -3. Transaction composition maintains reversibility -4. The system satisfies the formal criteria for reversible computing - -This bridge provides the missing link between JanusKey's practical implementation and the formal theory of reversible computation. \ No newline at end of file diff --git a/docs/bridges/buchholz-extended-wf.adoc b/docs/bridges/buchholz-extended-wf.adoc new file mode 100644 index 0000000..76c377f --- /dev/null +++ b/docs/bridges/buchholz-extended-wf.adoc @@ -0,0 +1,166 @@ +== Buchholz `+_<ᵇ⁺_+`: well-foundedness gap + +`+Ordinal.Buchholz.OrderExtended._<ᵇ⁺_+` adds two shared-binder lex +constructors on top of `+Ordinal.Buchholz.Order._<ᵇ_+`: + +* *`+<ᵇ⁺-ψα+`* — `+bpsi ν α <ᵇ⁺ bpsi ν β+` whenever `+α <ᵇ β+` (lex on +the ψ-argument at a fixed Ω-index). +* *`+<ᵇ⁺-+2+`* — `+bplus x y₁ <ᵇ⁺ bplus x y₂+` whenever `+y₁ <ᵇ y₂+` +(lex on the right summand at a fixed left summand). + +`+<ᵇ⁺-irrefl+` and `+<ᵇ⁺-trans+` are proved. *Well-foundedness for +`+_<ᵇ⁺_+` is open.* This note records why and sketches the two viable +design routes. + +=== Why `+wf-<ᵇ+` does not extend directly + +`+Ordinal.Buchholz.WellFounded.wf-<ᵇ+` is built from a per-Ω-index +bundle: + +[source,agda] +---- +ΩBundle μ = Acc _<ᵇ_ (bOmega μ) × ((α : BT) → Acc _<ᵇ_ (bpsi μ α)) + +<ᵇ-bundle-fromΩ : ∀ {μ} → Acc _<Ω_ μ → ΩBundle μ +---- + +The bundle’s `+psiAcc α+` returns `+Acc _<ᵇ_ (bpsi μ α)+` for any `+α+`, +discharging predecessors via case analysis on `+_<ᵇ_+`’s constructors. +The new `+<ᵇ⁺-ψα+` constructor introduces predecessors shaped +`+bpsi μ β+` for arbitrary `+β <ᵇ α+`. Discharging those needs recursion +on `+Acc _<ᵇ_ α+` — but `+psiAcc+` does not carry an `+Acc α+` argument, +so the natural attempt + +[source,agda] +---- +predPsi α (<ᵇ-ψα {α = β} refl _) = psiAcc β +---- + +calls `+psiAcc β+` with `+β+` strictly smaller than `+α+` only via +`+<ᵇ+`, not structurally. Agda’s termination checker rejects the mutual +cycle `+predPsi → psiAcc → predPsi+` because the first argument does not +decrease. + +Symmetrically, `+<ᵇ⁺-+2+` introduces predecessors `+bplus α y₁+` for +arbitrary `+y₁ <ᵇ y₂+`, and the existing `+<ᵇ-acc-bplus-from+` only +threads `+Acc _<ᵇ_ α+` (the left summand), so the right-summand lex case +has no decreasing measure either. + +=== Two design routes + +==== Route A — single-mutual block with widened bundle + +Replace the per-Ω-index bundle with a single mutual block in which: + +[source,agda] +---- +ΩBundle μ = Acc _<ᵇ_ (bOmega μ) + × ((α : BT) → Acc _<ᵇ_ α → Acc _<ᵇ_ (bpsi μ α)) + +<ᵇ-acc-bplus-from-both : + ∀ {α β} → Acc _<ᵇ_ α → Acc _<ᵇ_ β → Acc _<ᵇ_ (bplus α β) +---- + +i.e. the ψ-side of the bundle takes `+Acc _<ᵇ_ α+` as a parameter, and +`+bplus+`-acc takes `+Acc _<ᵇ_+` for *both* summands. `+wf-<ᵇ+` becomes +mutual with the bundle and supplies the extra `+Acc+` args via BT +structural recursion (`+wf-<ᵇ α+` for the smaller subterm). + +*Status of attempt.* Drafted twice (in this PR and again by a parallel +session on 2026-04-28); both attempts are constructionally identical and +both are rejected by Agda’s termination checker. The reported cycle is +`+pred-bpsi-from → wf-<ᵇ → <ᵇ-acc-bpsi → <ᵇ-acc-bpsi-from+`. The cycle +is well-founded in lex order on `+(BT-structure of carrier, witness)+`, +but Agda does not see the witness as decreasing the BT carrier without +an explicit size-measure annotation. A sized-types or explicit measure +encoding (e.g. via `+Induction.WellFounded.<-rec+` with a measure into ℕ +× ℕ) is the next thing to try; failing that, fall back to Route B. + +==== Route B — rank-embedding into Brouwer ordinals + +Define `+rank : BT → Ord+` (Brouwer, already present in +`+Ordinal.Brouwer+`) such that `+x <ᵇ⁺ y → rank x < rank y+`. Then WF +for `+_<ᵇ⁺_+` follows from `+Ordinal.Brouwer.wf-<+` by transport along +`+rank+`. + +Sketch of `+rank+`: + +[source,agda] +---- +rank bzero = oz +rank (bOmega μ) = ω-rank μ +rank (bplus α β) = rank α ⊕ rank β +rank (bpsi μ α) = psi-rank μ ⊕ rank α -- conjectural form +---- + +The arithmetic infrastructure (`+_⊕_+`, `+nat-to-ord+`, `+ω-rank+`, +`+psi-rank+`) is in `+Ordinal.Brouwer.Arithmetic+`. The strict decrease +must hold on every `+<ᵇ⁺+` constructor: + +* `+<ᵇ-ψΩ μ<ν+` — Ω-index decrease must dominate the ψ-arg comparison; +needs `+psi-rank+` to be strictly monotone in μ at a rate that swamps +`+_⊕_+`-additions of the ψ-arg. +* `+<ᵇ⁺-ψα+` — ψ-arg strict decrease at fixed μ; needs +`+psi-rank μ ⊕ ·+` to preserve `+<+` on the right. +* `+<ᵇ⁺-+2+` — right-summand strict decrease at fixed left; needs +`+· ⊕ rank α+` to be `+<+`-monotone on the left. + +*Status.* Not attempted yet. The constructive Brouwer-ordinal arithmetic +in this repo is light (Phase 1.1/1.2); some of the strict-monotonicity +lemmas the `+rank+` proof would need are not yet present. + +=== Pragmatic interim — leave `+_<ᵇ_+` and `+_<ᵇ⁺_+` separate + +Today’s commit ships the constructors in `+_<ᵇ⁺_+` only, leaving +`+Ordinal.Buchholz.Order._<ᵇ_+` (and its `+wf-<ᵇ+`) intact. Downstream +consumers that need only the K-free core (e.g. the +`+VeblenComparisonModel+` chain) keep their existing WF guarantee. +Consumers that need the lex cases use `+_<ᵇ⁺_+` and accept that WF is +not yet established for it. + +=== Recommended next attempt (HISTORICAL — superseded 2026-05-20) + +Route B (rank-embedding) was previously labelled lower-risk because the +arithmetic lemmas needed seemed bounded and discoverable. That verdict +is now *WRONG*. + +*Route B is impossible* for the current `+_<ᵇ_+`. The constructor +`+<ᵇ-+Ω : x <ᵇ bOmega μ → bplus x y <ᵇ bOmega μ+` is ordinally unsound +(concrete refutation: `+bplus bzero (bOmega (fin 1)) <ᵇ bOmega (fin 0)+` +exists via `+<ᵇ-+Ω <ᵇ-0-Ω+`, but any additive `+rank+` gives the LHS +larger than the RHS). No additive, multiplicative, or constructive +ordinal arithmetic on `+rank x+` and `+rank y+` resolves the joint +`+<ᵇ-+Ω+` ∧ `+<ᵇʳᶠ-+2+` tension. See `+buchholz-rank-obstruction.adoc+` +for the full analysis. Verified empirically 2026-05-20 that _all five_ +plausible routes are walled — rank-embedding, direct mutual structural +recursion (Agda termination error: `+wf-<ᵇʳᶠ x₂+` non-decreasing), +tower- stratification through `+LiftedOrder+` (refuted by +`+surfaceLiftBlocked+`’s shape — wrapper non-self-stability propagates +upward), lex-measure into ℕ, and inverse-image into `+_<ᵇʳᶠᵇ_+`. + +Route A’s "`Agda termination checker is harder to debug than provable +mathematics`" framing is also corrected: the mathematics turns out not +to be provable at all for the current `+_<ᵇ_+`. The termination check +was the right oracle. + +*What this means.* Both `+_<ᵇ⁺_+` and `+_<ᵇʳᶠ_+` retain their budgeted +forms as the canonical well-foundedness statements (`+_<ᵇ⁺ᵇ_+` newly in +`+Ordinal.Buchholz.OrderExtendedBudget+`, mirroring the existing +`+_<ᵇʳᶠᵇ_+`). To recover unbudgeted WF would require either restricting +`+_<ᵇ_+` to a `+WellFormed+` subset (2–3 weeks of +constructor-by-constructor rework + transitivity + inversion re-proof) +or providing a non-additive denotational measure (essentially solving +Buchholz WF "`from the model up`", a substantially larger project than +the rank-embedding route was ever framed as). + +=== See also + +* `+proofs/agda/Ordinal/Buchholz/Order.agda+` — the K-free core. +* `+proofs/agda/Ordinal/Buchholz/OrderExtended.agda+` — the extended +relation defined in this PR. +* `+proofs/agda/Ordinal/Buchholz/WellFounded.agda+` — the bundle proof +for `+_<ᵇ_+`. +* `+proofs/agda/Ordinal/Brouwer.agda+`, +`+proofs/agda/Ordinal/Brouwer/Arithmetic.agda+` — the rank target if +Route B is taken. +* `+docs/buchholz-plan.adoc+` — the broader Buchholz workstream. diff --git a/docs/bridges/buchholz-extended-wf.md b/docs/bridges/buchholz-extended-wf.md deleted file mode 100644 index 125fcd8..0000000 --- a/docs/bridges/buchholz-extended-wf.md +++ /dev/null @@ -1,170 +0,0 @@ - - -# Buchholz `_<ᵇ⁺_`: well-foundedness gap - -`Ordinal.Buchholz.OrderExtended._<ᵇ⁺_` adds two shared-binder lex -constructors on top of `Ordinal.Buchholz.Order._<ᵇ_`: - -* **`<ᵇ⁺-ψα`** — `bpsi ν α <ᵇ⁺ bpsi ν β` whenever `α <ᵇ β` - (lex on the ψ-argument at a fixed Ω-index). -* **`<ᵇ⁺-+2`** — `bplus x y₁ <ᵇ⁺ bplus x y₂` whenever `y₁ <ᵇ y₂` - (lex on the right summand at a fixed left summand). - -`<ᵇ⁺-irrefl` and `<ᵇ⁺-trans` are proved. **Well-foundedness for -`_<ᵇ⁺_` is open.** This note records why and sketches the two -viable design routes. - -## Why `wf-<ᵇ` does not extend directly - -`Ordinal.Buchholz.WellFounded.wf-<ᵇ` is built from a per-Ω-index -bundle: - -```agda -ΩBundle μ = Acc _<ᵇ_ (bOmega μ) × ((α : BT) → Acc _<ᵇ_ (bpsi μ α)) - -<ᵇ-bundle-fromΩ : ∀ {μ} → Acc _<Ω_ μ → ΩBundle μ -``` - -The bundle's `psiAcc α` returns `Acc _<ᵇ_ (bpsi μ α)` for any `α`, -discharging predecessors via case analysis on `_<ᵇ_`'s -constructors. The new `<ᵇ⁺-ψα` constructor introduces predecessors -shaped `bpsi μ β` for arbitrary `β <ᵇ α`. Discharging those needs -recursion on `Acc _<ᵇ_ α` — but `psiAcc` does not carry an `Acc α` -argument, so the natural attempt - -```agda -predPsi α (<ᵇ-ψα {α = β} refl _) = psiAcc β -``` - -calls `psiAcc β` with `β` strictly smaller than `α` only via -`<ᵇ`, not structurally. Agda's termination checker rejects the -mutual cycle `predPsi → psiAcc → predPsi` because the first -argument does not decrease. - -Symmetrically, `<ᵇ⁺-+2` introduces predecessors `bplus α y₁` for -arbitrary `y₁ <ᵇ y₂`, and the existing `<ᵇ-acc-bplus-from` only -threads `Acc _<ᵇ_ α` (the left summand), so the right-summand lex -case has no decreasing measure either. - -## Two design routes - -### Route A — single-mutual block with widened bundle - -Replace the per-Ω-index bundle with a single mutual block in -which: - -```agda -ΩBundle μ = Acc _<ᵇ_ (bOmega μ) - × ((α : BT) → Acc _<ᵇ_ α → Acc _<ᵇ_ (bpsi μ α)) - -<ᵇ-acc-bplus-from-both : - ∀ {α β} → Acc _<ᵇ_ α → Acc _<ᵇ_ β → Acc _<ᵇ_ (bplus α β) -``` - -i.e. the ψ-side of the bundle takes `Acc _<ᵇ_ α` as a parameter, -and `bplus`-acc takes `Acc _<ᵇ_` for **both** summands. `wf-<ᵇ` -becomes mutual with the bundle and supplies the extra `Acc` args -via BT structural recursion (`wf-<ᵇ α` for the smaller subterm). - -**Status of attempt.** Drafted twice (in this PR and again by a -parallel session on 2026-04-28); both attempts are -constructionally identical and both are rejected by Agda's -termination checker. The reported cycle is -`pred-bpsi-from → wf-<ᵇ → <ᵇ-acc-bpsi → <ᵇ-acc-bpsi-from`. The -cycle is well-founded in lex order on -`(BT-structure of carrier, witness)`, but Agda does not see the -witness as decreasing the BT carrier without an explicit -size-measure annotation. A sized-types or explicit measure -encoding (e.g. via `Induction.WellFounded.<-rec` with a measure -into ℕ × ℕ) is the next thing to try; failing that, fall back -to Route B. - -### Route B — rank-embedding into Brouwer ordinals - -Define `rank : BT → Ord` (Brouwer, already present in -`Ordinal.Brouwer`) such that `x <ᵇ⁺ y → rank x < rank y`. Then -WF for `_<ᵇ⁺_` follows from `Ordinal.Brouwer.wf-<` by -transport along `rank`. - -Sketch of `rank`: - -```agda -rank bzero = oz -rank (bOmega μ) = ω-rank μ -rank (bplus α β) = rank α ⊕ rank β -rank (bpsi μ α) = psi-rank μ ⊕ rank α -- conjectural form -``` - -The arithmetic infrastructure (`_⊕_`, `nat-to-ord`, `ω-rank`, -`psi-rank`) is in `Ordinal.Brouwer.Arithmetic`. The strict -decrease must hold on every `<ᵇ⁺` constructor: - -* `<ᵇ-ψΩ μ<ν` — Ω-index decrease must dominate the ψ-arg - comparison; needs `psi-rank` to be strictly monotone in μ at a - rate that swamps `_⊕_`-additions of the ψ-arg. -* `<ᵇ⁺-ψα` — ψ-arg strict decrease at fixed μ; needs - `psi-rank μ ⊕ ·` to preserve `<` on the right. -* `<ᵇ⁺-+2` — right-summand strict decrease at fixed left; - needs `· ⊕ rank α` to be `<`-monotone on the left. - -**Status.** Not attempted yet. The constructive Brouwer-ordinal -arithmetic in this repo is light (Phase 1.1/1.2); some of the -strict-monotonicity lemmas the `rank` proof would need are not -yet present. - -## Pragmatic interim — leave `_<ᵇ_` and `_<ᵇ⁺_` separate - -Today's commit ships the constructors in `_<ᵇ⁺_` only, leaving -`Ordinal.Buchholz.Order._<ᵇ_` (and its `wf-<ᵇ`) intact. Downstream -consumers that need only the K-free core (e.g. the -`VeblenComparisonModel` chain) keep their existing WF guarantee. -Consumers that need the lex cases use `_<ᵇ⁺_` and accept that -WF is not yet established for it. - -## Recommended next attempt (HISTORICAL — superseded 2026-05-20) - -Route B (rank-embedding) was previously labelled lower-risk because -the arithmetic lemmas needed seemed bounded and discoverable. That -verdict is now **WRONG**. - -**Route B is impossible** for the current `_<ᵇ_`. The constructor -`<ᵇ-+Ω : x <ᵇ bOmega μ → bplus x y <ᵇ bOmega μ` is ordinally unsound -(concrete refutation: `bplus bzero (bOmega (fin 1)) <ᵇ bOmega (fin 0)` -exists via `<ᵇ-+Ω <ᵇ-0-Ω`, but any additive `rank` gives the LHS -larger than the RHS). No additive, multiplicative, or constructive -ordinal arithmetic on `rank x` and `rank y` resolves the joint -`<ᵇ-+Ω` ∧ `<ᵇʳᶠ-+2` tension. See `buchholz-rank-obstruction.adoc` -for the full analysis. Verified empirically 2026-05-20 that *all five* -plausible routes are walled — rank-embedding, direct mutual structural -recursion (Agda termination error: `wf-<ᵇʳᶠ x₂` non-decreasing), tower- -stratification through `LiftedOrder` (refuted by `surfaceLiftBlocked`'s -shape — wrapper non-self-stability propagates upward), lex-measure -into ℕ, and inverse-image into `_<ᵇʳᶠᵇ_`. - -Route A's "Agda termination checker is harder to debug than provable -mathematics" framing is also corrected: the mathematics turns out -not to be provable at all for the current `_<ᵇ_`. The termination -check was the right oracle. - -**What this means.** Both `_<ᵇ⁺_` and `_<ᵇʳᶠ_` retain their -budgeted forms as the canonical well-foundedness statements -(`_<ᵇ⁺ᵇ_` newly in `Ordinal.Buchholz.OrderExtendedBudget`, -mirroring the existing `_<ᵇʳᶠᵇ_`). To recover unbudgeted WF would -require either restricting `_<ᵇ_` to a `WellFormed` subset -(2–3 weeks of constructor-by-constructor rework + transitivity + -inversion re-proof) or providing a non-additive denotational -measure (essentially solving Buchholz WF "from the model up", a -substantially larger project than the rank-embedding route was -ever framed as). - -## See also - -* `proofs/agda/Ordinal/Buchholz/Order.agda` — the K-free core. -* `proofs/agda/Ordinal/Buchholz/OrderExtended.agda` — the - extended relation defined in this PR. -* `proofs/agda/Ordinal/Buchholz/WellFounded.agda` — the bundle - proof for `_<ᵇ_`. -* `proofs/agda/Ordinal/Brouwer.agda`, - `proofs/agda/Ordinal/Brouwer/Arithmetic.agda` — the rank - target if Route B is taken. -* `docs/buchholz-plan.adoc` — the broader Buchholz workstream. diff --git a/docs/bridges/cross-repo-bridge-status.adoc b/docs/bridges/cross-repo-bridge-status.adoc new file mode 100644 index 0000000..ef3e53d --- /dev/null +++ b/docs/bridges/cross-repo-bridge-status.adoc @@ -0,0 +1,372 @@ +== Cross-Repo Bridge Status + +Last updated: 2026-06-21. + +This file is the single status ledger for echo-type bridge work that +touches other repositories. + +=== Tracks + +[width="100%",cols="20%,20%,20%,20%,20%",options="header",] +|=== +|Track |echo-types side |Adjacent side |Current status |Main blocker +|CNO bridge (Agda) |`+proofs/agda/EchoCNOBridge.agda+` +|`+absolute-zero/proofs/agda/CNO.agda+` (direct import) |*Content-bridge +done.* Bridge imports `+IsCNO+`, `+empty-is-cno+`, `+halt-is-cno+`, +`+cno-composition+`, `+absolute-zero-is-cno+`, `+seq-comp+` from +absolute-zero’s `+CNO.agda+` and exhibits +`+cno-program-echo : (p : Program) → IsCNO p → ProgramEcho p+` plus +three concrete instances. `+CNO.agda+` builds clean under +`+--safe --without-K+`, no postulates. |— (closed at content-bridge +level; cross-prover theorem-statement alignment is the next row.) + +|CNO core theorem alignment |`+EchoCNOBridge+` theorem family +|`+absolute-zero/proofs/coq/common/CNO.v+`, +`+absolute-zero/proofs/lean4/CNO.lean+` |Name-by-name correspondence +table drafted (see §"`CNO Agda↔Coq↔Lean4 correspondence`" below). |(1) +Coq’s `+eval+` is relational; Agda+Lean are functional. (2) Coq has no +`+absolute_zero+` alias. (3) Coq’s single-instruction CNO is +`+nop_is_cno+`; Agda+Lean use `+halt_is_cno+`. (4) Coq carries 3 axioms +(`+eval_deterministic+`, `+eval_respects_state_eq_{left,right}+`) that +echo-types’ `+--safe --without-K+` policy forbids — porting must +re-route through a functional formulation, where they hold by `+refl+`. +(5) `+ProgramEcho+`/`+Echo+` itself is currently unilateral (Agda-only). + +|JanusKey bridge |`+proofs/agda/EchoJanusBridge.agda+` +|`+januskey/src/abi/Types.idr+` (`+OpKind+`, `+IsFileOp+`, `+IsKeyOp+`); +`+januskey/PROOF-NEEDS.md+` |Name-bridge only — Agda side has a _local_ +4-variant `+JanusOp = Create \| Delete \| Modify \| Move+`; canonical +Idris2 ABI defines 8-variant +`+OpKind = Copy \| Move \| Delete \| Modify \| Obliterate \| KeyGen \| KeyRotate \| KeyRevoke+` +plus `+IsFileOp+`/`+IsKeyOp+` predicates. Already drifted (Create vs +Copy; missing Obliterate + 3 key ops). |Decision recorded: +structural-mirror the Agda enum to januskey’s Idris2 `+OpKind+`; +content-bridge deferred until januskey’s `+PROOF-NEEDS.md+` lands +content-bearing semantics. Agda↔Idris2 has no FFI, so any content-bridge +must run via shared schema or trusted extraction. + +|Tropical alignment |`+proofs/agda/EchoTropical.agda+` +|`+tropical-resource-typing/Tropical.thy+`, +`+tropical-resource-typing/TropicalSessionTypes.lean+` (and 8 other +`+.thy+` files) |Adjacent repo audit complete (2026-05-20). Repo present +at `+repos-monorepo/verification-ecosystem/tropical-resource-typing+`; +remote `+hyperpolymath/tropical-resource-typing+` active (last push +2026-05-18, language=Isabelle). First alignable theorem pair identified: +Agda `+⊕-idem+` ↔ Isabelle `+trop_add_idem+` ↔ Lean +`+add_comm_trop+`+`+add_assoc_trop+`. |Agda cannot import `+.thy+` or +`+.lean+` directly; alignment is citation-level (statement +correspondence with build-side independent proof per language), not +import-level. Long-game target: `+Tropical_Ordinal_Bridge.thy+` ↔ the +(now-RETIRED, extracting) echo-types ordinal track — that long-game +alignment moves with the ordinal extraction (echo-types#263, owner +decision D-2026-06-21); it is not an echo-types deliverable. + +|EchoTypes.jl executable mirror |Tier-1+Tier-2 spine + unconditional F5 +OFS fragment (modules: `+Echo+`, `+EchoResidue+`, `+EchoFiberCount+`, +`+EchoThermodynamics+`, plus 2026-05-27 v0.2.0 additions: +`+EchoTotalCompletion+`, `+EchoOrthogonalFactorizationSystem+`, +`+EchoImageFactorization+`, `+EchoNoSectionGeneric+`, +`+EchoLossTaxonomy+`, `+EchoEntropy+`, `+EchoObservationalEquivalence+`) +|https://github.com/hyperpolymath/EchoTypes.jl[`+hyperpolymath/EchoTypes.jl+`] +v0.2.0 (pinned to `+e7dded6+`); registered in +`+julia-professional-registry+` |*Executable companion shipped.* Mirrors +run the finite-domain shadow of the upstream theorems on concrete data +and falsify-by-counterexample; the companion makes no proof claims, the +Agda here remains the source of truth. R-2026-05-18 retraction surface +NOT mirrored; F5 funext-qualified clauses (uniqueness up to iso, +diagonal lifting) NOT mirrored — Julia has no funext, the claims would +be vacuous. UIP- and truncation-strength upgrades likewise honestly not +mirrored. |— (shipped; honest scope holds verbatim from upstream). +Future advances on the Tier-1+Tier-2 spine are candidates for new +shadows in subsequent EchoTypes.jl releases, but no in-repo CI +dependency exists in either direction. + +|Ephapax L3 bridge (Agda↔Coq) |`+proofs/agda/EchoEphapaxBridge.agda+` +|`+ephapax/formal/Echo.v+` (Coq, 584 lines, 24 `+Qed+`, zero +`+Admitted+` / zero `+Axiom+`) — explicit port of `+EchoLinear.agda+` + +`+EchoResidue.agda+` under a K-free / zero-axiom discipline equivalent +to `+--safe --without-K+` |*Navigability bridge done; content bridge +NARROW* (2026-05-30). Two definitional `+refl+`-renames: +`+ephapax-L3-weaken = EchoLinear.weaken+` and +`+ephapax-L3-no-section-collapse = EchoResidue.no-section-collapse-to-residue+`. +Coq headlines `+mode_le_prop+`, `+weaken_collapses_distinction+`, +`+affine_canonical+`, `+degrade_mode_comp+`, +`+no_section_collapse_to_residue+` (line 502-517) each match an Agda +counterpart pinned in `+Smoke.agda+`. Scope: *L3 only* — ephapax-affine +has Rust checkers only; L1 has 5 `+Axiom+` + 11 `+Admitted+`; L4 has no +mechanised theorems yet (cf. ephapax `+formal/PRESERVATION-DESIGN.md+`, +`+docs/echo-types/paper.adoc+` §"`Threats to validity`"). |Per-bridge +docs `+docs/bridges/ECHO-EPHAPAX-BRIDGE.adoc+` (CNO-equivalent) not yet +authored; tracked as follow-up issue. Full content bridge (round-trip CI +between Agda + Coq) would require an Agda mirror of ephapax +`+formal/Echo.v+` and is *not foreclosed* by the NARROW stub. + +|Valence Shell / Ochránce accountable-shell bridge (exploratory, +downstream) |Structured-loss vocabulary only — `+EchoResidue+` / +`+EchoResidueTaxonomy+` / `+EchoLossTaxonomy+` / +`+EchoObservationalEquivalence+` / `+EchoNoSectionGeneric+` cited at the +reading-aid level. *No bridge module*; nothing added to `+All.agda+`, +`+Smoke.agda+`, or `+EchoCanonicalIdentitySuite.agda+`. |Valence Shell +(`+hyperpolymath/valence-shell+`) — shell state transitions, undo/redo, +checkpoints, diff/replay. Ochránce (`+hyperpolymath/ochrance+`) — A2ML +manifests, Merkle state commitments, repair/attestation surfaces. +|*Exploratory — candidate downstream consumer. Core Affect: NO.* Echo +Types’ structured-loss semantics may _classify_ shell state transitions +by residue / loss form (recoverable / constrained / residue-bearing / +observationally equivalent / genuinely lost); Ochránce may supply +concrete receipt evidence. Downstream application evidence only — not a +new foundation. No mechanised cross-repo theorem currently exists. +Companion: `+docs/bridge-status.md+` §7 and +`+docs/echo-types/explorations/accountable-shell/README.adoc+`. |No +shared schema and no Agda↔Idris2 / Agda↔Rust import path; the +relationship is citation-level only. Echo Types makes *no* claim about +Valence Shell / Ochránce implementation correctness, and *no* claim +about POSIX, Rust, the Lean→Rust correspondence, secure deletion, GDPR, +cryptographic integrity, or attestation. Valence Shell’s RMR/RMO +vocabulary, if referenced, is downstream application vocabulary and is +not adopted into the Echo Types core. + +|*Typesystem integration (nextgen-typing)* |`+EchoLinear+` (`+weaken+`, +`+no-section-weaken+`, `+affine-canonical+`), `+Echo+` +|`+nextgen-typing/verification/proofs/agda/EchoTyping.agda+` (imports +echo-types directly via `+depend: echo-types+`) |*Content bridge done +(2026-06-12).* AffineScript `+linear ⊑ affine+` subtyping IS +`+EchoLinear.weaken+` (irreversible — `+no-section-weaken+`; +distinction-forgetting; proof-irrelevant at affine via +`+affine-canonical+`); refinement erasure IS a fiber of `+erase+`. +Headlines `+TP-ECHO-1/2/3+`. `+agda --safe+` 3/3 pass (Agda 2.6.3 + +stdlib v2.3 + echo-types). |— (closed at content-bridge level; the +hyperpolymath type-theory pipeline reuses echo-types’ structured-loss +notion directly rather than a parallel definition). + +|*Verdict-provenance (phronesis)* |`+Echo+`, `+echo-intro+` +|`+phronesis/academic/formal-verification/agda/PhronesisEcho.agda+` +(imports echo-types directly) |*Content bridge done (2026-06-12).* An +ethical verdict’s provenance IS `+Echo verdict v+`: `+eval+` is +non-injective, so the fiber retains _which_ expressions justify a +verdict the bare `+Bool+` forgets (`+verdict-forgets-provenance+`); +`+proj₁+` is the recovering section. Machine-checked vs real echo-types. +(Also fixed 4 pre-existing bugs making `+Phronesis.agda+` compile.) |— +(closed; downstream consumer in the agentic-ethics language). + +|*KitchenSpeak `+@+` witness (nextgen-languages)* |`+Echo+` +|`+nextgen-languages/kitchenspeak/proofs/agda/EchoBridge.agda+` |*Status +upgraded to MACHINE-CHECKED (2026-06-12).* Previously "`hand-verified, +not machine-checked`"; now typechecks against the real `+Echo+`. The +`+@+` sensor witness IS `+Echo (fired sensor thr) true+` +(`+witness⇒echo+` / `+echo⇒witness+`). PoachedEgg stdlib-v2.3 drift +(`+toWitness {Q=}+`→`+{a?=}+`) fixed so the suite type-checks. |— (the +`+--+` comments in `+kitchenspeak.agda-lib+` need Agda ≥ 2.6.4; on the +2.6.3 CI toolchain use the explicit `+-i+` form, documented in the +module). + +|*Invariant Path application (invariant-path)* |Structured-loss +vocabulary (the `+Echo+` fiber concept) — citation-level +|`+invariant-path+` (Rust): `+classify_candidate+` + +`+docs/ECHO-TYPES.md+` + +`+crates/invariant-path-core/{examples,tests}/echo_structured_loss.rs+` +|*Application example (2026-06-12).* `+classify_candidate+` is a +non-injective classifier; the retained `+ClaimCandidate+` + +`+ClassificationOutcome.losses+` IS the echo (fiber) over a +`+Classification+`. Invariant Path is "`a claim-path debugger, not a +truth engine`" precisely because it retains echoes. Runnable example + 2 +CI-covered tests. |No Agda↔Rust import path; citation-level — the +application _uses_ the echo principle; no mechanised cross-repo theorem. + +|*oikos alib aggregation bridge (economics)* +|`+proofs/agda/EchoAggregation.agda+` — the GENERAL aggregation form +(`+Monoid+` + `+GroupAggregator+` + `+aggregation-as-fold+` homomorphism ++ `+sumMonoid+`/`+countMonoid+`/`+maxMonoid+`/`+minMonoid+` + +`+no-canonical-disaggregation-of+`); the macro economics is the +`+Example-PairSum+` instance (`+pairSum+` IS the `+sumMonoid+` fold) +|`+oikos/docs/alib-aggregate-bridge.adoc+` (toolchain-free design note; +oikos is the Rust SFC-macro DSL) — names the macro reading +`+MacroAggregation+`, cited back to echo-types |*General/macro split +landed (2026-06-18, gen. rung).* echo-types now hosts the _general_ +monoid-aggregation form requested by issue #175 (SQL GROUP-BY as a +monoid homomorphism; consumer = affinescript db-theory #3); the +`+aggregation-as-fold+` law is _proved_, not merely signed, and generic +non-disaggregability `+no-canonical-disaggregation-of+` also discharges +#174’s no-section sibling. The _macro→micro economics_ reading — micro +ledger rolled up to a Godley total, the Sonnenschein–Mantel–Debreu / +representative-agent critique (refuting a _section_ / left inverse, not +a representative _choice_) — is the `+Example-PairSum+` instance, read +at macro scale in oikos under the name `+MacroAggregation+` (naming it +`+EchoAggregation+` there would be odd: aggregation is a _fundamental_ +of echo-types). `+EchoAggregation.agda+` is self-contained (imports +`+Echo+` + `+EchoNoSectionGeneric+` only), `+--safe --without-K+`, zero +postulates, pinned in `+Smoke.agda+`, classified in the kernel-note + +`+MAP.adoc+`. The oikos design note recommends Route B (alib as an +aggregation-morphism library over `+MacroState+`). |No Agda↔Rust import +path; citation-level — echo-types proves the general aggregation +principle (and its macro instance), oikos’s alib will _consume_ it. The +alib library itself is not yet built (design-note stage; Route A vs B +pending owner decision). +|=== + +=== Immediate next actions + +[arabic] +. *JanusKey* — rewrite `+EchoJanusBridge.JanusOp+` from the 4-variant +local enum to mirror the 8-variant Idris2 `+OpKind+` +(Copy/Move/Delete/Modify/Obliterate/KeyGen/KeyRotate/KeyRevoke); add +`+IsFileOp+`/`+IsKeyOp+` predicate analogues. Keep bridge theorems +trivial (each `+JanusEcho op+` continues to inhabit +`+Echo janus-to-unit tt+`). Re-pin in `+Smoke.agda+`. +. *Tropical* — extend this status doc with a name-by-name correspondence +appendix (Agda `+⊕-idem+`, `+score-⊕-idem+`, `+tropical-non-injective+`, +`+echo0-to-tropical+`, +`+distinct-candidates-same-visible-distinct-echo+` ↔ counterpart names +in `+Tropical.thy+` / `+TropicalSessionTypes.lean+`). +. *CNO theorem alignment* — promote the correspondence table below into +a separate cross-prover alignment doc once a Coq-side or Lean-side +`+Echo+` analog is introduced (currently Agda-unilateral). +. *JanusKey content-bridge* — gated on the adjacent repo’s +`+PROOF-NEEDS.md+` closing. No echo-types action until then. + +=== CNO Agda↔Coq↔Lean4 correspondence + +The table maps the Agda surface consumed by `+EchoCNOBridge.agda+` plus +the bridge’s own headlines onto the sibling Coq and Lean4 statements. +Where there is no analog the cell is `+—+`; where the analog exists but +the statement diverges, the cell is `+DIVERGES: +`. + +[width="100%",cols="25%,25%,25%,25%",options="header",] +|=== +|Agda (`+CNO.agda+` / `+EchoCNOBridge.agda+`) |Coq +(`+proofs/coq/common/CNO.v+`) |Lean4 (`+proofs/lean4/CNO.lean+`) |Notes +|`+Program+` (CNO.agda L100–101) |`+Program+` (L84) |`+Program+` (L90, +`+abbrev+`) |Match. All three = `+List Instruction+`. + +|`+Instruction+` (L91–97) |`+Instruction+` (L74–80) |`+Instruction+` +(L78–85) |Match. Same 6 constructors; only constructor ordering differs +(`+Halt+` last in Coq/Lean, second in Agda). + +|`+IsCNO+` (record, L214–219) |`+is_CNO+` (Definition, L204–208) +|`+isCNO+` (`+def+`, L195–199) |Match in intent (4-clause conjunction). +DIVERGES (mild): Agda = `+record+` with named fields; Coq/Lean = nested +`+∧+`. Identity clause also DIVERGES (mild): Agda `+eval p s ≡ s+` up to +`+state-eq+`; Coq quantifies over `+s'+` with `+eval p s s'+` +(relational `+eval+`); Lean `+eval p s = s+` up to `+ProgramState.eq+` +(functional `+eval+`). + +|`+empty-is-cno+` (L226–232) |`+empty_is_cno+` (L383–407) +|`+empty_is_cno+` (L204–217) |Match. Proof shapes diverge per `+eval+` +style. + +|`+halt-is-cno+` (L247–253) |— (only `+nop_is_cno+`, L412–440) +|`+halt_is_cno+` (L235–251) |DIVERGES: Coq ships `+nop_is_cno+` instead. +Agda picks Halt because Nop bumps PC (so isn’t identity-on-state in the +Agda model). + +|`+cno-composition+` (L312–330) |`+cno_composition+` (L338–378) +|`+cno_composition+` (L329–356) |Match. +`+IsCNO p1 → IsCNO p2 → IsCNO (seq_comp p1 p2)+`. + +|`+seq-comp+` (L280–281) |`+seq_comp+` (L247) |`+seqComp+` (`+abbrev+`, +L282) |Match. All three = `+p1 ++ p2+`. + +|`+absolute-zero+` (L359–360) |— |`+absoluteZero+` (`+def+`, L530) +|DIVERGES: Coq has no `+absolute_zero+` alias; one must use `+[]+` +directly. Agda+Lean both alias `+[]+`. + +|`+absolute-zero-is-cno+` (L363–364) |— (expressed as `+empty_is_cno+`) +|`+absoluteZero_is_cno+` (L533) |Lean matches Agda (`+= empty_is_cno+`); +Coq has no analog. + +|`+cno-program-echo+` (bridge, L76–77) |— |— |Bridge-only headline. No +Coq/Lean analog (no `+Echo+` type, no `+ProgramEcho+` fibre, no +`+echo-intro+`). + +|`+empty-cno-echo+` / `+halt-cno-echo+` / `+absolute-zero-echo+` / +`+cno-compose-echo+` (bridge) |— |— |Bridge instances; no analog. + +|`+ProgramEcho+` / `+program-to-unit+` (bridge) |— |— |Bridge type + +collapse map; defined only Agda-side. + +|`+cno-preserves-state+` / `+cno-terminates-thm+` / `+cno-pure-thm+` / +`+cno-thermo-rev+` (L260–273) |`+cno_terminates+`, +`+cno_preserves_state+`, `+cno_pure+`, `+cno_reversible+` (L213–242) +|`+cno_terminates+`, `+cno_preserves_state+`, `+cno_pure+`, +`+cno_reversible+` (L256–273) |Match (not consumed by bridge; included +for completeness). + +|— |`+eval_deterministic+`, `+cno_equiv*+`, +`+eval_respects_state_eq_{left,right}+` (Axioms + theorems, L444–626) |— +|DIVERGES: Coq introduces equivalence theory + 3 axioms not present in +Agda or Lean. `+--safe --without-K+` forbids axioms — a Coq→Agda port +must either re-prove these (impossible without altering the model) or +re-route through the functional `+eval+` formulation, where they hold by +`+refl+`. +|=== + +==== Structural alignment blocker + +The deepest cross-prover blocker is the *`+eval+` model mismatch*: + +* Agda — total function `+Program → ProgramState → ProgramState+`; +`+IsCNO+` quantifies as `+state-eq (eval p s) s+`. +* Lean4 — total function (same shape; `+ProgramState.eq (eval p s) s+` +ports cleanly from Agda). +* Coq — `+Prop+`-valued inductive relation +`+eval : Program → ProgramState → ProgramState → Prop+`; `+is_CNO+` +quantifies as `+forall s s', eval p s s' -> s =st= s'+`. + +Bridging the relational/functional split needs either (a) a +`+Functional.eval+` reformulation on the Coq side plus a soundness lemma +against the inductive `+eval+`, or (b) re-stating `+cno-program-echo+` +in Coq as +`+forall p (H : is_CNO p) s s', eval p s s' -> ProgramEcho p+`, which +changes the headline’s logical shape. The 3 Coq axioms exist precisely +to paper over this in the relational model. + +=== Revision history + +* 2026-06-18: *EchoAggregation general/macro split.* Generalised +`+EchoAggregation.agda+` from the macro-economics-specific module into +the general monoid-aggregation form requested by issue #175 (`+Monoid+` ++ `+GroupAggregator+` + the _proved_ `+aggregation-as-fold+` +homomorphism law + +`+sumMonoid+`/`+countMonoid+`/`+maxMonoid+`/`+minMonoid+` + generic +`+no-canonical-disaggregation-of+`, which also covers #174). The +macro→micro economics reading survives mechanised as the +`+Example-PairSum+` instance (`+pairSum+` IS the `+sumMonoid+` fold — +nothing re-proved or lost); oikos reads that instance at macro scale +under the name `+MacroAggregation+` (aggregation is a fundamental of +echo-types, so re-using the name there would be odd). Updated the bridge +row, `+MAP.adoc+`, and `+echo-kernel-note.adoc+`; +`+--safe --without-K+`, zero postulates, kernel-guard PASS. +* 2026-06-18: *oikos alib aggregation bridge.* Added the +economics-aggregation row recording `+EchoAggregation.agda+` +(micro→macro rollup is an `+Echo+`; non-disaggregability is +`+no-section-of-collapsing-map+` — the SMD / representative-agent +critique as a type-theoretic refutation of a left inverse) and the oikos +toolchain-free design note `+oikos/docs/alib-aggregate-bridge.adoc+`. +Keystone formalisation merged to echo-types `+main+` +(`+--safe --without-K+`, zero postulates, pinned in `+Smoke.agda+`, +classified in `+echo-kernel-note.adoc+` + `+MAP.adoc+`); the oikos note +merged to oikos `+main+`. Citation-level (no Agda↔Rust path); the alib +library is at design-note stage (Route A vs B owner decision pending). +* 2026-06-12: *Typesystem-integration sweep.* Added four downstream +consumer rows recording that echo-types is now integrated into the +hyperpolymath type systems, all merged to the consumers’ `+main+`: +nextgen-typing (`+EchoTyping.agda+` — affine subtyping = `+weaken+`; +refinement erasure = fiber), phronesis (`+PhronesisEcho.agda+` — +verdict-provenance = `+Echo+`), nextgen-languages/kitchenspeak +(`+EchoBridge.agda+` status upgraded hand-verified → machine-checked; +PoachedEgg stdlib drift fixed), and invariant-path (Rust application +example, citation-level). First three are content bridges that +`+import+` echo-types directly under `+--safe+`; the fourth is +citation-level (no Agda↔Rust path). +* 2026-06-02: Added the Valence Shell / Ochránce accountable-shell +bridge row as an exploratory downstream-consumer entry (Core Affect: NO; +citation-level only, no bridge module, nothing wired into `+All.agda+` / +`+Smoke.agda+` / `+EchoCanonicalIdentitySuite.agda+`). Mirrored in +`+docs/bridge-status.md+` §7 and the exploratory note +`+docs/echo-types/explorations/accountable-shell/README.adoc+`. +* 2026-05-20: Closed CNO content-bridge row; baked Agda↔Coq↔Lean4 +correspondence table in; updated JanusKey row with the structural-mirror +decision and the 4-vs-8 enum drift; closed the Tropical "`not recently +audited`" blocker after locating the active adjacent repo. Removed +references to the superseded `+EchoBridgeScaffold.agda+` adapter slot. +* 2026-04-23: Initial ledger. diff --git a/docs/bridges/cross-repo-bridge-status.md b/docs/bridges/cross-repo-bridge-status.md deleted file mode 100644 index 6be0636..0000000 --- a/docs/bridges/cross-repo-bridge-status.md +++ /dev/null @@ -1,122 +0,0 @@ - - -# Cross-Repo Bridge Status - -Last updated: 2026-06-21. - -This file is the single status ledger for echo-type bridge work that -touches other repositories. - -## Tracks - -| Track | echo-types side | Adjacent side | Current status | Main blocker | -|---|---|---|---|---| -| CNO bridge (Agda) | `proofs/agda/EchoCNOBridge.agda` | `absolute-zero/proofs/agda/CNO.agda` (direct import) | **Content-bridge done.** Bridge imports `IsCNO`, `empty-is-cno`, `halt-is-cno`, `cno-composition`, `absolute-zero-is-cno`, `seq-comp` from absolute-zero's `CNO.agda` and exhibits `cno-program-echo : (p : Program) → IsCNO p → ProgramEcho p` plus three concrete instances. `CNO.agda` builds clean under `--safe --without-K`, no postulates. | — (closed at content-bridge level; cross-prover theorem-statement alignment is the next row.) | -| CNO core theorem alignment | `EchoCNOBridge` theorem family | `absolute-zero/proofs/coq/common/CNO.v`, `absolute-zero/proofs/lean4/CNO.lean` | Name-by-name correspondence table drafted (see §"CNO Agda↔Coq↔Lean4 correspondence" below). | (1) Coq's `eval` is relational; Agda+Lean are functional. (2) Coq has no `absolute_zero` alias. (3) Coq's single-instruction CNO is `nop_is_cno`; Agda+Lean use `halt_is_cno`. (4) Coq carries 3 axioms (`eval_deterministic`, `eval_respects_state_eq_{left,right}`) that echo-types' `--safe --without-K` policy forbids — porting must re-route through a functional formulation, where they hold by `refl`. (5) `ProgramEcho`/`Echo` itself is currently unilateral (Agda-only). | -| JanusKey bridge | `proofs/agda/EchoJanusBridge.agda` | `januskey/src/abi/Types.idr` (`OpKind`, `IsFileOp`, `IsKeyOp`); `januskey/PROOF-NEEDS.md` | Name-bridge only — Agda side has a *local* 4-variant `JanusOp = Create \| Delete \| Modify \| Move`; canonical Idris2 ABI defines 8-variant `OpKind = Copy \| Move \| Delete \| Modify \| Obliterate \| KeyGen \| KeyRotate \| KeyRevoke` plus `IsFileOp`/`IsKeyOp` predicates. Already drifted (Create vs Copy; missing Obliterate + 3 key ops). | Decision recorded: structural-mirror the Agda enum to januskey's Idris2 `OpKind`; content-bridge deferred until januskey's `PROOF-NEEDS.md` lands content-bearing semantics. Agda↔Idris2 has no FFI, so any content-bridge must run via shared schema or trusted extraction. | -| Tropical alignment | `proofs/agda/EchoTropical.agda` | `tropical-resource-typing/Tropical.thy`, `tropical-resource-typing/TropicalSessionTypes.lean` (and 8 other `.thy` files) | Adjacent repo audit complete (2026-05-20). Repo present at `repos-monorepo/verification-ecosystem/tropical-resource-typing`; remote `hyperpolymath/tropical-resource-typing` active (last push 2026-05-18, language=Isabelle). First alignable theorem pair identified: Agda `⊕-idem` ↔ Isabelle `trop_add_idem` ↔ Lean `add_comm_trop`+`add_assoc_trop`. | Agda cannot import `.thy` or `.lean` directly; alignment is citation-level (statement correspondence with build-side independent proof per language), not import-level. Long-game target: `Tropical_Ordinal_Bridge.thy` ↔ the (now-RETIRED, extracting) echo-types ordinal track — that long-game alignment moves with the ordinal extraction (echo-types#263, owner decision D-2026-06-21); it is not an echo-types deliverable. | -| EchoTypes.jl executable mirror | Tier-1+Tier-2 spine + unconditional F5 OFS fragment (modules: `Echo`, `EchoResidue`, `EchoFiberCount`, `EchoThermodynamics`, plus 2026-05-27 v0.2.0 additions: `EchoTotalCompletion`, `EchoOrthogonalFactorizationSystem`, `EchoImageFactorization`, `EchoNoSectionGeneric`, `EchoLossTaxonomy`, `EchoEntropy`, `EchoObservationalEquivalence`) | [`hyperpolymath/EchoTypes.jl`](https://github.com/hyperpolymath/EchoTypes.jl) v0.2.0 (pinned to `e7dded6`); registered in `julia-professional-registry` | **Executable companion shipped.** Mirrors run the finite-domain shadow of the upstream theorems on concrete data and falsify-by-counterexample; the companion makes no proof claims, the Agda here remains the source of truth. R-2026-05-18 retraction surface NOT mirrored; F5 funext-qualified clauses (uniqueness up to iso, diagonal lifting) NOT mirrored — Julia has no funext, the claims would be vacuous. UIP- and truncation-strength upgrades likewise honestly not mirrored. | — (shipped; honest scope holds verbatim from upstream). Future advances on the Tier-1+Tier-2 spine are candidates for new shadows in subsequent EchoTypes.jl releases, but no in-repo CI dependency exists in either direction. | -| Ephapax L3 bridge (Agda↔Coq) | `proofs/agda/EchoEphapaxBridge.agda` | `ephapax/formal/Echo.v` (Coq, 584 lines, 24 `Qed`, zero `Admitted` / zero `Axiom`) — explicit port of `EchoLinear.agda` + `EchoResidue.agda` under a K-free / zero-axiom discipline equivalent to `--safe --without-K` | **Navigability bridge done; content bridge NARROW** (2026-05-30). Two definitional `refl`-renames: `ephapax-L3-weaken = EchoLinear.weaken` and `ephapax-L3-no-section-collapse = EchoResidue.no-section-collapse-to-residue`. Coq headlines `mode_le_prop`, `weaken_collapses_distinction`, `affine_canonical`, `degrade_mode_comp`, `no_section_collapse_to_residue` (line 502-517) each match an Agda counterpart pinned in `Smoke.agda`. Scope: **L3 only** — ephapax-affine has Rust checkers only; L1 has 5 `Axiom` + 11 `Admitted`; L4 has no mechanised theorems yet (cf. ephapax `formal/PRESERVATION-DESIGN.md`, `docs/echo-types/paper.adoc` §"Threats to validity"). | Per-bridge docs `docs/bridges/ECHO-EPHAPAX-BRIDGE.adoc` (CNO-equivalent) not yet authored; tracked as follow-up issue. Full content bridge (round-trip CI between Agda + Coq) would require an Agda mirror of ephapax `formal/Echo.v` and is **not foreclosed** by the NARROW stub. | -| Valence Shell / Ochránce accountable-shell bridge (exploratory, downstream) | Structured-loss vocabulary only — `EchoResidue` / `EchoResidueTaxonomy` / `EchoLossTaxonomy` / `EchoObservationalEquivalence` / `EchoNoSectionGeneric` cited at the reading-aid level. **No bridge module**; nothing added to `All.agda`, `Smoke.agda`, or `EchoCanonicalIdentitySuite.agda`. | Valence Shell (`hyperpolymath/valence-shell`) — shell state transitions, undo/redo, checkpoints, diff/replay. Ochránce (`hyperpolymath/ochrance`) — A2ML manifests, Merkle state commitments, repair/attestation surfaces. | **Exploratory — candidate downstream consumer. Core Affect: NO.** Echo Types' structured-loss semantics may *classify* shell state transitions by residue / loss form (recoverable / constrained / residue-bearing / observationally equivalent / genuinely lost); Ochránce may supply concrete receipt evidence. Downstream application evidence only — not a new foundation. No mechanised cross-repo theorem currently exists. Companion: `docs/bridge-status.md` §7 and `docs/echo-types/explorations/accountable-shell/README.adoc`. | No shared schema and no Agda↔Idris2 / Agda↔Rust import path; the relationship is citation-level only. Echo Types makes **no** claim about Valence Shell / Ochránce implementation correctness, and **no** claim about POSIX, Rust, the Lean→Rust correspondence, secure deletion, GDPR, cryptographic integrity, or attestation. Valence Shell's RMR/RMO vocabulary, if referenced, is downstream application vocabulary and is not adopted into the Echo Types core. | -| **Typesystem integration (nextgen-typing)** | `EchoLinear` (`weaken`, `no-section-weaken`, `affine-canonical`), `Echo` | `nextgen-typing/verification/proofs/agda/EchoTyping.agda` (imports echo-types directly via `depend: echo-types`) | **Content bridge done (2026-06-12).** AffineScript `linear ⊑ affine` subtyping IS `EchoLinear.weaken` (irreversible — `no-section-weaken`; distinction-forgetting; proof-irrelevant at affine via `affine-canonical`); refinement erasure IS a fiber of `erase`. Headlines `TP-ECHO-1/2/3`. `agda --safe` 3/3 pass (Agda 2.6.3 + stdlib v2.3 + echo-types). | — (closed at content-bridge level; the hyperpolymath type-theory pipeline reuses echo-types' structured-loss notion directly rather than a parallel definition). | -| **Verdict-provenance (phronesis)** | `Echo`, `echo-intro` | `phronesis/academic/formal-verification/agda/PhronesisEcho.agda` (imports echo-types directly) | **Content bridge done (2026-06-12).** An ethical verdict's provenance IS `Echo verdict v`: `eval` is non-injective, so the fiber retains *which* expressions justify a verdict the bare `Bool` forgets (`verdict-forgets-provenance`); `proj₁` is the recovering section. Machine-checked vs real echo-types. (Also fixed 4 pre-existing bugs making `Phronesis.agda` compile.) | — (closed; downstream consumer in the agentic-ethics language). | -| **KitchenSpeak `@` witness (nextgen-languages)** | `Echo` | `nextgen-languages/kitchenspeak/proofs/agda/EchoBridge.agda` | **Status upgraded to MACHINE-CHECKED (2026-06-12).** Previously "hand-verified, not machine-checked"; now typechecks against the real `Echo`. The `@` sensor witness IS `Echo (fired sensor thr) true` (`witness⇒echo` / `echo⇒witness`). PoachedEgg stdlib-v2.3 drift (`toWitness {Q=}`→`{a?=}`) fixed so the suite type-checks. | — (the `--` comments in `kitchenspeak.agda-lib` need Agda ≥ 2.6.4; on the 2.6.3 CI toolchain use the explicit `-i` form, documented in the module). | -| **Invariant Path application (invariant-path)** | Structured-loss vocabulary (the `Echo` fiber concept) — citation-level | `invariant-path` (Rust): `classify_candidate` + `docs/ECHO-TYPES.md` + `crates/invariant-path-core/{examples,tests}/echo_structured_loss.rs` | **Application example (2026-06-12).** `classify_candidate` is a non-injective classifier; the retained `ClaimCandidate` + `ClassificationOutcome.losses` IS the echo (fiber) over a `Classification`. Invariant Path is "a claim-path debugger, not a truth engine" precisely because it retains echoes. Runnable example + 2 CI-covered tests. | No Agda↔Rust import path; citation-level — the application *uses* the echo principle; no mechanised cross-repo theorem. | -| **oikos alib aggregation bridge (economics)** | `proofs/agda/EchoAggregation.agda` — the GENERAL aggregation form (`Monoid` + `GroupAggregator` + `aggregation-as-fold` homomorphism + `sumMonoid`/`countMonoid`/`maxMonoid`/`minMonoid` + `no-canonical-disaggregation-of`); the macro economics is the `Example-PairSum` instance (`pairSum` IS the `sumMonoid` fold) | `oikos/docs/alib-aggregate-bridge.adoc` (toolchain-free design note; oikos is the Rust SFC-macro DSL) — names the macro reading `MacroAggregation`, cited back to echo-types | **General/macro split landed (2026-06-18, gen. rung).** echo-types now hosts the *general* monoid-aggregation form requested by issue #175 (SQL GROUP-BY as a monoid homomorphism; consumer = affinescript db-theory #3); the `aggregation-as-fold` law is *proved*, not merely signed, and generic non-disaggregability `no-canonical-disaggregation-of` also discharges #174's no-section sibling. The *macro→micro economics* reading — micro ledger rolled up to a Godley total, the Sonnenschein–Mantel–Debreu / representative-agent critique (refuting a *section* / left inverse, not a representative *choice*) — is the `Example-PairSum` instance, read at macro scale in oikos under the name `MacroAggregation` (naming it `EchoAggregation` there would be odd: aggregation is a *fundamental* of echo-types). `EchoAggregation.agda` is self-contained (imports `Echo` + `EchoNoSectionGeneric` only), `--safe --without-K`, zero postulates, pinned in `Smoke.agda`, classified in the kernel-note + `MAP.adoc`. The oikos design note recommends Route B (alib as an aggregation-morphism library over `MacroState`). | No Agda↔Rust import path; citation-level — echo-types proves the general aggregation principle (and its macro instance), oikos's alib will *consume* it. The alib library itself is not yet built (design-note stage; Route A vs B pending owner decision). | - -## Immediate next actions - -1. **JanusKey** — rewrite `EchoJanusBridge.JanusOp` from the 4-variant local enum to mirror the 8-variant Idris2 `OpKind` (Copy/Move/Delete/Modify/Obliterate/KeyGen/KeyRotate/KeyRevoke); add `IsFileOp`/`IsKeyOp` predicate analogues. Keep bridge theorems trivial (each `JanusEcho op` continues to inhabit `Echo janus-to-unit tt`). Re-pin in `Smoke.agda`. -2. **Tropical** — extend this status doc with a name-by-name correspondence appendix (Agda `⊕-idem`, `score-⊕-idem`, `tropical-non-injective`, `echo0-to-tropical`, `distinct-candidates-same-visible-distinct-echo` ↔ counterpart names in `Tropical.thy` / `TropicalSessionTypes.lean`). -3. **CNO theorem alignment** — promote the correspondence table below into a separate cross-prover alignment doc once a Coq-side or Lean-side `Echo` analog is introduced (currently Agda-unilateral). -4. **JanusKey content-bridge** — gated on the adjacent repo's `PROOF-NEEDS.md` closing. No echo-types action until then. - -## CNO Agda↔Coq↔Lean4 correspondence - -The table maps the Agda surface consumed by `EchoCNOBridge.agda` plus -the bridge's own headlines onto the sibling Coq and Lean4 statements. -Where there is no analog the cell is `—`; where the analog exists but -the statement diverges, the cell is `DIVERGES: `. - -| Agda (`CNO.agda` / `EchoCNOBridge.agda`) | Coq (`proofs/coq/common/CNO.v`) | Lean4 (`proofs/lean4/CNO.lean`) | Notes | -|---|---|---|---| -| `Program` (CNO.agda L100–101) | `Program` (L84) | `Program` (L90, `abbrev`) | Match. All three = `List Instruction`. | -| `Instruction` (L91–97) | `Instruction` (L74–80) | `Instruction` (L78–85) | Match. Same 6 constructors; only constructor ordering differs (`Halt` last in Coq/Lean, second in Agda). | -| `IsCNO` (record, L214–219) | `is_CNO` (Definition, L204–208) | `isCNO` (`def`, L195–199) | Match in intent (4-clause conjunction). DIVERGES (mild): Agda = `record` with named fields; Coq/Lean = nested `∧`. Identity clause also DIVERGES (mild): Agda `eval p s ≡ s` up to `state-eq`; Coq quantifies over `s'` with `eval p s s'` (relational `eval`); Lean `eval p s = s` up to `ProgramState.eq` (functional `eval`). | -| `empty-is-cno` (L226–232) | `empty_is_cno` (L383–407) | `empty_is_cno` (L204–217) | Match. Proof shapes diverge per `eval` style. | -| `halt-is-cno` (L247–253) | — (only `nop_is_cno`, L412–440) | `halt_is_cno` (L235–251) | DIVERGES: Coq ships `nop_is_cno` instead. Agda picks Halt because Nop bumps PC (so isn't identity-on-state in the Agda model). | -| `cno-composition` (L312–330) | `cno_composition` (L338–378) | `cno_composition` (L329–356) | Match. `IsCNO p1 → IsCNO p2 → IsCNO (seq_comp p1 p2)`. | -| `seq-comp` (L280–281) | `seq_comp` (L247) | `seqComp` (`abbrev`, L282) | Match. All three = `p1 ++ p2`. | -| `absolute-zero` (L359–360) | — | `absoluteZero` (`def`, L530) | DIVERGES: Coq has no `absolute_zero` alias; one must use `[]` directly. Agda+Lean both alias `[]`. | -| `absolute-zero-is-cno` (L363–364) | — (expressed as `empty_is_cno`) | `absoluteZero_is_cno` (L533) | Lean matches Agda (`= empty_is_cno`); Coq has no analog. | -| `cno-program-echo` (bridge, L76–77) | — | — | Bridge-only headline. No Coq/Lean analog (no `Echo` type, no `ProgramEcho` fibre, no `echo-intro`). | -| `empty-cno-echo` / `halt-cno-echo` / `absolute-zero-echo` / `cno-compose-echo` (bridge) | — | — | Bridge instances; no analog. | -| `ProgramEcho` / `program-to-unit` (bridge) | — | — | Bridge type + collapse map; defined only Agda-side. | -| `cno-preserves-state` / `cno-terminates-thm` / `cno-pure-thm` / `cno-thermo-rev` (L260–273) | `cno_terminates`, `cno_preserves_state`, `cno_pure`, `cno_reversible` (L213–242) | `cno_terminates`, `cno_preserves_state`, `cno_pure`, `cno_reversible` (L256–273) | Match (not consumed by bridge; included for completeness). | -| — | `eval_deterministic`, `cno_equiv*`, `eval_respects_state_eq_{left,right}` (Axioms + theorems, L444–626) | — | DIVERGES: Coq introduces equivalence theory + 3 axioms not present in Agda or Lean. `--safe --without-K` forbids axioms — a Coq→Agda port must either re-prove these (impossible without altering the model) or re-route through the functional `eval` formulation, where they hold by `refl`. | - -### Structural alignment blocker - -The deepest cross-prover blocker is the **`eval` model mismatch**: - -- Agda — total function `Program → ProgramState → ProgramState`; `IsCNO` quantifies as `state-eq (eval p s) s`. -- Lean4 — total function (same shape; `ProgramState.eq (eval p s) s` ports cleanly from Agda). -- Coq — `Prop`-valued inductive relation `eval : Program → ProgramState → ProgramState → Prop`; `is_CNO` quantifies as `forall s s', eval p s s' -> s =st= s'`. - -Bridging the relational/functional split needs either (a) a -`Functional.eval` reformulation on the Coq side plus a soundness lemma -against the inductive `eval`, or (b) re-stating `cno-program-echo` in -Coq as `forall p (H : is_CNO p) s s', eval p s s' -> ProgramEcho p`, -which changes the headline's logical shape. The 3 Coq axioms exist -precisely to paper over this in the relational model. - -## Revision history - -- 2026-06-18: **EchoAggregation general/macro split.** Generalised - `EchoAggregation.agda` from the macro-economics-specific module into the - general monoid-aggregation form requested by issue #175 (`Monoid` + - `GroupAggregator` + the *proved* `aggregation-as-fold` homomorphism law + - `sumMonoid`/`countMonoid`/`maxMonoid`/`minMonoid` + generic - `no-canonical-disaggregation-of`, which also covers #174). The - macro→micro economics reading survives mechanised as the `Example-PairSum` - instance (`pairSum` IS the `sumMonoid` fold — nothing re-proved or lost); - oikos reads that instance at macro scale under the name `MacroAggregation` - (aggregation is a fundamental of echo-types, so re-using the name there - would be odd). Updated the bridge row, `MAP.adoc`, and - `echo-kernel-note.adoc`; `--safe --without-K`, zero postulates, - kernel-guard PASS. -- 2026-06-18: **oikos alib aggregation bridge.** Added the - economics-aggregation row recording `EchoAggregation.agda` (micro→macro - rollup is an `Echo`; non-disaggregability is `no-section-of-collapsing-map` - — the SMD / representative-agent critique as a type-theoretic refutation - of a left inverse) and the oikos toolchain-free design note - `oikos/docs/alib-aggregate-bridge.adoc`. Keystone formalisation merged to - echo-types `main` (`--safe --without-K`, zero postulates, pinned in - `Smoke.agda`, classified in `echo-kernel-note.adoc` + `MAP.adoc`); the - oikos note merged to oikos `main`. Citation-level (no Agda↔Rust path); - the alib library is at design-note stage (Route A vs B owner decision - pending). -- 2026-06-12: **Typesystem-integration sweep.** Added four downstream - consumer rows recording that echo-types is now integrated into the - hyperpolymath type systems, all merged to the consumers' `main`: - nextgen-typing (`EchoTyping.agda` — affine subtyping = `weaken`; - refinement erasure = fiber), phronesis (`PhronesisEcho.agda` — - verdict-provenance = `Echo`), nextgen-languages/kitchenspeak - (`EchoBridge.agda` status upgraded hand-verified → machine-checked; - PoachedEgg stdlib drift fixed), and invariant-path (Rust application - example, citation-level). First three are content bridges that - `import` echo-types directly under `--safe`; the fourth is - citation-level (no Agda↔Rust path). -- 2026-06-02: Added the Valence Shell / Ochránce accountable-shell - bridge row as an exploratory downstream-consumer entry (Core Affect: - NO; citation-level only, no bridge module, nothing wired into - `All.agda` / `Smoke.agda` / `EchoCanonicalIdentitySuite.agda`). - Mirrored in `docs/bridge-status.md` §7 and the exploratory note - `docs/echo-types/explorations/accountable-shell/README.adoc`. -- 2026-05-20: Closed CNO content-bridge row; baked Agda↔Coq↔Lean4 - correspondence table in; updated JanusKey row with the - structural-mirror decision and the 4-vs-8 enum drift; closed the - Tropical "not recently audited" blocker after locating the active - adjacent repo. Removed references to the superseded - `EchoBridgeScaffold.agda` adapter slot. -- 2026-04-23: Initial ledger. diff --git a/docs/bridges/tropical-correspondence.adoc b/docs/bridges/tropical-correspondence.adoc new file mode 100644 index 0000000..c50112a --- /dev/null +++ b/docs/bridges/tropical-correspondence.adoc @@ -0,0 +1,159 @@ +== Tropical Correspondence (echo-types ↔ tropical-resource-typing) + +Last updated: 2026-05-20 + +This appendix records the citation-level correspondence between +`+proofs/agda/EchoTropical.agda+` in this repo and the adjacent +`+hyperpolymath/tropical-resource-typing+` repo (Isabelle + Lean4). The +alignment is *statement-level only*: there is no FFI surface between +Agda and Isabelle/Lean, no shared definition module, and no cross-prover +extraction pipeline. Each side carries its own independent proof of the +named theorems; this document is a cross-reference that lets a reader +verify "`the same fact is established in all three systems,`" but does +not constitute a unified verification artefact. It closes the "`Adjacent +repo not recently audited`" blocker noted in +`+cross-repo-bridge-status.md+`. + +=== Source files + +* *Agda (this repo).* `+proofs/agda/EchoTropical.agda+` — the +Tropical-Echo bridge (E10): max-plus semiring on `+ℕ+` plus the +echo-retention bridge theorems. +* *Isabelle.* `+tropical-resource-typing/Tropical.thy+` — max-plus +tropical semiring over the lifted carrier `+ℕ ∪ {-∞}+`, wired into +Isabelle’s `+comm_semiring_1+` typeclass hierarchy, with idempotence +proved separately (the structure is a dioid, not a ring). +* *Lean4.* `+tropical-resource-typing/TropicalSessionTypes.lean+` — +max-plus tropical semiring on the lifted carrier `+Nat ∪ {bot}+`, used +to grade session types so that speculative parallel cost is the +bottleneck (`+max+`) rather than the sequential sum. +* *Canonical adjacent remote.* +`+hyperpolymath/tropical-resource-typing+` (active; primary language +Isabelle; the `+.thy+` files were last touched in the +`+Tropical_Semirings+` close sweep, with subsequent CI hardening commits +on top). +* *Local clone for this audit.* +`+/home/hyperpolymath/dev/repos/repos-monorepo/verification-ecosystem/tropical-resource-typing+`. + +=== Name-by-name correspondence + +[width="100%",cols="25%,25%,25%,25%",options="header",] +|=== +|Agda (`+EchoTropical.agda+`) |Isabelle (`+Tropical.thy+`) |Lean4 +(`+TropicalSessionTypes.lean+`) |Notes +|`+_⊕_+` (max-plus add on `+ℕ+`, line 23) |`+trop_add+` (function, line +41) |`+tAdd+` (function, line 96) |Same operation (max with identity +element absorbed at the left). DIVERGES (carrier): Agda’s `+_⊕_+` +operates on raw `+ℕ+` with `+zero+` acting as the additive identity by +the recursion shape; Isabelle’s `+trop_add+` and Lean’s `+tAdd+` both +operate on a _lifted_ carrier (`+tropical = Fin nat \| NegInf+` / +`+Tropical = .val Nat \| .bot+`) where the additive identity is the +bottom element `+−∞+`, not `+0+`. The `+ℕ+` quotient on the Agda side is +intentional (the bridge only needs scores in `+ℕ+`) but means Agda’s +`+_⊕_+` is the restriction of the Isabelle/Lean operation to the finite +sub-semiring; the algebraic laws below match on that restriction. + +|`+⊕-idem+` (line 30) |`+trop_add_idem [simp]+` (lemma, line 73) |— +|Match (Agda ↔ Isabelle): Agda `+⊕-idem : ∀ m → m ⊕ m ≡ m+` ↔ Isabelle +`+trop_add_idem : trop_add a a = a+`. The Isabelle file also restates +this at typeclass level as `+tropical_add_idem+` (theorem, line 266: +`+(a :: tropical) + a = a+`); the bare-function lemma is the closer +match. Lean side has NO named idempotence theorem — the file ships 13 +CommSemiring laws (commut/assoc/identity/distrib) but not +`+tAdd a a = a+`. The Lean docstring explicitly flags this gap: +`+tropical_grade_le_sequentialTotal+` is offered as the "`Lean analogue +of Isabelle `+tropical_add_idem+``" because `+max a b ≤ a + b+` is what +`+add_idem+` buys in a dioid. So the Lean cell is `+—+` for the bare law +and `+tropical_grade_le_sequentialTotal+` for the downstream consumer. + +|`+score-⊕-idem+` (line 82) |— |— |Unilateral (Agda-only). The Agda side +specialises `+⊕-idem+` to scores of the 3-candidate set; the adjacent +repo has no `+Candidate+` type and no `+score+` function, so the +specialisation has no analog. + +|`+tropical-non-injective+` (line 55) |— |— |Unilateral (Agda-only). +Headline of the echo-retention bridge: there exist distinct candidates +with the same tropical score. The adjacent repo does not type candidates +(its tropical semiring is generic), so there is nothing to be +non-injective about. + +|`+tropical-collapse-visible+` (line 121) |— |— |Unilateral (Agda-only). +`+score a ≡ score b+` for the concrete 3-candidate choice; no analog. + +|`+Echo+` / `+echo-intro+` / `+TropEcho+` / `+IsArgmin+` (lines 59–73) +|— |— |Unilateral (Agda-only). The echo type itself +(`+Echo f y := Σ A (λ x → f x ≡ y)+`) is an echo-types invention; the +adjacent repo has no fibre type and no echo bridge. + +|`+echo0-to-tropical+` (line 113) |— |— |Unilateral (Agda-only). Bridge +map echo → tropical residue; no analog (no echo on the other side). + +|`+distinct-candidates-same-visible-distinct-echo+` (line 130) |— |— +|Unilateral (Agda-only). The main bridge theorem: collapse on the +visible (tropical) side, retention on the echo side. No analog. + +|`+tropical-echo-retention-simple+` (line 135) |— |— |Unilateral +(Agda-only). Simplified restatement of the headline bridge. + +|(no Agda analog) |`+trop_mul+` (function, line 46) |`+tMul+` (function, +line 103) |DIVERGES: the adjacent repo carries a full semiring (add + +mul), the Agda side does not. The Agda bridge needs only the additive +(max) structure of the dioid; multiplicative tropical structure is out +of scope for the echo bridge as it currently stands. + +|(no Agda analog) |`+trop_add_comm+` (line 65) |`+add_comm_trop+` (line +114) |Adjacent-side commutativity. Match between Isabelle and Lean. No +Agda analog by design — `+_⊕_+` on `+ℕ+` is commutative but the lemma is +not stated because the bridge headlines do not consume it. + +|(no Agda analog) |`+trop_add_assoc+` (line 69) |`+add_assoc_trop+` +(line 117) |Adjacent-side associativity. Match between Isabelle and +Lean. No Agda analog by design (same reason as commutativity). + +|(no Agda analog) |`+trop_distrib_{left,right}+` (lines 122/126); +semiring instance |`+left_distrib_trop+` / `+right_distrib_trop+` (lines +167/173); `+CommSemiring Tropical+` instance (line 208) |Adjacent-side +distributivity + semiring typeclass wiring. Match between Isabelle and +Lean. Out of scope for the echo bridge. +|=== + +=== Alignment caveats + +* *No Agda↔Isabelle/Lean import surface.* Agda cannot `+import+` a +`+.thy+` or a `+.lean+`; Isabelle and Lean4 cannot `+import+` an +`+.agda+`. Any "`alignment`" between these files is therefore +citation-level only — a reader verifies the names and statements line +up, but each prover runs its own independent proof. None of the three is +a trusted oracle for either of the others. +* *Independent proofs, identical claims.* The first alignable theorem +pair is `+⊕-idem+` (Agda) ↔ `+trop_add_idem+` (Isabelle). Both are +proved (clean, no axioms, no `+sorry+`); the Agda side under +`+--safe --without-K+`, the Isabelle side as a `+simp+` lemma against +the algebraic kernel of `+Tropical.thy+`. The Lean side does not name +this fact directly but consumes it inside the QTT refinement theorem +`+tropical_grade_le_sequentialTotal+` (`+max a b ≤ a + b+` is the dioid +consequence of additive idempotence). +* *Carrier mismatch is intentional, not a defect.* Agda’s `+_⊕_+` lives +on `+ℕ+` (the score type); Isabelle/Lean live on the lifted carrier with +an explicit `+−∞+` bottom. The Agda side never needs `+−∞+` because +every candidate has a finite score; the bridge is consciously narrower +than the full max-plus semiring. +* *Echo-side machinery is Agda-exclusive.* The `+Echo+`/`+TropEcho+` +fibre type, `+IsArgmin+`, the candidate datatype, and all bridge +headlines (`+tropical-non-injective+`, `+echo0-to-tropical+`, +`+distinct-candidates-same-visible-distinct-echo+`) have no analog on +the Isabelle or Lean sides. The adjacent repo’s tropical semiring stands +on its own and is consumed by _session-type grading_ +(`+grade : Session → Tropical+` in Lean), which is the symmetric +Agda-exclusive direction. +* *Long-game alignment target.* When the echo-types ordinal track +reaches Bachmann–Howard (ψ₀(Ω_ω); see `+roadmap.adoc+` §Lane 3 and +`+docs/buchholz-plan.adoc+`), the adjacent repo’s +`+Tropical_Ordinal_Bridge.thy+` becomes the natural cross-repo alignment +target (Agda Buchholz BT ↔ Isabelle `+tropO+` carrier). This target is +*firewalled* until the ordinal track lands the milestone — do not pull +it forward. + +=== Revision history + +* 2026-05-20: created (initial citation-level correspondence). diff --git a/docs/bridges/tropical-correspondence.md b/docs/bridges/tropical-correspondence.md deleted file mode 100644 index 5e0eb0e..0000000 --- a/docs/bridges/tropical-correspondence.md +++ /dev/null @@ -1,98 +0,0 @@ - - -# Tropical Correspondence (echo-types ↔ tropical-resource-typing) - -Last updated: 2026-05-20 - -This appendix records the citation-level correspondence between -`proofs/agda/EchoTropical.agda` in this repo and the adjacent -`hyperpolymath/tropical-resource-typing` repo (Isabelle + Lean4). The -alignment is **statement-level only**: there is no FFI surface between -Agda and Isabelle/Lean, no shared definition module, and no cross-prover -extraction pipeline. Each side carries its own independent proof of the -named theorems; this document is a cross-reference that lets a reader -verify "the same fact is established in all three systems," but does -not constitute a unified verification artefact. It closes the -"Adjacent repo not recently audited" blocker noted in -`cross-repo-bridge-status.md`. - -## Source files - -- **Agda (this repo).** `proofs/agda/EchoTropical.agda` — the - Tropical-Echo bridge (E10): max-plus semiring on `ℕ` plus the - echo-retention bridge theorems. -- **Isabelle.** - `tropical-resource-typing/Tropical.thy` — max-plus tropical semiring - over the lifted carrier `ℕ ∪ {-∞}`, wired into Isabelle's - `comm_semiring_1` typeclass hierarchy, with idempotence proved - separately (the structure is a dioid, not a ring). -- **Lean4.** - `tropical-resource-typing/TropicalSessionTypes.lean` — max-plus - tropical semiring on the lifted carrier `Nat ∪ {bot}`, used to grade - session types so that speculative parallel cost is the bottleneck - (`max`) rather than the sequential sum. -- **Canonical adjacent remote.** `hyperpolymath/tropical-resource-typing` - (active; primary language Isabelle; the `.thy` files were last - touched in the `Tropical_Semirings` close sweep, with subsequent CI - hardening commits on top). -- **Local clone for this audit.** - `/home/hyperpolymath/dev/repos/repos-monorepo/verification-ecosystem/tropical-resource-typing`. - -## Name-by-name correspondence - -| Agda (`EchoTropical.agda`) | Isabelle (`Tropical.thy`) | Lean4 (`TropicalSessionTypes.lean`) | Notes | -|---|---|---|---| -| `_⊕_` (max-plus add on `ℕ`, line 23) | `trop_add` (function, line 41) | `tAdd` (function, line 96) | Same operation (max with identity element absorbed at the left). DIVERGES (carrier): Agda's `_⊕_` operates on raw `ℕ` with `zero` acting as the additive identity by the recursion shape; Isabelle's `trop_add` and Lean's `tAdd` both operate on a *lifted* carrier (`tropical = Fin nat \| NegInf` / `Tropical = .val Nat \| .bot`) where the additive identity is the bottom element `−∞`, not `0`. The `ℕ` quotient on the Agda side is intentional (the bridge only needs scores in `ℕ`) but means Agda's `_⊕_` is the restriction of the Isabelle/Lean operation to the finite sub-semiring; the algebraic laws below match on that restriction. | -| `⊕-idem` (line 30) | `trop_add_idem [simp]` (lemma, line 73) | — | Match (Agda ↔ Isabelle): Agda `⊕-idem : ∀ m → m ⊕ m ≡ m` ↔ Isabelle `trop_add_idem : trop_add a a = a`. The Isabelle file also restates this at typeclass level as `tropical_add_idem` (theorem, line 266: `(a :: tropical) + a = a`); the bare-function lemma is the closer match. Lean side has NO named idempotence theorem — the file ships 13 CommSemiring laws (commut/assoc/identity/distrib) but not `tAdd a a = a`. The Lean docstring explicitly flags this gap: `tropical_grade_le_sequentialTotal` is offered as the "Lean analogue of Isabelle `tropical_add_idem`" because `max a b ≤ a + b` is what `add_idem` buys in a dioid. So the Lean cell is `—` for the bare law and `tropical_grade_le_sequentialTotal` for the downstream consumer. | -| `score-⊕-idem` (line 82) | — | — | Unilateral (Agda-only). The Agda side specialises `⊕-idem` to scores of the 3-candidate set; the adjacent repo has no `Candidate` type and no `score` function, so the specialisation has no analog. | -| `tropical-non-injective` (line 55) | — | — | Unilateral (Agda-only). Headline of the echo-retention bridge: there exist distinct candidates with the same tropical score. The adjacent repo does not type candidates (its tropical semiring is generic), so there is nothing to be non-injective about. | -| `tropical-collapse-visible` (line 121) | — | — | Unilateral (Agda-only). `score a ≡ score b` for the concrete 3-candidate choice; no analog. | -| `Echo` / `echo-intro` / `TropEcho` / `IsArgmin` (lines 59–73) | — | — | Unilateral (Agda-only). The echo type itself (`Echo f y := Σ A (λ x → f x ≡ y)`) is an echo-types invention; the adjacent repo has no fibre type and no echo bridge. | -| `echo0-to-tropical` (line 113) | — | — | Unilateral (Agda-only). Bridge map echo → tropical residue; no analog (no echo on the other side). | -| `distinct-candidates-same-visible-distinct-echo` (line 130) | — | — | Unilateral (Agda-only). The main bridge theorem: collapse on the visible (tropical) side, retention on the echo side. No analog. | -| `tropical-echo-retention-simple` (line 135) | — | — | Unilateral (Agda-only). Simplified restatement of the headline bridge. | -| (no Agda analog) | `trop_mul` (function, line 46) | `tMul` (function, line 103) | DIVERGES: the adjacent repo carries a full semiring (add + mul), the Agda side does not. The Agda bridge needs only the additive (max) structure of the dioid; multiplicative tropical structure is out of scope for the echo bridge as it currently stands. | -| (no Agda analog) | `trop_add_comm` (line 65) | `add_comm_trop` (line 114) | Adjacent-side commutativity. Match between Isabelle and Lean. No Agda analog by design — `_⊕_` on `ℕ` is commutative but the lemma is not stated because the bridge headlines do not consume it. | -| (no Agda analog) | `trop_add_assoc` (line 69) | `add_assoc_trop` (line 117) | Adjacent-side associativity. Match between Isabelle and Lean. No Agda analog by design (same reason as commutativity). | -| (no Agda analog) | `trop_distrib_{left,right}` (lines 122/126); semiring instance | `left_distrib_trop` / `right_distrib_trop` (lines 167/173); `CommSemiring Tropical` instance (line 208) | Adjacent-side distributivity + semiring typeclass wiring. Match between Isabelle and Lean. Out of scope for the echo bridge. | - -## Alignment caveats - -- **No Agda↔Isabelle/Lean import surface.** Agda cannot `import` a - `.thy` or a `.lean`; Isabelle and Lean4 cannot `import` an `.agda`. - Any "alignment" between these files is therefore citation-level only - — a reader verifies the names and statements line up, but each - prover runs its own independent proof. None of the three is a - trusted oracle for either of the others. -- **Independent proofs, identical claims.** The first alignable - theorem pair is `⊕-idem` (Agda) ↔ `trop_add_idem` (Isabelle). Both - are proved (clean, no axioms, no `sorry`); the Agda side under - `--safe --without-K`, the Isabelle side as a `simp` lemma against - the algebraic kernel of `Tropical.thy`. The Lean side does not name - this fact directly but consumes it inside the QTT refinement - theorem `tropical_grade_le_sequentialTotal` (`max a b ≤ a + b` is - the dioid consequence of additive idempotence). -- **Carrier mismatch is intentional, not a defect.** Agda's `_⊕_` - lives on `ℕ` (the score type); Isabelle/Lean live on the lifted - carrier with an explicit `−∞` bottom. The Agda side never needs - `−∞` because every candidate has a finite score; the bridge is - consciously narrower than the full max-plus semiring. -- **Echo-side machinery is Agda-exclusive.** The `Echo`/`TropEcho` - fibre type, `IsArgmin`, the candidate datatype, and all bridge - headlines (`tropical-non-injective`, `echo0-to-tropical`, - `distinct-candidates-same-visible-distinct-echo`) have no analog - on the Isabelle or Lean sides. The adjacent repo's tropical - semiring stands on its own and is consumed by *session-type - grading* (`grade : Session → Tropical` in Lean), which is the - symmetric Agda-exclusive direction. -- **Long-game alignment target.** When the echo-types ordinal track - reaches Bachmann–Howard (ψ₀(Ω_ω); see `roadmap.adoc` §Lane 3 and - `docs/buchholz-plan.adoc`), the adjacent repo's - `Tropical_Ordinal_Bridge.thy` becomes the natural cross-repo - alignment target (Agda Buchholz BT ↔ Isabelle `tropO` carrier). - This target is **firewalled** until the ordinal track lands the - milestone — do not pull it forward. - -## Revision history - -- 2026-05-20: created (initial citation-level correspondence). diff --git a/docs/build.adoc b/docs/build.adoc new file mode 100644 index 0000000..c8de3f1 --- /dev/null +++ b/docs/build.adoc @@ -0,0 +1,32 @@ +== Build Instructions + +This repository contains mechanically verified proofs written in Agda. + +=== Prerequisites + +* Agda (with the standard library) +* `+just+` (command runner) + +=== Verifying the Proofs + +To run the complete verification suite, including safety checks and +build steps: + +[source,bash] +---- +sh scripts/verify.sh +---- + +To build the Agda proofs via `+just+`: + +[source,bash] +---- +just build-all +---- + +To run the full suite via `+just+`: + +[source,bash] +---- +just test-all +---- diff --git a/docs/build.md b/docs/build.md deleted file mode 100644 index 2d08812..0000000 --- a/docs/build.md +++ /dev/null @@ -1,29 +0,0 @@ - - -# Build Instructions - -This repository contains mechanically verified proofs written in Agda. - -## Prerequisites -- Agda (with the standard library) -- `just` (command runner) - -## Verifying the Proofs - -To run the complete verification suite, including safety checks and build steps: - -```bash -sh scripts/verify.sh -``` - -To build the Agda proofs via `just`: - -```bash -just build-all -``` - -To run the full suite via `just`: - -```bash -just test-all -``` diff --git a/docs/echo-types/composition.adoc b/docs/echo-types/composition.adoc new file mode 100644 index 0000000..e1206f0 --- /dev/null +++ b/docs/echo-types/composition.adoc @@ -0,0 +1,442 @@ +== Echo Types — Composition + +*Status:* working note mixing established results and open conjectures. +Every result backed by the current Agda development is marked +_Agda-backed_; every conjectural claim is labelled explicitly. + +____ +*Forward-link (2026-05-27).* The composition-track narrative this doc +maintains has been consolidated into +link:fibration-package.adoc[`+fibration-package.adoc+`] (`+map-over+` +action + `+Echo-comp-iso+` accumulation + `+cancel-iso+` cancellation + +pentagon coherence, threaded with reading order). The fibration-package +consolidation is now the recommended entry point; this doc remains as +the longer-form working-note narrative with the per-section +conjecture-vs-proof labelling. The proofs cited herein are all +Agda-backed and pinned in `+Smoke.agda+`. +____ + +''''' + +=== The central question + +Given `+f : A → B+` and `+g : B → C+`, how does +`+Echo(g ∘ f) : C → Set+` relate to `+Echo(f) : B → Set+` and +`+Echo(g) : C → Set+`? + +Three candidate answers to rule between: + +[arabic] +. *Accumulation.* The echoes stack: `+Echo(g ∘ f) y+` factors as +`+(Echo(f) b × Echo(g) y)+` integrated over intermediates `+b+`. +. *Weakening.* The echo of `+g ∘ f+` is _strictly less informative_ than +`+Echo(f)+` alone — composition can only lose more. +. *Cancellation.* When `+g+` has a section, `+Echo(g ∘ f)+` is +isomorphic to `+Echo(f)+`. + +The current Agda evidence strongly favours *accumulation* as the base +case and *cancellation* as a corollary. Weakening is true at the shadow +level but not generally at the intensional core. + +''''' + +=== Accumulation — Agda-backed (base case, landed) + +_Lemma._ For `+f : A → B+` and `+g : B → C+`, the type `+Echo(g ∘ f) y+` +is canonically isomorphic to `+Σ B (λ b → Echo(f) b × (g b ≡ y))+`. + +_Proof._ Σ-associativity plus propositional-equality rearrangement. In +Agda terms, given + +.... +Echo f b = Σ A (λ x → f x ≡ b) +Echo g y = Σ B (λ b → g b ≡ y) +Echo (g ∘ f) y = Σ A (λ x → g (f x) ≡ y) +.... + +the iso is witnessed by + +.... +to (x , p) = (f x , (x , refl) , p) +from (b , (x , refl) , p) = (x , p) +.... + +and both round-trips reduce to `+refl+` definitionally once the `+refl+` +pattern has pinned the intermediate `+b+` to `+f x+`. Landed in +`+proofs/agda/Echo.agda+` as `+Echo-comp-iso-to+`, +`+Echo-comp-iso-from+`, `+Echo-comp-iso-from-to+`, +`+Echo-comp-iso-to-from+` (all pinned in `+Smoke.agda+`). + +_Agda adjacency._ `+Echo.map-over-comp+` proves functoriality of the +derived action on echoes; this is the morphism side of the same +composition law. The object-side iso above and the morphism-side +composition law together give a coherent two-level story for +composition. + +''''' + +=== Cancellation — partial (Agda-backed maps, iso deferred) + +_Statement._ If `+g : B → C+` has a two-sided inverse `+s : C → B+` with +`+s-left : ∀ b → s (g b) ≡ b+` and `+s-right : ∀ y → g (s y) ≡ y+`, then +`+Echo(g ∘ f) y+` and `+Echo(f) (s y)+` are related by a canonical +forward and backward map. + +_What is landed._ Two maps in `+proofs/agda/Echo.agda+`, each requiring +only the relevant half of the iso structure: + +.... +cancel-iso-to : (s-left : ∀ b → s (g b) ≡ b) → Echo (g ∘ f) y → Echo f (s y) +cancel-iso-from : (s-right : ∀ y → g (s y) ≡ y) → Echo f (s y) → Echo (g ∘ f) y +.... + +Pinned in `+Smoke.agda+` as `+cancel-iso-to+`, `+cancel-iso-from+`. + +_What is landed (round-trips + packaging)._ The two round-trips +`+cancel-iso-from-to+` and `+cancel-iso-to-from+` are now proved in +`+Echo.agda+`, each parameterised by its respective triangle-identity +coherence: + +* `+cancel-iso-from-to+` needs +`+triangle₁ : ∀ b → cong g (s-left b) ≡ s-right (g b)+`. +* `+cancel-iso-to-from+` needs +`+triangle₂ : ∀ y → cong s (s-right y) ≡ s-left (s y)+`. + +One triangle implies the other in HoTT (any quasi-inverse can be +upgraded to a half-adjoint equivalence), but constructing the upgrade +requires non-trivial path algebra, so both are taken as explicit +arguments. The full iso then packages via stdlib’s `+mk↔ₛ′+` as +`+Echo.cancel-iso : (s-left ...) (s-right ...) (triangle₁ ...) (triangle₂ ...) → Echo (g ∘ f) y ↔ Echo f (s y)+`. +Companion `+Echo.Echo-comp-iso+` does the same for the unconditional +accumulation iso (no triangles needed). All five pinned in +`+Smoke.agda+`. + +_Correction to earlier wording._ A bare section on `+g+` (i.e., +`+s-right+` only) is not enough to collapse the Σ-over-intermediate in +the accumulation law; the earlier version of this section claimed +otherwise. The correction is that both `+s-left+` and `+s-right+` are +needed, and the full iso additionally needs the two triangle identities +— both are passed explicitly. + +''''' + +=== Weakening — true at the shadow, false at the core + +_Observation (Agda-backed)._ At the extensional shadow, +`+Shadow(g ∘ f) ⊆ Shadow(g)+`, because `+image(g ∘ f) ⊆ image(g)+`. So +at the shadow level, composition weakens: you cannot learn more after an +additional forgetful step. + +_Counter at the core._ At the intensional core, `+Echo(g ∘ f) y+` can +carry _more_ witness structure than `+Echo(g) y+` alone — specifically, +it records which `+b ∈ Echo(g) y+` came via `+f+`. This is the content +of the accumulation iso above: the composed echo is the sum-total, not +just the outer fiber. + +_Summary._ Weakening is a shadow-level phenomenon. At the core, +composition _accumulates_ witnesses rather than losing them. + +''''' + +=== Open questions + +==== Q1. 2-categorical structure — closed (rule-out) + +_Verdict._ No 2-category. The five structurally plausible organisations +(echo as a lax/oplax 2-functor; slice-of-echos with `+IsMediator+` +cells; double category; graded bicomonad; Grothendieck stack) each +collapse to existing 1-cat + graded-comonad + pullback content because +every would-be 2-cell appears as `+refl+` or is prop-forced trivial by +`+≤g-prop+` / `+⊑-prop+`. The composition laws (accumulation iso, +cancel-iso, pentagon Σ-assoc, decoration commuting) are _not_ +2-coherence laws of a hypothesised 2-category — they are the +1-categorical composition laws of a pullback-presented type, full stop. +See `+docs/echo-types/decisions/no-2-cat.adoc+` for the full closure +note (verdict / evidence / implication). + +==== Q2. Negative echoes + +_Question._ Is there a systematic dual to `+Echo(f)+` — call it +`+CoEcho(f)+` — that records _what has been lost_ rather than what +remains? For a linear map this would correspond to the kernel; for a +general map, to a typed analogue of the fibre-wise "`information loss`". + +_Candidate._ +`+CoEcho(f)(y) = (something like) "equivalence class of preimages of y modulo identity"+`. +The tropical / metric echo (`+EchoTropical.agda+`) may be the first +instance. + +_Status._ Speculative. Worth developing alongside approximate echoes. + +==== Q3. Composition of approximate echoes + +_Question._ Under the approximate-echo definition (taxonomy, axis 2), +does composition give a clean tolerance calculus? + +_Conjecture._ For metric-tolerance echoes, +`+ε₁-echo(f) ⊙ ε₂-echo(g) ⊑ (ε₁ + L_g · ε₂)-echo(g ∘ f)+` where `+L_g+` +is a Lipschitz constant of `+g+`. This is a crude first guess — the +right form may involve sup-norms, dilation-operators, or coarser bounds. + +_Status (updated)._ No longer entirely speculative. The non-expansive +case (`+L_g = 1+`) is landed as +`+EchoApprox.Approx.echo-approx-compose+` in additive form +`+(ε₁ + ε₂)-echo(g ∘ f)+`. The compositional _shape_ — whether the +forward/backward maps form a strict iso analogous to `+Echo-comp-iso+` — +is settled in the negative: it is a _retract_, not an iso, because the +RHS Σ admits multiple splits of the budget and the chosen intermediate +`+b+` is not pinned by the input. The axis-2 design note +(`+/tmp/echo-types-exploration/axis2-approximate.md+` §5) gives the full +discussion. + +First slice of the retract landed in `+EchoApprox.agda+`: +`+echo-approx-comp-sound+` (RHS-Σ → LHS via `+echo-approx-compose+`), +`+echo-approx-comp-retract-to+` (canonical-split LHS → RHS-Σ section at +`+b := f x+`, `+ε₁ := zero+`, `+ε₂ := ε+`), and +`+echo-approx-comp-retract-A+` (A-component round-trip preserves the +witness up to `+refl+`). + +Rung-C slice (post-PR-#74, design call resolved in favour of option +(b)): a separate `+BalancedTolerance+` record layered on `+Tolerance+` +(mirroring how `+Separated+` layers on `+PseudoMetric+`), carrying +`++-identityˡ : ∀ ε → zero + ε ≡ ε+` and +`++-identityʳ : ∀ ε → ε + zero ≡ ε+`. The base `+Tolerance+` interface +stays untouched; lemmas that need the identity laws take an explicit +`+BalancedTolerance+` hypothesis. With it landed: +`+echo-approx-comp-retract-B+` (B-component pin: the canonical-split +section picks `+b := f x+` definitionally, `+refl+`), +`+echo-approx-comp-retract-budget+` (`+(zero + ε) ≡ ε+` from +`++-identityˡ+`), and `+echo-approx-comp-retract-from-to+` +(budget-aligned A-component round-trip: +`+proj₁ (subst _ (+-identityˡ ε) (sound (retract-to e))) ≡ proj₁ e+`). +The full transported equality +`+subst _ (+-identityˡ ε) (sound (retract-to e)) ≡ e+` is NOT discharged +— it would require propositionality of the order `+_≤_+` on the inner +bound, which `+Tolerance+` deliberately does not assert; the A-component +statement is the strongest available without that extra hypothesis. + +Second slice landed alongside (axis-2 design note §7 obligations 7 and +8): `+Separated+` (separation predicate on the pseudo-metric: +`+dist b₁ b₂ ≤ zero → b₁ ≡ b₂+`), `+echo-approx-zero-collapses-strict+` +(under separation, every zero-tolerance approximate echo IS a strict +echo with the same A-witness — the §4 "`Approximate → strict, only when +separated, at ε = 0`" statement made formal), and the axis-1 shadow +lemmas `+echo-shadow-A+`, `+echo-shadow-iso-{to,from}+`, +`+echo-strict→approx-shadow-A+`, +`+echo-strict→approx-collapse-shadow-A+`. The last two pin the axis-1 / +axis-2 cross-classification: the A-component (the axis-1 "`shadow`" of +the approximate echo) is preserved on the nose by `+echo-strict→approx+` +and round-trips definitionally through the zero-collapse under +separation. + +The Lipschitz generalisation (`+L_g ≠ 1+`) remains deferred — it +requires multiplication on `+Tolerance+`, another interface call. The +full transported LHS round-trip equality (beyond the A-component) +remains deferred too — it needs `+_≤_+`-propositionality, which is +structurally orthogonal to `+BalancedTolerance+`. + +==== Q4. Associativity — landed + +_Question._ Does the accumulation isomorphism above satisfy the pentagon +coherence for three-fold composition? I.e., for `+f : A → B+`, +`+g : B → C+`, `+h : C → D+`, do the two ways of associating +`+Echo((h ∘ g) ∘ f) ≃ Echo(h ∘ (g ∘ f))+` yield equivalent iso’s? + +_Answer._ Yes, at both levels. The two projection-pentagon lemmas +`+Echo-comp-iso-pent-B+` and `+Echo-comp-iso-pent-echo+` (both `+refl+`) +confirm that the two natural factorings — inner-first `+(f, h∘g)+` +versus outer-first `+(g∘f, h)+` then `+(f, g)+` — produce the same +`+f x+` at the B-component and the same `+(x , refl) : Echo f (f x)+` at +the Echo-f witness. The full Σ-associativity iso between the two nested +Σ-shapes (which differ by whether the intermediate `+c : C+` with +`+g b ≡ c+` is carried or absorbed) lands as +`+Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}+` and is packaged +as a stdlib `+Function.Bundles._↔_+` via `+Echo-comp-pent-Σ-assoc+`. +Both round-trips reduce definitionally once `+g b ≡ c+` has been pinned, +so this is a strict iso inside `+--safe --without-K+`. + +_Confirmed this is the right shape._ Both lemmas land as `+refl+` +without any `+trans-assoc+` / `+cong-trans+` manipulation, because +`+Echo-comp-iso-to+`’s body `+(x , p) ↦ (f x , (x , refl) , p)+` is +structurally symmetric in the outer function — the f-component and +witness do not depend on which outer is peeled off. If the iso had a +`+trans+`-shaped body instead, pentagon would have required real +coherence lemmas. The `+refl+` outcome is the _definitive +characterisation_: pentagon is identity — what would be the +bicategorical associator-2-cell — and is forced trivial here. With the +2-cat shape ruled out (§Q1; `+decisions/no-2-cat.adoc+`), this is no +longer "`evidence the iso has the right design`" but the +1-categorical-final reading of it. + +==== Q5. Interaction with role-indexing, gradings, linearity + +_Question._ The existing repo modules `+EchoIndexed+`, `+EchoGraded+`, +`+EchoLinear+` each decorate the basic echo with extra structure (role +index, grade label, mode tag). Does composition commute with these +decorations, or do some decorations require refined composition laws? + +_Evidence._ `+EchoGraded.degrade-comp+` is the first hint of a +graded-composition law. Linear echoes via `+EchoLinear.weaken+` behave +by weakening along mode transitions. No systematic cross-check between +these decorations has been attempted. + +==== Q6. Composition in the presence of recovery / echo-erasure + +_Question._ When a downstream stage "`uses`" the echo — extracts the +preimage `+x+` and re-applies `+f+` to reconstruct `+y+` — the echo is +temporarily made definite. Does the composition law respect this +extraction? + +_Formalisation hint (revised)._ With the 2-cat shape ruled out (§Q1; +`+decisions/no-2-cat.adoc+`), recovery is a 1-categorical notion: a +slice morphism into `+Echo f y+` (the extraction step) followed by the +canonical projection, or equivalently a section of the appropriate +fibration. The earlier "`expressible as a 2-cell in the hypothetical +2-category of Q1`" hedge no longer applies. Not attempted; now +write-up-tractable on a 1-categorical footing. + +''''' + +=== Composition laws — a compact statement + +Collecting the above: + +[arabic] +. *(Landed) Base accumulation iso.* +`+Echo(g ∘ f) y ≃ Σ B (λ b → Echo(f) b × (g b ≡ y))+`. Proved in +`+Echo.agda+` as `+Echo-comp-iso-{to, from, from-to, to-from}+`. +. *(Agda-backed) Functorial action.* `+map-over+` respects composition: +`+map-over (g' , c₁) ∘ map-over (f' , c₂) ≡ map-over ((g' ∘ f') , coherence)+`. +Proved in `+Echo.map-over-comp+`. +. *(Landed) Cancellation.* Forward, backward, both round-trips landed in +`+Echo.agda+` as `+cancel-iso-{to, from, from-to, to-from}+`, plus +the packaging `+Echo.cancel-iso : ... ↔ ...+` via stdlib’s `+mk↔ₛ′+`. +Round-trips parameterised by both triangle identities (`+triangle₁+`, +`+triangle₂+`) — one implies the other in HoTT, but the constructive +upgrade is non-trivial path algebra, so both are explicit. +. *(Landed) Pentagon.* Three-fold composition associates at the +projections (`+Echo-comp-iso-pent-B+`, `+Echo-comp-iso-pent-echo+`, both +`+refl+`) and at the full Σ shape +(`+Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}+`). The two +nested-Σ shapes differ only by Σ-associativity / unification of the +intermediate base point; both round-trips reduce definitionally once +`+g b ≡ c+` is pinned, so this is a strict iso inside +`+--safe --without-K+`. All four iso components pinned in +`+Smoke.agda+`. +. *(Landed) Tolerance calculus.* For approximate echoes, tolerances +compose additively under a non-expansive outer leg. Realised as +`+EchoApprox.Approx.echo-approx-compose+` over a parametric +pseudo-metric. +. *(Landed) Decoration commuting — sweep complete (2026-04-28).* All +five decorations now commute with composition under the same recipe +(decoration order → propositionality → join → factoring- free compose → +via-join restatement): +* Grade: `+EchoGraded.degrade-{compose, via-join}+` resting on +`+≤g-prop+`, `+degrade-comp+`, and `+_⊔g_+` join structure +(`+≤g-⊔g-{left,right,univ}+`). +* Linear: `+EchoLinear.degradeMode-{comp, compose, via-join}+` along the +two-mode order with `+_⊔m_+` join (affine top). +* Indexed: `+EchoIndexed.map-role-indexed-comp+`. +* Choreo (role): `+EchoChoreo.applyChoreo-{comp, compose, via-join}+` +along `+_⊑c_+` (`+Client ⊑c Server+`) with `+_⊔c_+` join. +* Modal (epistemic): `+EchoEpistemic.knowledge-monotone-{comp, id}+`. +All headlines pinned in `+Smoke.agda+`. + +''''' + +=== What to formalise next + +Ranked by unblock-value. (1) and (2) landed; (3) onwards is open. + +[arabic] +. [line-through]#*Base accumulation iso.*# Landed in `+Echo.agda+` as +`+Echo-comp-iso-{to, from, from-to, to-from}+`. +. [line-through]#*Cancellation corollary.*# *Fully landed* as +`+cancel-iso-{to, from, from-to, to-from}+` plus the +`+Function.Bundles._↔_+` packaging `+Echo.cancel-iso+`, parameterised by +`+s-left+`, `+s-right+`, and both triangle identities. See §3 above for +the triangle structure. +. [line-through]#*Pentagon coherence.*# Landed: projection-level +(`+-pent-B+`, `+-pent-echo+` as `+refl+`) plus the full Σ-shape iso +(`+Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}+`). +. [line-through]#*Full cancel-iso with round-trips.*# Landed: +`+Echo.cancel-iso+` packages the four pieces +(`+cancel-iso-{to, from, from-to, to-from}+`) plus both +triangle-identity coherences as a single `+Function.Bundles._↔_+` +record. Companion `+Echo.Echo-comp-iso+` does the same for the +unconditional accumulation iso (no triangles needed). Built via stdlib’s +`+mk↔ₛ′+`; both round-trips close on the existing pointwise lemmas. +. [line-through]#*Approximate-echo skeleton.*# Landed in +`+EchoApprox.agda+` with `+EchoR ε f y+`, `+echo-approx-intro+`, +`+echo-approx-relax+`, and `+echo-approx-compose+` (additive under +non-expansive outer leg). +. *Decoration commuting.* Per-decoration lemmas in the existing +`+EchoGraded+`, `+EchoLinear+`, `+EchoIndexed+`, `+EchoChoreo+`, +`+EchoEpistemic+` modules. _Grade case landed_: +`+EchoGraded.degrade-compose+` (per-decoration composition law) and +`+degrade-via-join+` (its join-structured restatement), resting on +`+≤g-prop+` and `+degrade-comp+`. _Linear case landed_: +`+EchoLinear.degradeMode-{comp,compose,via-join}+` along the two-mode +order. _Indexed case landed_: `+EchoIndexed.map-role-indexed-comp+`. +_Modal case landed_: `+EchoEpistemic.knowledge-monotone-comp+` (with +`+knowledge-monotone-id+` identity-step corollary). _Role/choreo case +landed_: `+EchoChoreo.applyChoreo-{comp,compose,via-join}+` along the +choreographic-reachability order `+_⊑c_+` (`+Client ⊑c Server+`), +resting on `+⊑c-prop+` and the canonical `+_⊔c_+` join. The +five-decoration sweep is now closed at the per-decoration composition +rung. + +None of these depend on the blocked Buchholz-WF / shared-binder work. +All are Sonnet-class proofs; (5) is Opus 4.7 design and Sonnet +execution. + +''''' + +=== Anti-pattern — closing a degrade-map obligation within an endpoint + +_Status: methodological note (2026-05-30). Not Agda-backed; the upstream +theorem it abstracts from IS Agda-backed._ + +The per-decoration composition rung (§6, "`Decoration commuting`") +proves that for each decoration `+D+` the degrade map +`+degrade : ⊑ → Echo D₁ → Echo D₂+` commutes with composition under a +recipe: order → propositionality → join → factoring-free compose → +via-join restatement. The recipe makes the cross-decoration obligation — +"`two successive weakenings agree with a single weakening along the +composed proof`" — _explicitly_ a property of the degrade map, not of +either endpoint. The upstream theorem is `+EchoLinear.degradeMode-comp+` +(`+proofs/agda/EchoLinear.agda:93-101+`), three `+refl+` clauses pinning +each reachable constructor pair. + +*The anti-pattern.* When a decoration `+D₁ ≤ D₂+` connects two indexed +instances of a fiber, an obligation that mentions _both_ endpoints does +not close inside either endpoint alone. Attempting to discharge it by +strengthening a typing rule of `+D₁+` (or `+D₂+`) with a premise that +references the other endpoint’s invariant is structurally ill-shaped: +the load-bearing content lives on the degrade arrow. + +*Detection heuristic.* If a proof attempt requires adding a premise to a +rule of one decoration that mentions a _different_ decoration’s +invariant (e.g. a region-presence premise on a modality-indexed rule), +the discipline is being violated. The corrective is to relocate the +obligation to the decoration map, not to thicken the endpoint. + +*Empirical downstream test.* The `+hyperpolymath/ephapax+` project’s L1 +region-capability layer admits an analogue cross-decoration obligation. +An empirical closure attempt (ephapax PR #170, merged 2026-05-27) +strengthened the L1 variable rule `+T_Var_*_L1+` with a +region-well-formedness premise and verified the resulting axiom remained +false on a concrete typing-level counterexample +(`+ERegion rv (EI32 5) : TBase TI32 at R = [rv]+`). The honest closure +path identified in ephapax’s `+PRESERVATION-DESIGN.md+` §4.8.1 is +cross-layer — the obligation lives at the L1→L2 boundary where the +effect-typed `+TFun+` of `+T_Lam_Linear_L2+` carries the region-effect +that L1’s R-threading lacks. The pattern matches the echo-types +abstraction: visible source-level discrepancies _can_ be absorbed inside +an endpoint (and PR #170 absorbed one), but the cross-decoration +obligation cannot. + +The downstream test is not a proof of the upstream theorem — it is +empirical evidence that the discipline detects ill-shaped attempts at +the point the abstraction predicts. See echo-types#125 for the issue +thread that surfaced this observation. diff --git a/docs/echo-types/composition.md b/docs/echo-types/composition.md deleted file mode 100644 index 17acadf..0000000 --- a/docs/echo-types/composition.md +++ /dev/null @@ -1,450 +0,0 @@ - - -# Echo Types — Composition - -**Status:** working note mixing established results and open -conjectures. Every result backed by the current Agda development is -marked *Agda-backed*; every conjectural claim is labelled explicitly. - -> **Forward-link (2026-05-27).** The composition-track narrative this -> doc maintains has been consolidated into -> [`fibration-package.adoc`](fibration-package.adoc) (`map-over` action -> + `Echo-comp-iso` accumulation + `cancel-iso` cancellation + -> pentagon coherence, threaded with reading order). The -> fibration-package consolidation is now the recommended entry point; -> this doc remains as the longer-form working-note narrative with the -> per-section conjecture-vs-proof labelling. The proofs cited herein -> are all Agda-backed and pinned in `Smoke.agda`. - ---- - -## The central question - -Given `f : A → B` and `g : B → C`, how does `Echo(g ∘ f) : C → Set` -relate to `Echo(f) : B → Set` and `Echo(g) : C → Set`? - -Three candidate answers to rule between: - -1. **Accumulation.** The echoes stack: `Echo(g ∘ f) y` factors as - `(Echo(f) b × Echo(g) y)` integrated over intermediates `b`. -2. **Weakening.** The echo of `g ∘ f` is *strictly less informative* - than `Echo(f)` alone — composition can only lose more. -3. **Cancellation.** When `g` has a section, `Echo(g ∘ f)` is - isomorphic to `Echo(f)`. - -The current Agda evidence strongly favours **accumulation** as the -base case and **cancellation** as a corollary. Weakening is true at -the shadow level but not generally at the intensional core. - ---- - -## Accumulation — Agda-backed (base case, landed) - -*Lemma.* For `f : A → B` and `g : B → C`, the type -`Echo(g ∘ f) y` is canonically isomorphic to -`Σ B (λ b → Echo(f) b × (g b ≡ y))`. - -*Proof.* Σ-associativity plus propositional-equality rearrangement. -In Agda terms, given -``` -Echo f b = Σ A (λ x → f x ≡ b) -Echo g y = Σ B (λ b → g b ≡ y) -Echo (g ∘ f) y = Σ A (λ x → g (f x) ≡ y) -``` -the iso is witnessed by -``` -to (x , p) = (f x , (x , refl) , p) -from (b , (x , refl) , p) = (x , p) -``` -and both round-trips reduce to `refl` definitionally once the -`refl` pattern has pinned the intermediate `b` to `f x`. Landed -in `proofs/agda/Echo.agda` as `Echo-comp-iso-to`, `Echo-comp-iso-from`, -`Echo-comp-iso-from-to`, `Echo-comp-iso-to-from` (all pinned in -`Smoke.agda`). - -*Agda adjacency.* `Echo.map-over-comp` proves functoriality of the -derived action on echoes; this is the morphism side of the same -composition law. The object-side iso above and the morphism-side -composition law together give a coherent two-level story for -composition. - ---- - -## Cancellation — partial (Agda-backed maps, iso deferred) - -*Statement.* If `g : B → C` has a two-sided inverse `s : C → B` -with `s-left : ∀ b → s (g b) ≡ b` and `s-right : ∀ y → g (s y) ≡ y`, -then `Echo(g ∘ f) y` and `Echo(f) (s y)` are related by a canonical -forward and backward map. - -*What is landed.* Two maps in `proofs/agda/Echo.agda`, each -requiring only the relevant half of the iso structure: -``` -cancel-iso-to : (s-left : ∀ b → s (g b) ≡ b) → Echo (g ∘ f) y → Echo f (s y) -cancel-iso-from : (s-right : ∀ y → g (s y) ≡ y) → Echo f (s y) → Echo (g ∘ f) y -``` -Pinned in `Smoke.agda` as `cancel-iso-to`, `cancel-iso-from`. - -*What is landed (round-trips + packaging).* The two round-trips -`cancel-iso-from-to` and `cancel-iso-to-from` are now proved in -`Echo.agda`, each parameterised by its respective triangle-identity -coherence: - -* `cancel-iso-from-to` needs `triangle₁ : ∀ b → cong g (s-left b) ≡ - s-right (g b)`. -* `cancel-iso-to-from` needs `triangle₂ : ∀ y → cong s (s-right y) ≡ - s-left (s y)`. - -One triangle implies the other in HoTT (any quasi-inverse can be -upgraded to a half-adjoint equivalence), but constructing the upgrade -requires non-trivial path algebra, so both are taken as explicit -arguments. The full iso then packages via stdlib's `mk↔ₛ′` as -`Echo.cancel-iso : (s-left ...) (s-right ...) (triangle₁ ...) -(triangle₂ ...) → Echo (g ∘ f) y ↔ Echo f (s y)`. Companion -`Echo.Echo-comp-iso` does the same for the unconditional -accumulation iso (no triangles needed). All five pinned in -`Smoke.agda`. - -*Correction to earlier wording.* A bare section on `g` (i.e., -`s-right` only) is not enough to collapse the Σ-over-intermediate -in the accumulation law; the earlier version of this section -claimed otherwise. The correction is that both `s-left` and -`s-right` are needed, and the full iso additionally needs the two -triangle identities — both are passed explicitly. - ---- - -## Weakening — true at the shadow, false at the core - -*Observation (Agda-backed).* At the extensional shadow, -`Shadow(g ∘ f) ⊆ Shadow(g)`, because `image(g ∘ f) ⊆ image(g)`. So -at the shadow level, composition weakens: you cannot learn more -after an additional forgetful step. - -*Counter at the core.* At the intensional core, `Echo(g ∘ f) y` can -carry *more* witness structure than `Echo(g) y` alone — specifically, -it records which `b ∈ Echo(g) y` came via `f`. This is the content -of the accumulation iso above: the composed echo is the sum-total, -not just the outer fiber. - -*Summary.* Weakening is a shadow-level phenomenon. At the core, -composition *accumulates* witnesses rather than losing them. - ---- - -## Open questions - -### Q1. 2-categorical structure — closed (rule-out) - -*Verdict.* No 2-category. The five structurally plausible -organisations (echo as a lax/oplax 2-functor; slice-of-echos -with `IsMediator` cells; double category; graded bicomonad; -Grothendieck stack) each collapse to existing 1-cat + -graded-comonad + pullback content because every would-be 2-cell -appears as `refl` or is prop-forced trivial by `≤g-prop` / -`⊑-prop`. The composition laws (accumulation iso, cancel-iso, -pentagon Σ-assoc, decoration commuting) are *not* 2-coherence -laws of a hypothesised 2-category — they are the 1-categorical -composition laws of a pullback-presented type, full stop. See -`docs/echo-types/decisions/no-2-cat.adoc` for the full closure -note (verdict / evidence / implication). - -### Q2. Negative echoes - -*Question.* Is there a systematic dual to `Echo(f)` — call it -`CoEcho(f)` — that records *what has been lost* rather than what -remains? For a linear map this would correspond to the kernel; for -a general map, to a typed analogue of the fibre-wise "information -loss". - -*Candidate.* `CoEcho(f)(y) = (something like) "equivalence class of -preimages of y modulo identity"`. The tropical / metric echo -(`EchoTropical.agda`) may be the first instance. - -*Status.* Speculative. Worth developing alongside approximate -echoes. - -### Q3. Composition of approximate echoes - -*Question.* Under the approximate-echo definition (taxonomy, -axis 2), does composition give a clean tolerance calculus? - -*Conjecture.* For metric-tolerance echoes, -`ε₁-echo(f) ⊙ ε₂-echo(g) ⊑ (ε₁ + L_g · ε₂)-echo(g ∘ f)` where `L_g` -is a Lipschitz constant of `g`. This is a crude first guess — the -right form may involve sup-norms, dilation-operators, or -coarser bounds. - -*Status (updated).* No longer entirely speculative. The -non-expansive case (`L_g = 1`) is landed as -`EchoApprox.Approx.echo-approx-compose` in additive form -`(ε₁ + ε₂)-echo(g ∘ f)`. The compositional *shape* — whether the -forward/backward maps form a strict iso analogous to -`Echo-comp-iso` — is settled in the negative: it is a *retract*, -not an iso, because the RHS Σ admits multiple splits of the budget -and the chosen intermediate `b` is not pinned by the input. The -axis-2 design note (`/tmp/echo-types-exploration/axis2-approximate.md` -§5) gives the full discussion. - -First slice of the retract landed in `EchoApprox.agda`: -`echo-approx-comp-sound` (RHS-Σ → LHS via `echo-approx-compose`), -`echo-approx-comp-retract-to` (canonical-split LHS → RHS-Σ section -at `b := f x`, `ε₁ := zero`, `ε₂ := ε`), and -`echo-approx-comp-retract-A` (A-component round-trip preserves the -witness up to `refl`). - -Rung-C slice (post-PR-#74, design call resolved in favour of option -(b)): a separate `BalancedTolerance` record layered on `Tolerance` -(mirroring how `Separated` layers on `PseudoMetric`), carrying -`+-identityˡ : ∀ ε → zero + ε ≡ ε` and `+-identityʳ : ∀ ε → ε + zero -≡ ε`. The base `Tolerance` interface stays untouched; lemmas that -need the identity laws take an explicit `BalancedTolerance` -hypothesis. With it landed: -`echo-approx-comp-retract-B` (B-component pin: the canonical-split -section picks `b := f x` definitionally, `refl`), -`echo-approx-comp-retract-budget` (`(zero + ε) ≡ ε` from -`+-identityˡ`), and `echo-approx-comp-retract-from-to` (budget-aligned -A-component round-trip: `proj₁ (subst _ (+-identityˡ ε) (sound -(retract-to e))) ≡ proj₁ e`). The full transported equality `subst _ -(+-identityˡ ε) (sound (retract-to e)) ≡ e` is NOT discharged — it -would require propositionality of the order `_≤_` on the inner -bound, which `Tolerance` deliberately does not assert; the -A-component statement is the strongest available without that extra -hypothesis. - -Second slice landed alongside (axis-2 design note §7 obligations -7 and 8): `Separated` (separation predicate on the pseudo-metric: -`dist b₁ b₂ ≤ zero → b₁ ≡ b₂`), -`echo-approx-zero-collapses-strict` (under separation, every -zero-tolerance approximate echo IS a strict echo with the same -A-witness — the §4 "Approximate → strict, only when separated, at -ε = 0" statement made formal), and the axis-1 shadow lemmas -`echo-shadow-A`, `echo-shadow-iso-{to,from}`, -`echo-strict→approx-shadow-A`, -`echo-strict→approx-collapse-shadow-A`. The last two pin the -axis-1 / axis-2 cross-classification: the A-component (the axis-1 -"shadow" of the approximate echo) is preserved on the nose by -`echo-strict→approx` and round-trips definitionally through the -zero-collapse under separation. - -The Lipschitz generalisation (`L_g ≠ 1`) remains deferred — it -requires multiplication on `Tolerance`, another interface call. -The full transported LHS round-trip equality (beyond the -A-component) remains deferred too — it needs `_≤_`-propositionality, -which is structurally orthogonal to `BalancedTolerance`. - -### Q4. Associativity — landed - -*Question.* Does the accumulation isomorphism above satisfy the -pentagon coherence for three-fold composition? I.e., for -`f : A → B`, `g : B → C`, `h : C → D`, do the two ways of -associating `Echo((h ∘ g) ∘ f) ≃ Echo(h ∘ (g ∘ f))` yield equivalent -iso's? - -*Answer.* Yes, at both levels. The two projection-pentagon lemmas -`Echo-comp-iso-pent-B` and `Echo-comp-iso-pent-echo` (both `refl`) -confirm that the two natural factorings — inner-first `(f, h∘g)` -versus outer-first `(g∘f, h)` then `(f, g)` — produce the same -`f x` at the B-component and the same `(x , refl) : Echo f (f x)` -at the Echo-f witness. The full Σ-associativity iso between the -two nested Σ-shapes (which differ by whether the intermediate -`c : C` with `g b ≡ c` is carried or absorbed) lands as -`Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}` and is -packaged as a stdlib `Function.Bundles._↔_` via -`Echo-comp-pent-Σ-assoc`. Both round-trips reduce definitionally -once `g b ≡ c` has been pinned, so this is a strict iso inside -`--safe --without-K`. - -*Confirmed this is the right shape.* Both lemmas land as `refl` -without any `trans-assoc` / `cong-trans` manipulation, because -`Echo-comp-iso-to`'s body `(x , p) ↦ (f x , (x , refl) , p)` is -structurally symmetric in the outer function — the f-component -and witness do not depend on which outer is peeled off. If the -iso had a `trans`-shaped body instead, pentagon would have -required real coherence lemmas. The `refl` outcome is the -*definitive characterisation*: pentagon is identity — what would -be the bicategorical associator-2-cell — and is forced trivial -here. With the 2-cat shape ruled out (§Q1; -`decisions/no-2-cat.adoc`), this is no longer "evidence the iso -has the right design" but the 1-categorical-final reading of it. - -### Q5. Interaction with role-indexing, gradings, linearity - -*Question.* The existing repo modules `EchoIndexed`, `EchoGraded`, -`EchoLinear` each decorate the basic echo with extra structure -(role index, grade label, mode tag). Does composition commute with -these decorations, or do some decorations require refined -composition laws? - -*Evidence.* `EchoGraded.degrade-comp` is the first hint of a -graded-composition law. Linear echoes via `EchoLinear.weaken` behave -by weakening along mode transitions. No systematic cross-check -between these decorations has been attempted. - -### Q6. Composition in the presence of recovery / echo-erasure - -*Question.* When a downstream stage "uses" the echo — extracts the -preimage `x` and re-applies `f` to reconstruct `y` — the echo is -temporarily made definite. Does the composition law respect this -extraction? - -*Formalisation hint (revised).* With the 2-cat shape ruled out -(§Q1; `decisions/no-2-cat.adoc`), recovery is a 1-categorical -notion: a slice morphism into `Echo f y` (the extraction step) -followed by the canonical projection, or equivalently a section -of the appropriate fibration. The earlier "expressible as a -2-cell in the hypothetical 2-category of Q1" hedge no longer -applies. Not attempted; now write-up-tractable on a 1-categorical -footing. - ---- - -## Composition laws — a compact statement - -Collecting the above: - -1. **(Landed) Base accumulation iso.** - `Echo(g ∘ f) y ≃ Σ B (λ b → Echo(f) b × (g b ≡ y))`. Proved in - `Echo.agda` as `Echo-comp-iso-{to, from, from-to, to-from}`. - -2. **(Agda-backed) Functorial action.** `map-over` respects - composition: `map-over (g' , c₁) ∘ map-over (f' , c₂) ≡ map-over - ((g' ∘ f') , coherence)`. Proved in `Echo.map-over-comp`. - -3. **(Landed) Cancellation.** Forward, backward, both round-trips - landed in `Echo.agda` as `cancel-iso-{to, from, from-to, - to-from}`, plus the packaging `Echo.cancel-iso : ... ↔ ...` - via stdlib's `mk↔ₛ′`. Round-trips parameterised by both - triangle identities (`triangle₁`, `triangle₂`) — one implies - the other in HoTT, but the constructive upgrade is non-trivial - path algebra, so both are explicit. - -4. **(Landed) Pentagon.** Three-fold composition associates at - the projections (`Echo-comp-iso-pent-B`, `Echo-comp-iso-pent-echo`, - both `refl`) and at the full Σ shape - (`Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}`). The two - nested-Σ shapes differ only by Σ-associativity / unification of - the intermediate base point; both round-trips reduce - definitionally once `g b ≡ c` is pinned, so this is a strict iso - inside `--safe --without-K`. All four iso components pinned in - `Smoke.agda`. - -5. **(Landed) Tolerance calculus.** For approximate echoes, - tolerances compose additively under a non-expansive outer leg. - Realised as `EchoApprox.Approx.echo-approx-compose` over a - parametric pseudo-metric. - -6. **(Landed) Decoration commuting — sweep complete (2026-04-28).** - All five decorations now commute with composition under the same - recipe (decoration order → propositionality → join → factoring- - free compose → via-join restatement): - * Grade: `EchoGraded.degrade-{compose, via-join}` resting on - `≤g-prop`, `degrade-comp`, and `_⊔g_` join structure - (`≤g-⊔g-{left,right,univ}`). - * Linear: `EchoLinear.degradeMode-{comp, compose, via-join}` - along the two-mode order with `_⊔m_` join (affine top). - * Indexed: `EchoIndexed.map-role-indexed-comp`. - * Choreo (role): `EchoChoreo.applyChoreo-{comp, compose, - via-join}` along `_⊑c_` (`Client ⊑c Server`) with `_⊔c_` - join. - * Modal (epistemic): `EchoEpistemic.knowledge-monotone-{comp, - id}`. - All headlines pinned in `Smoke.agda`. - ---- - -## What to formalise next - -Ranked by unblock-value. (1) and (2) landed; (3) onwards is open. - -1. ~~**Base accumulation iso.**~~ Landed in `Echo.agda` as - `Echo-comp-iso-{to, from, from-to, to-from}`. -2. ~~**Cancellation corollary.**~~ **Fully landed** as - `cancel-iso-{to, from, from-to, to-from}` plus the - `Function.Bundles._↔_` packaging `Echo.cancel-iso`, - parameterised by `s-left`, `s-right`, and both triangle - identities. See §3 above for the triangle structure. -3. ~~**Pentagon coherence.**~~ Landed: projection-level - (`-pent-B`, `-pent-echo` as `refl`) plus the full Σ-shape iso - (`Echo-comp-pent-Σ-assoc-{to, from, from-to, to-from}`). -4. ~~**Full cancel-iso with round-trips.**~~ Landed: `Echo.cancel-iso` - packages the four pieces (`cancel-iso-{to, from, from-to, to-from}`) - plus both triangle-identity coherences as a single - `Function.Bundles._↔_` record. Companion `Echo.Echo-comp-iso` - does the same for the unconditional accumulation iso (no - triangles needed). Built via stdlib's `mk↔ₛ′`; both round-trips - close on the existing pointwise lemmas. -5. ~~**Approximate-echo skeleton.**~~ Landed in - `EchoApprox.agda` with `EchoR ε f y`, `echo-approx-intro`, - `echo-approx-relax`, and `echo-approx-compose` (additive under - non-expansive outer leg). -6. **Decoration commuting.** Per-decoration lemmas in the existing - `EchoGraded`, `EchoLinear`, `EchoIndexed`, `EchoChoreo`, - `EchoEpistemic` modules. *Grade case landed*: `EchoGraded.degrade-compose` - (per-decoration composition law) and `degrade-via-join` (its - join-structured restatement), resting on `≤g-prop` and `degrade-comp`. - *Linear case landed*: `EchoLinear.degradeMode-{comp,compose,via-join}` - along the two-mode order. *Indexed case landed*: - `EchoIndexed.map-role-indexed-comp`. *Modal case landed*: - `EchoEpistemic.knowledge-monotone-comp` (with `knowledge-monotone-id` - identity-step corollary). *Role/choreo case landed*: - `EchoChoreo.applyChoreo-{comp,compose,via-join}` along the - choreographic-reachability order `_⊑c_` (`Client ⊑c Server`), - resting on `⊑c-prop` and the canonical `_⊔c_` join. The - five-decoration sweep is now closed at the per-decoration - composition rung. - -None of these depend on the blocked Buchholz-WF / shared-binder -work. All are Sonnet-class proofs; (5) is Opus 4.7 design and -Sonnet execution. - ---- - -## Anti-pattern — closing a degrade-map obligation within an endpoint - -*Status: methodological note (2026-05-30). Not Agda-backed; the -upstream theorem it abstracts from IS Agda-backed.* - -The per-decoration composition rung (§6, "Decoration commuting") proves -that for each decoration `D` the degrade map `degrade : ⊑ → Echo D₁ → -Echo D₂` commutes with composition under a recipe: order → -propositionality → join → factoring-free compose → via-join restatement. -The recipe makes the cross-decoration obligation — "two successive -weakenings agree with a single weakening along the composed proof" — -*explicitly* a property of the degrade map, not of either endpoint. -The upstream theorem is `EchoLinear.degradeMode-comp` -(`proofs/agda/EchoLinear.agda:93-101`), three `refl` clauses pinning -each reachable constructor pair. - -**The anti-pattern.** When a decoration `D₁ ≤ D₂` connects two -indexed instances of a fiber, an obligation that mentions *both* -endpoints does not close inside either endpoint alone. Attempting to -discharge it by strengthening a typing rule of `D₁` (or `D₂`) with a -premise that references the other endpoint's invariant is structurally -ill-shaped: the load-bearing content lives on the degrade arrow. - -**Detection heuristic.** If a proof attempt requires adding a premise -to a rule of one decoration that mentions a *different* decoration's -invariant (e.g. a region-presence premise on a modality-indexed rule), -the discipline is being violated. The corrective is to relocate the -obligation to the decoration map, not to thicken the endpoint. - -**Empirical downstream test.** The `hyperpolymath/ephapax` project's -L1 region-capability layer admits an analogue cross-decoration -obligation. An empirical closure attempt (ephapax PR #170, merged -2026-05-27) strengthened the L1 variable rule -`T_Var_*_L1` with a region-well-formedness premise and verified the -resulting axiom remained false on a concrete typing-level -counterexample (`ERegion rv (EI32 5) : TBase TI32 at R = [rv]`). The -honest closure path identified in ephapax's `PRESERVATION-DESIGN.md` -§4.8.1 is cross-layer — the obligation lives at the L1→L2 boundary -where the effect-typed `TFun` of `T_Lam_Linear_L2` carries the -region-effect that L1's R-threading lacks. The pattern matches the -echo-types abstraction: visible source-level discrepancies *can* be -absorbed inside an endpoint (and PR #170 absorbed one), but the -cross-decoration obligation cannot. - -The downstream test is not a proof of the upstream theorem — it is -empirical evidence that the discipline detects ill-shaped attempts at -the point the abstraction predicts. See echo-types#125 for the -issue thread that surfaced this observation. diff --git a/docs/echo-types/examples.adoc b/docs/echo-types/examples.adoc new file mode 100644 index 0000000..b297c9f --- /dev/null +++ b/docs/echo-types/examples.adoc @@ -0,0 +1,259 @@ +== Echo Types — Canonical Examples + +*Status:* working example library. Entries marked _Agda-backed_ have a +corresponding compiled theorem in this repo. Entries marked _informal_ +are described at the theory level only; they may be formalisable later +but are not proved here. + +Template used for every entry: + +* *Source map* — the `+f : A → B+` under discussion. +* *What is lost* — information that `+y ∈ B+` alone does not determine. +* *What remains* — structured residue of `+f+` given `+y+`. +* *Echo* — the concrete shape of `+Echo f y+` for this case. +* *Extensional / intensional* — where the distinguishing content sits. +* *Reference* — Agda module if applicable. + +''''' + +=== 1. Sign loss under squaring + +* *Source map.* `+square : ℤ → ℕ+`, `+square n = n * n+`. +* *What is lost.* The sign of `+n+` — `+square(+3) = square(-3) = 9+`. +* *What remains.* The magnitude, witnessed together with a specific +signed preimage. +* *Echo.* `+Echo square 9 = Σ ℤ (λ n → square n ≡ 9)+` is inhabited by +both `+(+3 , refl)+` and `+(-3 , refl)+`; these are distinct inhabitants +of the echo even though they collapse to the same `+9+`. +* *Extensional / intensional.* Intensional — the shadow is +`+{0, 1, 4, 9, 16, …}+`; the intensional core distinguishes signed +preimages. +* *Reference.* `+proofs/agda/EchoExamples.square9+`. + +''''' + +=== 2. Boolean component forgetting + +* *Source map.* `+fst : Bool × Bool → Bool+`, `+fst (a, b) = a+`. +* *What is lost.* The second component `+b+`. +* *What remains.* A concrete pair whose first component is the observed +boolean. +* *Echo.* `+Echo fst a = Σ (Bool × Bool) (λ p → fst p ≡ a)+`, with +exactly two distinct inhabitants for each `+a : Bool+` (corresponding to +the two choices of `+b+`). +* *Extensional / intensional.* Both. Shadow is `+Bool+` in full; the +intensional core distinguishes `+(true, true)+` from `+(true, false)+`. +* *Reference.* `+proofs/agda/EchoCharacteristic.visible+`; +`+no-section-visible+` shows the loss is genuine. + +''''' + +=== 3. Quotient by equivalence + +* *Source map.* `+[_] : A → A/∼+`, the quotient map modulo an +equivalence relation `+∼+`. +* *What is lost.* Which specific representative of an equivalence class +was taken. +* *What remains.* A specific representative, together with proof it lies +in the given class. +* *Echo.* `+Echo [_] c = Σ A (λ x → [x] ≡ c)+` — inhabited by every +representative, up to the quotient’s induced proof structure. +* *Extensional / intensional.* Intensional is load-bearing: the shadow +is the entire quotient, but the echo records the specific +representative. +* *Reference.* `+proofs/agda/EchoExamples.quot+`; +`+collapse-residue-identifies+` shows residue-level identification. + +''''' + +=== 4. Cantor normal form as a canonical echo + +* *Source map.* `+normalize : OrdinalBelowε₀ → CNF+`, mapping an +arbitrary expression tree of ordinals below ε₀ to its unique Cantor +normal form. +* *What is lost.* The specific expression tree (associativity, redundant +zero-summands, non-descending summand orders). +* *What remains.* A canonical representative whose shape strictly +determines the ordinal value. +* *Echo.* +`+Echo normalize cnf = Σ (tree : OrdinalBelowε₀) (normalize tree ≡ cnf)+`. +* *Extensional / intensional.* Both. The shadow is "`the canonical form +exists`"; the intensional core records _which tree_ produced it, giving +provenance across normalisation. +* *Reference.* `+proofs/agda/Ordinal/CNF.agda+`; trichotomy +(`+cnf-trichotomy+`, `+<ᶜ-trans+`, `+<ᶜ-irrefl+`) gives the order +structure that makes this a well-behaved canonicalisation. + +''''' + +=== 5. Database GROUP BY + +* *Source map.* `+group_by_key : List Row → Map Key Row-Summary+`. Each +row contributes to a group keyed by some attribute; the summary (count, +sum, max, …) aggregates the group. +* *What is lost.* Individual row identities within each group. +* *What remains.* Enough aggregate information to answer the summary +query, plus (in a residue layer) references to the rows that +contributed. +* *Echo.* For a given key `+k+` and summary `+s+`, the echo is the set +of input row lists that would produce `+s+` under the aggregation. In an +actual database with provenance annotations (K-provenance, +`+Bag+`-semiring), the echo specialises to the semiring element. +* *Extensional / intensional.* Both. Shadow = set of (key, summary) +pairs. Intensional = which rows contributed, with semiring-level +provenance. +* *Informal.* Not yet formalised in Agda. The adjacency note +`+docs/adjacency/provenance-semirings.adoc+` is the neighbour. + +''''' + +=== 6. Lossy numerical truncation + +* *Source map.* `+truncate : ℝ → ℤ+`, `+truncate x = ⌊x⌋+`. +* *What is lost.* The fractional part `+x − ⌊x⌋ ∈ [0, 1)+`. +* *What remains.* The integer value, plus — in an ε-echo refinement — a +bound on how far from the truncation value the original `+x+` could have +been. +* *Echo.* Exact: `+Echo truncate n = Σ ℝ (λ x → ⌊x⌋ ≡ n)+`. Approximate: +`+EchoR (ε = ½) ⌊·⌋ n ≈ Σ ℝ (λ x → |⌊x⌋ − n| ≤ ½)+`. +* *Extensional / intensional.* Both. The approximate version brings in +the "`Exact vs approximate`" axis (see taxonomy). +* *Informal.* Approximate-echo formalisation is open (see +`+taxonomy.md+`, axis 2). + +''''' + +=== 7. Ordinal collapse + +* *Source map.* `+collapse : BT → OmegaIndex+`, collapsing a Buchholz +term to its leading Ω-marker, as in `+EchoOrdinal.ordinal-collapse+`. +* *What is lost.* The full inner structure of the term (subterms, +plus-decomposition, nested ψ-applications). +* *What remains.* The Ω-index marker — enough to place the term in a +rough cardinal tier but nowhere near enough to reconstruct it. +* *Echo.* `+Echo collapse ν = Σ BT (λ t → collapse t ≡ ν)+`. Many +distinct BT terms collapse to the same ν. +* *Extensional / intensional.* Intensional is crucial: +`+ordinal-collapse-non-injective+` and +`+ordinal-echo-left≢ordinal-echo-right+` distinguish two terms that +share a collapse target. +* *Reference.* `+proofs/agda/EchoOrdinal.agda+`. + +''''' + +=== 8. Cryptographic hash (mathematical preimage) + +* *Source map.* `+H : {0,1}* → {0,1}ⁿ+`, a cryptographic hash. +* *What is lost.* Essentially everything — in the security model, +preimages should be computationally inaccessible from the hash. +* *What remains.* Mathematically (not computationally), the full set of +strings that hash to the observed output. +* *Echo.* `+Echo H y = Σ {0,1}* (λ s → H s ≡ y)+` — a mathematically +enormous but enumerable (in principle) set. +* *Extensional / intensional.* Intensional at the set-theoretic level +(every preimage exists), but the security claim is about _computational_ +access to the echo, not its existence. +* *Informal.* Not in repo. This is the example that forced the promotion +of the information-theoretic/computational access axis — see +`+taxonomy.md+` axis 8. Candidate refinements of `+Echo+` that would +capture the security claim (cost-indexed echo, graded access modality, +decidability-respecting echo, witness-search abstract machine) are +listed there. + +''''' + +=== 9. Parser error recovery + +* *Source map.* `+parse : List Token → Maybe SyntaxTree+`. On malformed +input the parser returns a best-effort tree with error markers. +* *What is lost.* Which specific token stream produced the (possibly +error-bearing) tree; the erased parts of malformed input. +* *What remains.* The tree, plus error markers recording where the +parser made recovery choices — this is an _explicit_ residue in the +return type, not merely implicit. +* *Echo.* `+Echo parse tree = Σ (List Token) (λ ts → parse ts ≡ tree)+`, +but a more faithful version carries the recovery trace as part of the +tree itself, making the echo split into a "`canonical-tree`" part and an +"`error-annotation`" part. +* *Extensional / intensional.* Both. Shadow = set of reachable trees. +Intensional = which token stream + what recovery choices. +* *Informal.* Not formalised. This is the example that forces the +*presentation-dependent* axis (taxonomy, axis 4): the same tree can be +reached from different token streams, and the echo distinguishes them. + +''''' + +=== 10. Abstract interpretation (widening) + +* *Source map.* `+α : Values → AbstractValues+`, a Galois-connection +abstraction (e.g. `+Int → Sign = {⊥, neg, zero, pos, ⊤}+`). +* *What is lost.* The precise value — `+α(5) = α(7) = pos+`. +* *What remains.* The abstract class, plus (in any reasonable analyser) +enough trace information to refine the abstraction in a re-analysis. +* *Echo.* `+Echo α a = Σ Values (λ v → α v ≡ a)+` is the concrete class +over the abstract element `+a+`. Dually, the analyser’s _widening_ step +introduces _approximate_ echoes whose tolerance grows with analysis +depth — tying example 6 and example 10 together through axis 2 (exact vs +approximate). +* *Extensional / intensional.* Both. The shadow is the abstract lattice; +the intensional core is the concrete class structure. +* *Informal.* Not formalised; adjacent to +`+docs/adjacency/refinement-types.adoc+`. + +''''' + +=== 11. Region exit in a linear type system (ephapax L3) + +* *Source map.* `+collapse_r : LiveAt r → ExitedAt r+`, the operational +`+S_Region_Exit+` rule of the ephapax calculus: a region scope +`+ERegion r e+` reducing on a value `+v+` produces +`+(mem_free_region μ r, remove_first r R, v)+`. The map sends a +configuration with `+r ∈ R+` to one with `+r ∉ R+`, freeing the region’s +memory. +* *What is lost.* Which linear values (of types `+TString r+`, +`+TRef Lin (TString r)+`, …) were live in `+r+` immediately before exit. +After the step, `+r+` is unrecoverable as a region name, and the typing +system cannot reconstruct which preimage configuration produced the +post-step state. +* *What remains.* A proof-relevant residue: the residue value typed at +`+TEcho+` in ephapax’s L3 layer carries a witness of _which_ value-shape +was erased. Under Linear mode the residue must be observed +(`+T_Observe+` consumes it); under Affine mode the residue may be +silently lowered to the trivial residue `+EchoR ⊤ TrivCert y+`. +* *Echo.* +`+Echo collapse_r exited = Σ (LiveAt r) (λ s → collapse_r s ≡ exited)+`. +Under Linear mode the full fiber is retained; under Affine mode the +codomain collapses to ⊤ and the inhabitants become propositionally equal +(cf. `+affine_canonical+` / `+affine_all_equal+` in ephapax +`+formal/Echo.v:291-301+`). +* *Extensional / intensional.* Intensional. The shadow +(`+{R-after-exit : list region_name}+`) lets the typing system see the +post-exit capability set, but the intensional core distinguishes _which_ +configuration produced it. +* *Reference.* `+tutorial/region_exit_audit/RegionExitAudit.agda+` (the +echo-types-side type-level audit walkthrough); ephapax `+formal/Echo.v+` +(Coq port of `+EchoLinear.agda+`); ephapax +`+no_section_collapse_to_residue+` (`+formal/Echo.v:502-517+`, `+Qed+`, +zero axioms) matches `+EchoResidue.no-section-collapse-to-residue+` +(`+proofs/agda/EchoResidue.agda:52-65+`). See echo-types#127 for the +issue thread that seeded this entry. + +''''' + +=== Cross-cutting observations + +[arabic] +. *Shadow collapse is the same across cases.* Every example’s +"`extensional shadow`" is just `+image(f)+`. The shadow provides no +structural discrimination between examples; all the discrimination lives +in the intensional core. +. *Presentation-dependent echoes cluster.* Examples 5, 9, 10 share +presentation-dependence. This suggests a sub-theory of +"`implementation-detail residue`" distinct from the canonical +fiber-based cases (examples 1–4). +. *The computational-access question is live.* Example 8 (cryptographic +hash) cannot be captured by the fiber definition alone. It motivates +adding a computational-access axis to the taxonomy. +. *Approximate echoes appear twice.* Examples 6 and 10 both involve +tolerance; both are open for formalisation. A single approximate-echo +definition that serves both is a next theory step. diff --git a/docs/echo-types/examples.md b/docs/echo-types/examples.md deleted file mode 100644 index 03f40d3..0000000 --- a/docs/echo-types/examples.md +++ /dev/null @@ -1,264 +0,0 @@ - - -# Echo Types — Canonical Examples - -**Status:** working example library. Entries marked *Agda-backed* -have a corresponding compiled theorem in this repo. Entries marked -*informal* are described at the theory level only; they may be -formalisable later but are not proved here. - -Template used for every entry: - -- **Source map** — the `f : A → B` under discussion. -- **What is lost** — information that `y ∈ B` alone does not determine. -- **What remains** — structured residue of `f` given `y`. -- **Echo** — the concrete shape of `Echo f y` for this case. -- **Extensional / intensional** — where the distinguishing content sits. -- **Reference** — Agda module if applicable. - ---- - -## 1. Sign loss under squaring - -- **Source map.** `square : ℤ → ℕ`, `square n = n * n`. -- **What is lost.** The sign of `n` — `square(+3) = square(-3) = 9`. -- **What remains.** The magnitude, witnessed together with a specific - signed preimage. -- **Echo.** `Echo square 9 = Σ ℤ (λ n → square n ≡ 9)` is inhabited - by both `(+3 , refl)` and `(-3 , refl)`; these are distinct - inhabitants of the echo even though they collapse to the same `9`. -- **Extensional / intensional.** Intensional — the shadow is - `{0, 1, 4, 9, 16, …}`; the intensional core distinguishes signed - preimages. -- **Reference.** `proofs/agda/EchoExamples.square9`. - ---- - -## 2. Boolean component forgetting - -- **Source map.** `fst : Bool × Bool → Bool`, `fst (a, b) = a`. -- **What is lost.** The second component `b`. -- **What remains.** A concrete pair whose first component is the - observed boolean. -- **Echo.** `Echo fst a = Σ (Bool × Bool) (λ p → fst p ≡ a)`, with - exactly two distinct inhabitants for each `a : Bool` - (corresponding to the two choices of `b`). -- **Extensional / intensional.** Both. Shadow is `Bool` in full; the - intensional core distinguishes `(true, true)` from `(true, false)`. -- **Reference.** `proofs/agda/EchoCharacteristic.visible`; - `no-section-visible` shows the loss is genuine. - ---- - -## 3. Quotient by equivalence - -- **Source map.** `[_] : A → A/∼`, the quotient map modulo an - equivalence relation `∼`. -- **What is lost.** Which specific representative of an equivalence - class was taken. -- **What remains.** A specific representative, together with proof - it lies in the given class. -- **Echo.** `Echo [_] c = Σ A (λ x → [x] ≡ c)` — inhabited by every - representative, up to the quotient's induced proof structure. -- **Extensional / intensional.** Intensional is load-bearing: the - shadow is the entire quotient, but the echo records the specific - representative. -- **Reference.** `proofs/agda/EchoExamples.quot`; - `collapse-residue-identifies` shows residue-level identification. - ---- - -## 4. Cantor normal form as a canonical echo - -- **Source map.** `normalize : OrdinalBelowε₀ → CNF`, mapping an - arbitrary expression tree of ordinals below ε₀ to its unique - Cantor normal form. -- **What is lost.** The specific expression tree (associativity, - redundant zero-summands, non-descending summand orders). -- **What remains.** A canonical representative whose shape strictly - determines the ordinal value. -- **Echo.** `Echo normalize cnf = Σ (tree : OrdinalBelowε₀) (normalize tree ≡ cnf)`. -- **Extensional / intensional.** Both. The shadow is "the canonical - form exists"; the intensional core records *which tree* produced - it, giving provenance across normalisation. -- **Reference.** `proofs/agda/Ordinal/CNF.agda`; trichotomy - (`cnf-trichotomy`, `<ᶜ-trans`, `<ᶜ-irrefl`) gives the order - structure that makes this a well-behaved canonicalisation. - ---- - -## 5. Database GROUP BY - -- **Source map.** `group_by_key : List Row → Map Key Row-Summary`. - Each row contributes to a group keyed by some attribute; the - summary (count, sum, max, …) aggregates the group. -- **What is lost.** Individual row identities within each group. -- **What remains.** Enough aggregate information to answer the - summary query, plus (in a residue layer) references to the rows - that contributed. -- **Echo.** For a given key `k` and summary `s`, the echo is the set - of input row lists that would produce `s` under the aggregation. - In an actual database with provenance annotations (K-provenance, - `Bag`-semiring), the echo specialises to the semiring element. -- **Extensional / intensional.** Both. Shadow = set of (key, - summary) pairs. Intensional = which rows contributed, with - semiring-level provenance. -- **Informal.** Not yet formalised in Agda. The adjacency note - `docs/adjacency/provenance-semirings.adoc` is the neighbour. - ---- - -## 6. Lossy numerical truncation - -- **Source map.** `truncate : ℝ → ℤ`, `truncate x = ⌊x⌋`. -- **What is lost.** The fractional part `x − ⌊x⌋ ∈ [0, 1)`. -- **What remains.** The integer value, plus — in an ε-echo refinement - — a bound on how far from the truncation value the original `x` - could have been. -- **Echo.** Exact: `Echo truncate n = Σ ℝ (λ x → ⌊x⌋ ≡ n)`. - Approximate: `EchoR (ε = ½) ⌊·⌋ n ≈ Σ ℝ (λ x → |⌊x⌋ − n| ≤ ½)`. -- **Extensional / intensional.** Both. The approximate version - brings in the "Exact vs approximate" axis (see taxonomy). -- **Informal.** Approximate-echo formalisation is open (see - `taxonomy.md`, axis 2). - ---- - -## 7. Ordinal collapse - -- **Source map.** `collapse : BT → OmegaIndex`, collapsing a - Buchholz term to its leading Ω-marker, as in - `EchoOrdinal.ordinal-collapse`. -- **What is lost.** The full inner structure of the term (subterms, - plus-decomposition, nested ψ-applications). -- **What remains.** The Ω-index marker — enough to place the term in - a rough cardinal tier but nowhere near enough to reconstruct it. -- **Echo.** `Echo collapse ν = Σ BT (λ t → collapse t ≡ ν)`. Many - distinct BT terms collapse to the same ν. -- **Extensional / intensional.** Intensional is crucial: - `ordinal-collapse-non-injective` and - `ordinal-echo-left≢ordinal-echo-right` distinguish two terms that - share a collapse target. -- **Reference.** `proofs/agda/EchoOrdinal.agda`. - ---- - -## 8. Cryptographic hash (mathematical preimage) - -- **Source map.** `H : {0,1}* → {0,1}ⁿ`, a cryptographic hash. -- **What is lost.** Essentially everything — in the security model, - preimages should be computationally inaccessible from the hash. -- **What remains.** Mathematically (not computationally), the full - set of strings that hash to the observed output. -- **Echo.** `Echo H y = Σ {0,1}* (λ s → H s ≡ y)` — a mathematically - enormous but enumerable (in principle) set. -- **Extensional / intensional.** Intensional at the set-theoretic - level (every preimage exists), but the security claim is about - *computational* access to the echo, not its existence. -- **Informal.** Not in repo. This is the example that forced the - promotion of the information-theoretic/computational access - axis — see `taxonomy.md` axis 8. Candidate refinements of `Echo` - that would capture the security claim (cost-indexed echo, graded - access modality, decidability-respecting echo, witness-search - abstract machine) are listed there. - ---- - -## 9. Parser error recovery - -- **Source map.** `parse : List Token → Maybe SyntaxTree`. On malformed - input the parser returns a best-effort tree with error markers. -- **What is lost.** Which specific token stream produced the (possibly - error-bearing) tree; the erased parts of malformed input. -- **What remains.** The tree, plus error markers recording where the - parser made recovery choices — this is an *explicit* residue in - the return type, not merely implicit. -- **Echo.** `Echo parse tree = Σ (List Token) (λ ts → parse ts ≡ tree)`, - but a more faithful version carries the recovery trace as part of - the tree itself, making the echo split into a - "canonical-tree" part and an "error-annotation" part. -- **Extensional / intensional.** Both. Shadow = set of reachable - trees. Intensional = which token stream + what recovery choices. -- **Informal.** Not formalised. This is the example that forces the - **presentation-dependent** axis (taxonomy, axis 4): the same tree - can be reached from different token streams, and the echo - distinguishes them. - ---- - -## 10. Abstract interpretation (widening) - -- **Source map.** `α : Values → AbstractValues`, a Galois-connection - abstraction (e.g. `Int → Sign = {⊥, neg, zero, pos, ⊤}`). -- **What is lost.** The precise value — `α(5) = α(7) = pos`. -- **What remains.** The abstract class, plus (in any reasonable - analyser) enough trace information to refine the abstraction in a - re-analysis. -- **Echo.** `Echo α a = Σ Values (λ v → α v ≡ a)` is the concrete - class over the abstract element `a`. Dually, the analyser's - *widening* step introduces *approximate* echoes whose tolerance - grows with analysis depth — tying example 6 and example 10 - together through axis 2 (exact vs approximate). -- **Extensional / intensional.** Both. The shadow is the abstract - lattice; the intensional core is the concrete class structure. -- **Informal.** Not formalised; adjacent to `docs/adjacency/refinement-types.adoc`. - ---- - -## 11. Region exit in a linear type system (ephapax L3) - -- **Source map.** `collapse_r : LiveAt r → ExitedAt r`, the - operational `S_Region_Exit` rule of the ephapax calculus: a region - scope `ERegion r e` reducing on a value `v` produces - `(mem_free_region μ r, remove_first r R, v)`. The map sends a - configuration with `r ∈ R` to one with `r ∉ R`, freeing the - region's memory. -- **What is lost.** Which linear values (of types `TString r`, - `TRef Lin (TString r)`, …) were live in `r` immediately before - exit. After the step, `r` is unrecoverable as a region name, - and the typing system cannot reconstruct which preimage - configuration produced the post-step state. -- **What remains.** A proof-relevant residue: the residue value typed - at `TEcho` in ephapax's L3 layer carries a witness of *which* - value-shape was erased. Under Linear mode the residue must be - observed (`T_Observe` consumes it); under Affine mode the residue - may be silently lowered to the trivial residue - `EchoR ⊤ TrivCert y`. -- **Echo.** `Echo collapse_r exited = Σ (LiveAt r) (λ s → collapse_r s ≡ exited)`. - Under Linear mode the full fiber is retained; under Affine mode the - codomain collapses to ⊤ and the inhabitants become propositionally - equal (cf. `affine_canonical` / `affine_all_equal` in ephapax - `formal/Echo.v:291-301`). -- **Extensional / intensional.** Intensional. The shadow - (`{R-after-exit : list region_name}`) lets the typing system - see the post-exit capability set, but the intensional core - distinguishes *which* configuration produced it. -- **Reference.** `tutorial/region_exit_audit/RegionExitAudit.agda` - (the echo-types-side type-level audit walkthrough); ephapax - `formal/Echo.v` (Coq port of `EchoLinear.agda`); ephapax - `no_section_collapse_to_residue` (`formal/Echo.v:502-517`, - `Qed`, zero axioms) matches - `EchoResidue.no-section-collapse-to-residue` - (`proofs/agda/EchoResidue.agda:52-65`). See echo-types#127 for - the issue thread that seeded this entry. - ---- - -## Cross-cutting observations - -1. **Shadow collapse is the same across cases.** Every example's - "extensional shadow" is just `image(f)`. The shadow provides no - structural discrimination between examples; all the discrimination - lives in the intensional core. -2. **Presentation-dependent echoes cluster.** Examples 5, 9, 10 - share presentation-dependence. This suggests a sub-theory of - "implementation-detail residue" distinct from the canonical - fiber-based cases (examples 1–4). -3. **The computational-access question is live.** Example 8 - (cryptographic hash) cannot be captured by the fiber definition - alone. It motivates adding a computational-access axis to the - taxonomy. -4. **Approximate echoes appear twice.** Examples 6 and 10 both - involve tolerance; both are open for formalisation. A single - approximate-echo definition that serves both is a next theory - step. diff --git a/docs/echo-types/overview.adoc b/docs/echo-types/overview.adoc new file mode 100644 index 0000000..7d0d50e --- /dev/null +++ b/docs/echo-types/overview.adoc @@ -0,0 +1,222 @@ +== Echo Types — Overview + +*Status:* working note. Paths marked _definition_ are stable within this +document; paths marked _conjecture_ are speculative and will stay +speculative until formal evidence is produced. + +''''' + +=== Working definition + +_Definition (informal)._ Echo Types is a theory of the structured +remainder left by information-losing computation. For a map +`+f : A → B+`, the _echo of `+f+` at `+y : B+`_ is whatever evidence, +structure, or witness survives the act of applying `+f+` and looking at +the result `+y+` — but survives in a form that is explicit, +compositional, and (ideally) formally tractable. + +_Definition (current Agda)._ The spine of the current formalization is +the fiber-shaped type + +.... +Echo : ∀ {a b} {A : Set a} {B : Set b} (f : A → B) → B → Set (a ⊔ b) +Echo {A = A} f y = Σ A (λ x → f x ≡ y) +.... + +introduced in `+proofs/agda/Echo.agda+`. An inhabitant of `+Echo f y+` +is a pair `+(x , p)+` where `+x : A+` and `+p : f x ≡ y+`. The echo is +thus a proof-relevant witness that `+y+` was produced by applying `+f+` +to some specific `+x+`, with `+p+` recording exactly which one. + +=== Core intuition + +When a map forgets, merges, erases, compresses, or abstracts +information, the output does not by itself determine its source. But it +may still determine a _typed remainder_: + +* *admissible antecedents* — the set of `+x+` with `+f x = y+`, +* *retained constraints* — properties of `+x+` that must hold for any +antecedent, +* *provenance* — a witnessed history of how `+y+` was produced, +* *reconstruction bounds* — information about `+x+` that can be +recovered up to some equivalence, +* *proof-relevant witness structure* — the specific derivation +`+(x , p)+` rather than the mere fact that some `+x+` exists. + +Echo Types names the remainder side explicitly. In the current +formalization this is the dependent sum above; later stages may add +residue quotients, graded annotations, relational witnesses, +ordinal-indexed closure, etc. + +=== Semantic fibre, avec fibre, sans fibre + +The current kernel is literally a preimage fibre, but the intended +use-case is semantic: a value has crossed some declared observation or +degradation map and the question is what typed-origin structure still +lies over the observed artefact. + +* *Semantic fibre* names that possible-origin structure: the set, +approximation, or witness family of typed origins compatible with the +observation. In the exact Agda spine it is `+Echo f y+`; in approximate +or executable settings it may be a finite preimage set, bound, search +witness, or residue-backed approximation. +* *Avec fibre* means the target-side artefact is accompanied by enough +semantic fibre to justify the inference being made. For example, knowing +an output is `+true+` under a declared projection may license "`the +source was one of these witnesses`" but not "`the source was this unique +witness`". +* *Sans fibre* means the artefact is only valid on the target side. It +may be well-typed as a `+B+`, parse as a JSON object, validate at an ABI +boundary, or satisfy a checksum format, while still carrying no declared +possible-origin structure from the source side. + +This is deliberately weaker than a universal boundary-system claim. Echo +Types do not replace exact typing, typed-wasm, ABI proofs, FFI +discipline, or structural-fit systems. They become relevant after a +crossing, compression, observation, corruption, archive step, or +translation has already made exact preservation unavailable and a +non-trivial "`what could this still have come from?`" question remains. + +The vocabulary also separates neighbouring notions: + +[width="100%",cols="34%,33%,33%",options="header",] +|=== +|Term |What it answers |Why it is not enough alone +|Provenance |Where did it come from? |Often records one history or +source, not the full compatible-origin type. + +|Trace / lineage |How did it get here? |Records a path, not necessarily +the fibre over the final observation. + +|Residue |What lower-level evidence remains after degradation? |A +residue may be weaker than the full possible-origin structure. + +|Semantic fibre |What possible typed origins still lie over this +observation? |Needs a declared map and honest scope. + +|Warrant |What may we infer or do from this fibre/residue? |Useful +internally, but not the headline mathematical object. +|=== + +Use *semantic fibre* or *preimage fibre* when clarity matters: "`fibre`" +aligns with the mathematical homotopy/preimage fibre, but can otherwise +be confused with lightweight-thread fibers or network fibre. + +The doc-side prototype +`+docs/echo-types/prototypes/warrant_debugger_prototype.jsx+` +illustrates the warrant/debugging reading of this vocabulary. It is not +a formal artefact: it shows how an interface might disclose an empty +fibre and the epistemic cost of weakening, widening, or softening the +obligations used to restore support. + +=== The loss / residue pairing + +Every information-losing map `+f : A → B+` admits two dual framings: + +[width="100%",cols="50%,50%",options="header",] +|=== +|Framing |What it tracks +|*Loss side* |What information `+y+` alone fails to recover about `+x+`. + +|*Residue side* |What information the typed remainder `+Echo f y+` +_does_ record. +|=== + +Classical framings of information loss (Shannon entropy, Landauer +erasure, fiber cardinality, quotient by equivalence, abstraction in +program analysis) describe the loss side quantitatively. Echo Types is +the project of naming and reasoning about the residue side +_structurally_. The two sides are dual: loss tells you how much is gone; +residue tells you what shape the "`not gone`" has. + +Crucially, two maps with the same _loss-side_ characterisation can have +very different _residue-side_ structure. Shannon-entropy-equal maps can +admit different echo types. + +=== Project goals + +[arabic] +. *Explicit.* Make the residue type a first-class named entity for every +context in which information loss appears. +. *Compositional.* Behave well under function composition, parallel +product, slicing, and change of universe. +. *Axis-aware.* Distinguish kinds of echoes along the axes in +`+taxonomy.md+` rather than presenting "`the`" echo construction. +. *Formally tractable.* The theory is implementable in +`+--safe --without-K+` Agda without postulates, at least for the +extensional/intensional core and a growing list of canonical examples. +. *Portable.* Usable outside Agda as a conceptual vocabulary for +database provenance, compiler analyses, verified abstraction, and ML +interpretability, even where no proof assistant is involved. + +=== What Echo Types is _not_ claiming + +* *Not a new type-former* in its own right, in the bare definition. +`+Echo f y+` as defined above is literally a fiber. The claim is +editorial: that studying fibers systematically _as residues of +information loss_, in an intensional setting with proof-relevant +witnesses, is worthwhile. See `+docs/adjacency/hott-fibers.adoc+` for +the honest adjacency assessment. _Update 2026-05-27:_ the 2026-05-27 +Tier-1+2+3 spine adds NAMED STRUCTURAL ARTEFACTS on top of the bare +fibre — the orthogonal factorisation system witness +(`+EchoOrthogonalFactorizationSystem.ofs-witness+`), the proof-relevant +image (`+EchoImageFactorization.Image+`), the classification grid +(`+EchoLossTaxonomy+` / `+EchoResidueTaxonomy+` / +`+EchoDecorationStructure+`). The "`not a type-former`" bound still +holds at the bare definition; the editorial claim is now much more +strongly supported by the named structural layer sitting on top. +* *Not a theorem of ordinal analysis.* The ordinal-notation / Buchholz +workstream in this repo (`+docs/buchholz-plan.adoc+`) is a parallel, +syntactic development; its relationship to Echo Types via +`+EchoOrdinal.agda+` is a bridge, not a reduction. At present, the +current K-free Buchholz core (`+Ordinal.Buchholz.Order._<ᵇ_+`) has a +closed well-foundedness route, finite same-binder depth is handled by +iterated mediated wrappers, and the shared-binder lex cases (`+<ᵇ⁺-ψα+`, +`+<ᵇ⁺-+2+`) are now internalised in the extended relation +`+Ordinal.Buchholz.OrderExtended._<ᵇ⁺_+` with proven irrefl + trans; +well-foundedness for `+_<ᵇ⁺_+` is the next open step, with two design +routes documented in `+docs/echo-types/buchholz-extended-wf.md+`. +* *Not (yet) a completed categorical semantics — but* Pillar F Gate F5 +FULL PASS (2026-05-27, follow-up F-2026-05-27a) mechanises the full +(equivalence, projection) orthogonal factorisation system on Type _at +the qualified level_ (funext as explicit module parameter, never a +postulate). The unconditional pointwise content remains the funext-free +artefact; the function-level OFS clauses are true given funext. See +`+docs/echo-types/universal-property.adoc+` for the consolidated +narrative and `+docs/assessment.adoc+` for the older M5 verdict. + +=== Extensional shadow vs intensional core + +This distinction is load-bearing for the rest of the theory and is +developed in detail in `+taxonomy.md+`. Briefly: + +* The *extensional shadow* of `+Echo(f)+` is the subset of `+B+` on +which `+Echo f y+` is inhabited — equivalent to `+image(f)+`. The shadow +forgets every proof-relevant detail. +* The *intensional core* is the full proof-relevant witness family +`+{Echo f y | y : B}+`. Two maps with identical extensional shadows +(same image) can have very different intensional cores (different +preimage structures, different equality evidence). + +Echo Types lives primarily in the intensional core. The shadow exists, +is useful for sanity checks, and is the quantity that classical +information theory measures. It is _not_ what this theory is +fundamentally about. + +=== Next reading + +* `+MAP.adoc+` — the master content map (single source of truth); start +here if you need to find anything. +* `+EchoCanonicalIdentitySuite.agda+` (in `+proofs/agda/+`) — the +curated single-file entry point pulling Tier-1 / Tier-2 / Tier-3 +headlines together as the "`why Echo deserves a name`" demo. +* `+universal-property.adoc+` — pullback + F4 + F5 / OFS arc end-to-end +(the categorical-universal-property story). +* `+fibration-package.adoc+` — `+map-over+` + composition iso + +cancellation iso + pentagon coherence (the fibration-side story). +* `+taxonomy.md+` — axes along which echoes differ. +* `+examples.md+` — worked cases. +* `+composition.md+` — how `+Echo+` behaves under function composition. +* `+roadmap.adoc+` — what can advance without the current proof +blockers, and what cannot (note: `+roadmap.md+` was consolidated into +`+roadmap.adoc+` in 2026-05-26). diff --git a/docs/echo-types/overview.md b/docs/echo-types/overview.md deleted file mode 100644 index f1bab76..0000000 --- a/docs/echo-types/overview.md +++ /dev/null @@ -1,213 +0,0 @@ - - -# Echo Types — Overview - -**Status:** working note. Paths marked *definition* are stable within -this document; paths marked *conjecture* are speculative and will -stay speculative until formal evidence is produced. - ---- - -## Working definition - -*Definition (informal).* Echo Types is a theory of the structured -remainder left by information-losing computation. For a map -`f : A → B`, the *echo of `f` at `y : B`* is whatever evidence, -structure, or witness survives the act of applying `f` and looking -at the result `y` — but survives in a form that is explicit, -compositional, and (ideally) formally tractable. - -*Definition (current Agda).* The spine of the current formalization -is the fiber-shaped type - -``` -Echo : ∀ {a b} {A : Set a} {B : Set b} (f : A → B) → B → Set (a ⊔ b) -Echo {A = A} f y = Σ A (λ x → f x ≡ y) -``` - -introduced in `proofs/agda/Echo.agda`. An inhabitant of `Echo f y` is -a pair `(x , p)` where `x : A` and `p : f x ≡ y`. The echo is thus a -proof-relevant witness that `y` was produced by applying `f` to some -specific `x`, with `p` recording exactly which one. - -## Core intuition - -When a map forgets, merges, erases, compresses, or abstracts -information, the output does not by itself determine its source. But -it may still determine a *typed remainder*: - -- **admissible antecedents** — the set of `x` with `f x = y`, -- **retained constraints** — properties of `x` that must hold for any - antecedent, -- **provenance** — a witnessed history of how `y` was produced, -- **reconstruction bounds** — information about `x` that can be - recovered up to some equivalence, -- **proof-relevant witness structure** — the specific derivation - `(x , p)` rather than the mere fact that some `x` exists. - -Echo Types names the remainder side explicitly. In the current -formalization this is the dependent sum above; later stages may add -residue quotients, graded annotations, relational witnesses, -ordinal-indexed closure, etc. - -## Semantic fibre, avec fibre, sans fibre - -The current kernel is literally a preimage fibre, but the intended -use-case is semantic: a value has crossed some declared observation or -degradation map and the question is what typed-origin structure still -lies over the observed artefact. - -- **Semantic fibre** names that possible-origin structure: the set, - approximation, or witness family of typed origins compatible with the - observation. In the exact Agda spine it is `Echo f y`; in approximate - or executable settings it may be a finite preimage set, bound, search - witness, or residue-backed approximation. -- **Avec fibre** means the target-side artefact is accompanied by - enough semantic fibre to justify the inference being made. For - example, knowing an output is `true` under a declared projection may - license "the source was one of these witnesses" but not "the source - was this unique witness". -- **Sans fibre** means the artefact is only valid on the target side. - It may be well-typed as a `B`, parse as a JSON object, validate at an - ABI boundary, or satisfy a checksum format, while still carrying no - declared possible-origin structure from the source side. - -This is deliberately weaker than a universal boundary-system claim. -Echo Types do not replace exact typing, typed-wasm, ABI proofs, FFI -discipline, or structural-fit systems. They become relevant after a -crossing, compression, observation, corruption, archive step, or -translation has already made exact preservation unavailable and a -non-trivial "what could this still have come from?" question remains. - -The vocabulary also separates neighbouring notions: - -| Term | What it answers | Why it is not enough alone | -|---|---|---| -| Provenance | Where did it come from? | Often records one history or source, not the full compatible-origin type. | -| Trace / lineage | How did it get here? | Records a path, not necessarily the fibre over the final observation. | -| Residue | What lower-level evidence remains after degradation? | A residue may be weaker than the full possible-origin structure. | -| Semantic fibre | What possible typed origins still lie over this observation? | Needs a declared map and honest scope. | -| Warrant | What may we infer or do from this fibre/residue? | Useful internally, but not the headline mathematical object. | - -Use **semantic fibre** or **preimage fibre** when clarity matters: -"fibre" aligns with the mathematical homotopy/preimage fibre, but can -otherwise be confused with lightweight-thread fibers or network fibre. - -The doc-side prototype -`docs/echo-types/prototypes/warrant_debugger_prototype.jsx` illustrates -the warrant/debugging reading of this vocabulary. It is not a formal -artefact: it shows how an interface might disclose an empty fibre and -the epistemic cost of weakening, widening, or softening the obligations -used to restore support. - -## The loss / residue pairing - -Every information-losing map `f : A → B` admits two dual framings: - -| Framing | What it tracks | -|---|---| -| **Loss side** | What information `y` alone fails to recover about `x`. | -| **Residue side** | What information the typed remainder `Echo f y` *does* record. | - -Classical framings of information loss (Shannon entropy, Landauer -erasure, fiber cardinality, quotient by equivalence, abstraction in -program analysis) describe the loss side quantitatively. Echo Types -is the project of naming and reasoning about the residue side -*structurally*. The two sides are dual: loss tells you how much is -gone; residue tells you what shape the "not gone" has. - -Crucially, two maps with the same *loss-side* characterisation can -have very different *residue-side* structure. Shannon-entropy-equal -maps can admit different echo types. - -## Project goals - -1. **Explicit.** Make the residue type a first-class named entity for - every context in which information loss appears. -2. **Compositional.** Behave well under function composition, - parallel product, slicing, and change of universe. -3. **Axis-aware.** Distinguish kinds of echoes along the axes in - `taxonomy.md` rather than presenting "the" echo construction. -4. **Formally tractable.** The theory is implementable in - `--safe --without-K` Agda without postulates, at least for the - extensional/intensional core and a growing list of canonical - examples. -5. **Portable.** Usable outside Agda as a conceptual vocabulary for - database provenance, compiler analyses, verified abstraction, and - ML interpretability, even where no proof assistant is involved. - -## What Echo Types is *not* claiming - -- **Not a new type-former** in its own right, in the bare definition. - `Echo f y` as defined above is literally a fiber. The claim is - editorial: that studying fibers systematically *as residues of - information loss*, in an intensional setting with proof-relevant - witnesses, is worthwhile. See `docs/adjacency/hott-fibers.adoc` - for the honest adjacency assessment. *Update 2026-05-27:* the - 2026-05-27 Tier-1+2+3 spine adds NAMED STRUCTURAL ARTEFACTS on - top of the bare fibre — the orthogonal factorisation system - witness (`EchoOrthogonalFactorizationSystem.ofs-witness`), the - proof-relevant image (`EchoImageFactorization.Image`), the - classification grid (`EchoLossTaxonomy` / `EchoResidueTaxonomy` - / `EchoDecorationStructure`). The "not a type-former" bound - still holds at the bare definition; the editorial claim is now - much more strongly supported by the named structural layer - sitting on top. -- **Not a theorem of ordinal analysis.** The ordinal-notation / - Buchholz workstream in this repo (`docs/buchholz-plan.adoc`) is a - parallel, syntactic development; its relationship to Echo Types - via `EchoOrdinal.agda` is a bridge, not a reduction. At present, - the current K-free Buchholz core (`Ordinal.Buchholz.Order._<ᵇ_`) - has a closed well-foundedness route, finite same-binder depth is - handled by iterated mediated wrappers, and the shared-binder lex - cases (`<ᵇ⁺-ψα`, `<ᵇ⁺-+2`) are now internalised in the extended - relation `Ordinal.Buchholz.OrderExtended._<ᵇ⁺_` with proven - irrefl + trans; well-foundedness for `_<ᵇ⁺_` is the next open - step, with two design routes documented in - `docs/echo-types/buchholz-extended-wf.md`. -- **Not (yet) a completed categorical semantics — but** Pillar F - Gate F5 FULL PASS (2026-05-27, follow-up F-2026-05-27a) - mechanises the full (equivalence, projection) orthogonal - factorisation system on Type *at the qualified level* (funext - as explicit module parameter, never a postulate). The - unconditional pointwise content remains the funext-free - artefact; the function-level OFS clauses are true given funext. - See `docs/echo-types/universal-property.adoc` for the - consolidated narrative and `docs/assessment.adoc` for the older - M5 verdict. - -## Extensional shadow vs intensional core - -This distinction is load-bearing for the rest of the theory and is -developed in detail in `taxonomy.md`. Briefly: - -- The **extensional shadow** of `Echo(f)` is the subset of `B` on - which `Echo f y` is inhabited — equivalent to `image(f)`. The - shadow forgets every proof-relevant detail. -- The **intensional core** is the full proof-relevant witness family - `{Echo f y | y : B}`. Two maps with identical extensional shadows - (same image) can have very different intensional cores (different - preimage structures, different equality evidence). - -Echo Types lives primarily in the intensional core. The shadow -exists, is useful for sanity checks, and is the quantity that -classical information theory measures. It is *not* what this theory -is fundamentally about. - -## Next reading - -- `MAP.adoc` — the master content map (single source of truth); - start here if you need to find anything. -- `EchoCanonicalIdentitySuite.agda` (in `proofs/agda/`) — the - curated single-file entry point pulling Tier-1 / Tier-2 / Tier-3 - headlines together as the "why Echo deserves a name" demo. -- `universal-property.adoc` — pullback + F4 + F5 / OFS arc - end-to-end (the categorical-universal-property story). -- `fibration-package.adoc` — `map-over` + composition iso + - cancellation iso + pentagon coherence (the fibration-side story). -- `taxonomy.md` — axes along which echoes differ. -- `examples.md` — worked cases. -- `composition.md` — how `Echo` behaves under function composition. -- `roadmap.adoc` — what can advance without the current proof - blockers, and what cannot (note: `roadmap.md` was consolidated - into `roadmap.adoc` in 2026-05-26). diff --git a/docs/echo-types/taxonomy.adoc b/docs/echo-types/taxonomy.adoc new file mode 100644 index 0000000..5b1bfe5 --- /dev/null +++ b/docs/echo-types/taxonomy.adoc @@ -0,0 +1,454 @@ +== Echo Types — Taxonomy + +*Status:* working taxonomy. Axes below are working distinctions, not +committed definitions. Each axis carries at least one distinguishing +example that forces the distinction to be real. + +____ +*Forward-link (2026-05-27).* The audit’s "`kinds-of-loss × +shapes-of-residue`" two-axis grid is now mechanised in +`+proofs/agda/EchoLossTaxonomy.agda+` (function-side: four-axis +EQUIV/INJ/SURJ/CONST) and `+proofs/agda/EchoResidueTaxonomy.agda+` +(residue-side: `+record ResidueForm+` + six instances). The decoration +recipe is mechanised in `+proofs/agda/EchoDecorationStructure.agda+` +(`+record DecorationStructure+` + four instances + abstract +degrade-compose). Together with `+EchoObservationalEquivalence+` +(mode-indexed `+_≡m_+`), these four modules close the +classification-grid as Agda artefacts rather than comments. Citers +should reference the modules; this taxonomy doc remains as the +longer-form narrative around the axes. +____ + +''''' + +=== Cross-axis vocabulary — semantic fibre status + +The axes below classify shapes of echo. A separate, cross-axis +distinction is whether a target-side artefact is being used *avec fibre* +or *sans fibre*. + +* *Semantic fibre* is the possible-origin structure over an observed +artefact under a declared map. In the exact kernel this is `+Echo f y+`; +in finite-domain tools it may be the computed preimage set; in +approximate or residue settings it may be a bound, witness, or lower +carrier with an honest lowering map. +* *Avec fibre*: the artefact carries, or is accompanied by, enough +semantic fibre for the advertised inference. The inference must be +stated at the same strength as the fibre: non-empty, finite, singleton, +approximate, computationally searchable, proof-relevant, residue-only, +etc. +* *Sans fibre*: the artefact is only known as a valid target-side value. +No source-side origin constraint follows merely from its validity unless +a map and fibre evidence are supplied. + +This status is not a new top-level project name and not a replacement +for the axes. It is a usage discipline: a local exact echo, a global +family, an approximate echo, and a residue-lowered echo can each be used +avec fibre or misused sans fibre. + +Related terms split as follows. Provenance identifies origin or source +history; trace/lineage records the route; residue records evidence left +after a degradation; semantic fibre records the compatible-origin +structure over the observation; warrant is the inferential or +operational licence provided by that structure. Warrant is useful as an +internal design word, but the public taxonomy should keep "`echo`", +"`residue`", and "`semantic fibre`" as the primary terms. + +Prototype hook: +`+docs/echo-types/prototypes/warrant_debugger_prototype.jsx+` visualises +that usage discipline as an empty-fibre contradiction followed by +cost-disclosed repair moves. It is an explanatory interface sketch, not +a taxonomy axis and not a proof artefact. + +Terminology guardrail: where "`fibre`" could be confused with CS fibers +or network fibre, prefer *semantic fibre* or *preimage fibre*. + +''''' + +=== Axis 1 — Extensional vs intensional + +_Definition._ The *extensional shadow* of `+Echo(f)+` is the set-valued +indicator `+Shadow(f) = { y : B | Echo f y is inhabited } = image(f)+`. +The *intensional core* is the full proof-relevant family +`+{ Echo f y | y : B }+`, with each fiber inspected up to its witness +structure `+(x , p : f x ≡ y)+`. + +_Distinguishing test._ Two maps with identical extensional shadow may +have different intensional cores. + +_Example forcing the distinction._ - `+f : ℕ → ℕ+`, `+f n = 0+`. - +`+g : ℕ × ℕ → ℕ+`, `+g (m, n) = 0+`. + +Both have `+image = {0}+`, so `+Shadow(f) = Shadow(g)+`. But +`+Echo f 0 ≃ ℕ+` while `+Echo g 0 ≃ ℕ × ℕ+` — same extensional shadow, +distinct intensional core. + +_Agda anchor._ All modules in this repo that pin proof-relevant +witnesses live in the intensional layer. `+EchoCharacteristic.collapse+` +and `+EchoResidue.EchoR+` are examples of "`projecting to the shadow`" +(forgetting witness structure). + +_Stable axis for the rest of the document._ + +''''' + +=== Axis 2 — Exact vs approximate + +_Definition._ An echo is *exact* when `+Echo f y+` records the full +preimage with definitional equality at the witness. It is *approximate* +when the witness records only up to some coarser relation `+~+` on `+A+` +(e.g. approximate equality, bounded distance). + +_Distinguishing test._ Substitute `+≡+` by some relation +`+R : A → A → Set+` and ask whether the theory still names the residue +coherently. + +_Example._ - Exact: `+Echo f y = Σ A (λ x → f x ≡ y)+`. - Approximate: +`+EchoR ε f y = Σ A (λ x → dist (f x) y ≤ ε)+` for a pseudo-metric on +`+B+`. *Formalised* in `+proofs/agda/EchoApprox.agda+`, parametric over +a `+Tolerance+` monoid and a `+PseudoMetric+`. + +The approximate version appears implicitly in numerical computation, +sensor-fusion pipelines, and lossy compression. + +_Conjecture (now a theorem)._ Approximate echoes compose with an +additive error under a non-expansive outer leg: +`+ε₁-echo(f) + ε₂-echo(g) ⊑ (ε₁ + ε₂)-echo(g ∘ f)+`. Realised in +`+EchoApprox.Approx.echo-approx-compose+`. The non-expansiveness +hypothesis on the outer leg is the minimal extra assumption — without it +an amplifying second leg can blow ε₁ up arbitrarily on the way through. + +''''' + +=== Axis 3 — Local vs global + +_Definition._ A *local* echo describes the remainder at one specific +`+y : B+`. A *global* echo describes a coherent family indexed by every +`+y+`, with some compatibility between fibers. + +_Distinguishing test._ Does the theory care about how `+Echo f y₁+` and +`+Echo f y₂+` relate when `+y₁+` and `+y₂+` are in the same equivalence +class or on the same trajectory? + +_Example._ - Local: `+Echo f y+` alone, for a specific y. - Global: +`+Echo f+` as a type-level function `+B → Set+`, with induced structure +such as `+map-over : MapOver f f' → ∀ y → Echo f y → Echo f' y+`. + +_Agda anchor._ `+map-over+` and `+map-over-comp+` in `+Echo.agda+` are +the glue that promotes local echoes to a global, functorial object. + +''''' + +=== Axis 4 — Canonical vs presentation-dependent + +_Definition._ A *canonical* echo is invariant under re-presentation of +`+f+` and its codomain. A *presentation-dependent* echo encodes +information that survives only as long as the current representation +does. + +_Distinguishing test._ Apply an isomorphism on the domain or codomain +and check whether the echo type is isomorphic. + +_Example._ - Canonical: `+Echo f y+` as a dependent sum is canonical +under isomorphism of `+A+` and `+B+` up to transport. - +Presentation-dependent: parser-state echoes record the specific token +sequence that produced a parse tree; a different (but isomorphic) +tokenisation yields a different echo. + +_Open question._ Is there a systematic way to extract the canonical-part +of a presentation-dependent echo, analogous to quotienting by a symmetry +group? This could be the "`canonical-form`" operator for echoes. + +''''' + +=== Axis 5 — Compositional vs non-compositional + +_Definition._ *Compositional* echoes satisfy a clean law relating +`+Echo(g ∘ f)+` to `+Echo(f)+` and `+Echo(g)+` (see `+composition.md+`). +*Non-compositional* echoes do not — computing `+Echo(g ∘ f)+` requires +global information beyond the component echoes. + +_Distinguishing test._ Factor a map through an intermediate type and ask +whether the echo factors accordingly. + +_Example._ - Compositional (expected): fiber-based echoes, since +`+Σ A (λ x → (g ∘ f) x ≡ y) ≃ Σ B (λ b → Σ A (λ x → f x ≡ b) × g b ≡ y)+` +up to a canonical isomorphism. - Non-compositional (conjectural): +approximate echoes where the tolerance on `+g ∘ f+` is not a function of +the tolerances on `+f+` and `+g+` alone — e.g. when the two stages +amplify or cancel. + +_Open question._ Is there a class of echo types that is always +compositional, and another that provably is not? Strongest version: are +there functors `+EchoC : A → B → Set+` and `+EchoN : A → B → Set+` +exhibiting exactly the split? + +''''' + +=== Axis 6 — Static vs dynamic + +_Definition._ *Static* echoes are determined at compile time (or proof +construction) from the shape of `+f+`. *Dynamic* echoes are determined +only at runtime, from data produced during execution. + +_Distinguishing test._ Can `+Echo f y+` be computed from `+f+` and `+y+` +alone, or does it require observing a specific computation trace? + +_Example._ - Static: `+Echo f y+` for a known pure function `+f+` with +known `+y+`. - Dynamic: the residue of a concurrent scheduler, where the +same program can produce different echoes depending on interleaving. +Formalised partially in `+EchoChoreo.agda+` via role-indexed +observation. + +''''' + +=== Axis 7 — Proof-relevant vs proof-irrelevant + +_Definition._ A *proof-relevant* echo distinguishes different proofs +that `+f x = y+`, treating them as different inhabitants of the residue. +A *proof-irrelevant* echo collapses all such proofs to a single witness. + +_Distinguishing test._ In an intensional type theory, are there two +inhabitants of `+Echo f y+` that share the same `+x+` but differ in +`+p+`? + +_Example._ - Proof-relevant (current Agda default under +`+--without-K+`): different `+p : f x ≡ y+` can in principle be +distinct. In practice all current examples in this repo use `+refl+` +exclusively, so the proof-relevant-ness is latent rather than exploited. +- Proof-irrelevant: truncate `+Echo f y+` by a higher inductive type +`+∥ Echo f y ∥+`, or work in a setoid where `+p+` is modulo an +equivalence relation. + +_Open question._ Which theorems in the current Agda development actually +require proof-relevance, and which collapse identically if `+Echo+` is +propositionally truncated? A spotcheck of +`+EchoCharacteristic.echo-true≢echo-false+` suggests the distinction is +load-bearing there. + +''''' + +=== Axis 8 — Information-theoretic vs computational access + +_Definition._ An echo is *information-theoretically accessible* when +`+Echo f y+` is merely _inhabited_ as a type — i.e. a witness +`+(x , p : f x ≡ y)+` exists in the metatheory. An echo is +*computationally accessible* when a concrete procedure produces such a +witness in bounded resources given `+y+`. Information-theoretic +accessibility is a property of the type; computational accessibility is +a property of an accompanying algorithm. + +_Distinguishing test._ Does the echo’s usefulness collapse when we +restrict to witness-extraction algorithms of a fixed complexity class? + +_Example forcing the distinction._ - `+H : {0,1}* → {0,1}ⁿ+`, a +cryptographically strong hash function. `+Echo H y+` is +information-theoretically inhabited for every `+y ∈ image(H)+` +(pigeonhole — there exist preimages), but computationally inaccessible +under the standard security assumption (no polynomial-time algorithm +produces a witness). See `+examples.md+` §8. - `+square⁻¹ : ℕ → ℕ+` +under the constructive square-root algorithm. Same information content +as `+Echo square+`, but the witness is produced in `+O(log n)+` +operations. Computationally accessible. + +_Why it is a separate axis._ Axes 1–7 are properties of the echo type as +a mathematical object — they do not depend on any notion of cost, +algorithm, or resource. Axis 8 does. Two echoes can be identical on +every other axis (same extensional shadow, same intensional core, same +proof relevance, etc.) and differ only in whether a witness is reachable +by a feasible algorithm. The security of every modern cryptosystem +depends on this axis being real. + +_Agda anchor._ Two artifacts now live at this axis: - +`+EchoDecidable.agda+` formalises refinement 3 below +(decidability-respecting echo) as the first axis-8 artifact under +`+--safe --without-K+` — the _qualitative_ "`yes / no`" layer. - +`+EchoFiberCount.agda+` (companion) provides the _quantitative_ layer +for the finite-domain regime: `+FiberSize-fin f y _≟_ : ℕ+` enumerates +`+Fin n+` and asks the decidable equality at each index, returning the +actual preimage count. Headlines: `+FiberSize-fin-id-zero+` (id has +fiber 1), `+FiberSize-fin-const+` (constant collapse: fiber n), and the +bidirectional `+FiberSize-fin ≡ 0 ⟺ ¬ Echo+`. This is the count +`+EchoThermodynamics.fiber-erasure-bound+` runs on, replacing the +earlier `+FiberSize ≡ 1+` hardcode that rendered all Landauer/Bennett +claims vacuous. + +All four axis-8 refinements now have first artifacts (2026-05-20): +refinement 1 (`+EchoCost.agda+`, scalar ℕ ledger), refinement 2 +(`+EchoAccess.agda+`, two-point modal lattice), refinement 3 +(`+EchoDecidable.agda+`, decidability layer, earlier), refinement 4 +(`+EchoSearch.agda+`, bounded-enumeration extractor). The four artifacts +form a small lattice: `+BoundedSearch+` substantiates both the +`+feasible+` grade of `+EchoA+` and the cost ledger of `+EchoCost+`; +`+EchoCost+` projects conservatively to `+EchoA+` at `+infeasible+`; +`+EchoDec+` is the qualitative ceiling. Open operational upgrades: +replacing `+EchoCost+`’s ℕ field with a resource monad; refining +`+BoundedSearch+`’s unstructured bound to a step-counter over a specific +term-language. Asymptotic computational access still cannot be named at +the type level without further machinery. Adjacent stdlib pieces: - +`+Data.Nat.Logarithm.⌊log₂⌋+` (now imported by `+EchoThermodynamics+`) +and arithmetic complexity conventions admit informal-level statements +like "`this function runs in `+O(n log n)+``", but without a cost monad. +- `+EchoLinear.agda+` and `+EchoGraded.agda+` restrict what one can _do_ +with witnesses via usage modes and grades. These are proxies for +resource control, not full computational-access tracking. + +_Candidate refinements of `+Echo+` that would capture this axis._ + +[arabic] +. *Cost-indexed echo.* Pair `+Echo f y+` with a witness-extraction +bound: `+CEcho f y cost = Σ (Echo f y) (λ _ → Extractor f y cost)+`. +Requires a resource monad or a cost-passing semantics. *First artifact +landed 2026-05-20:* `+proofs/agda/EchoCost.agda+` ships the bookkeeping +shape — a record `+EchoCost f y+` pairing the witness with a `+ℕ+` cost +ledger — together with the axis-8 lattice projections +(`+echo-cost-forget+` to base `+Echo+`, `+echo-cost-to-dec+` to +refinement 3’s `+EchoDec+`), `+echo-cost-intro-zero+`, +`+echo-cost-bump+` (loose upper bound), and `+echo-cost-compose+` +(additive cost along `+g ∘ f+`). The ledger is bookkeeping, not yet +operationally substantiated; a resource-monad / cost-passing upgrade +replaces the `+ℕ+` field without changing the lattice shape. +. *Graded access modality.* `+Echo^c f y+` at grade `+c+` means +"`witness is reachable with `+≤ c+` steps`". A graded semiring on the +cost indexes gives composition. `+EchoGraded.agda+` is the natural host; +the grade would need a complexity-class interpretation (e.g. polynomial +vs super-polynomial). *First artifact landed 2026-05-20:* +`+proofs/agda/EchoAccess.agda+` ships the modal layer at a two-point +lattice `+{feasible, infeasible}+` ordered `+feasible ⊑a infeasible+`. +Headlines: `+_⊑a_+` order with `+⊑a-prop+` (propositional), `+_⊔a_+` +join with the categorical left/right/univ lemmas, `+EchoA f y φ+` +grade-indexed echo, +`+echo-access-{forget, intro, relax, from-cost, compose}+`. The grade is +a _label_; the lattice / composition structure carries the modal +content. Refinement 4 (witness-search abstract machine) would +operationally substantiate the `+feasible+` grade. +. *Decidability-respecting echo.* `+EchoDec f y = Dec (Echo f y)+` pairs +the echo with a _constructive decision procedure_. Weaker than full +cost-tracking but enough to distinguish "`feasibly decidable`" from +"`mathematically inhabited`". *Formalised* in +`+proofs/agda/EchoDecidable.agda+` as the first axis-8 artifact. + +_Refinement choice (chosen first formalisation target)._ Refinement 3 is +the right starting point under `+--safe --without-K+`. It is the only +one of the four candidates that lives entirely inside the existing type +theory: no resource monad, no graded semiring with a complexity-class +interpretation, no abstract machine. `+Dec+` is already in the standard +library, and the gap between `+Echo f y+` (inhabited) and +`+Dec (Echo f y)+` (constructively decided) is exactly the gap axis 8 +names. Formalising 3 first lets the heavier refinements (1, 2, 4) be +added later as orthogonal layers, each projecting to the +decidability-respecting echo by forgetting cost information. Realised in +`+EchoDecidable.agda+` with headline lemmas `+echo-dec-intro+`, +`+echo-dec-pull-yes+`, `+echo-dec-respect-≡+`, `+echo-dec-fin+`, +`+echo-dec-compose-with-search+`. + +[arabic, start=4] +. *Witness-search abstract machine.* Model the extractor as a term in a +bounded-step abstract machine and pair it with the echo. Heavier; more +faithful to actual cryptographic modelling. *First artifact landed +2026-05-20:* `+proofs/agda/EchoSearch.agda+` ships the lightest +substantiation — a `+BoundedSearch f y bound+` record packaging an +explicit candidate function `+Fin bound → A+` plus a hit position +witnessing that some candidate maps to the target. Headlines: +`+bounded-search-{to-echo, to-cost, to-dec, to-access-feasible, introduce-1}+`, +providing bridges to all three other axis-8 artifacts. The `+bound+` +measures search-space cardinality, not step count — a richer abstract +machine with `+Step : Term → Term+` and a step-counter would refine this +further; the present layer is what lands under `+--safe --without-K+` +without committing to a specific term-language. + +_Open question._ Is there a single refinement that subsumes all four? My +guess is no: (1) and (4) track asymptotic cost, (2) and (3) track +discrete feasibility classes. They probably live on a small lattice of +access-tracking theories. Concretely, refinement 3 (now formalised) +gives the bottom of the lattice: every other refinement projects down to +it by erasing cost data. + +_Composition conjecture._ Computational accessibility composes +*multiplicatively* along `+g ∘ f+` in the canonical case — the cost of +extracting a `+g ∘ f+` witness is bounded by the product of component +costs. This is the standard complexity composition and should carry +over; would need to be stated carefully since the accumulation iso of +`+composition.md+` §1 introduces an intermediate `+b : B+` whose +extraction cost is implicit. + +_Worked example motivating the axis._ Hash chains in a blockchain. Each +block’s header is a pre-image echo over the previous block’s hash. +Information-theoretically, the entire chain’s residue structure is +determined by any final hash value. Computationally, reconstructing +earlier blocks from the final hash alone is infeasible — precisely the +property that makes the chain tamper-evident. The current Echo Types +framework cannot name this distinction as a type-level fact. + +''''' + +=== Cross-classification table + +A first cut at placing existing modules on the axes. Entries marked +`+?+` are not yet pinned down. Entries marked `+·+` are not applicable. +The access column uses `+Info+` for information-theoretic only (typical +for a theorem-prover module with no resource semantics) and is the +uniform default at this stage — no module currently models computational +access as a first-class property. + +[width="99%",cols="12%,11%,11%,11%,11%,11%,11%,11%,11%",options="header",] +|=== +|Module |Ext/Int |Exact/Approx |Local/Global |Canonical |Compositional +|Static/Dynamic |Proof-rel |Access +|`+Echo+` |Int |Exact |Global |Canon |Expected |Static |Yes |Info + +|`+EchoCharacteristic+` |Both |Exact |Local |Canon |? |Static |Yes |Info + +|`+EchoResidue+` |Int→Shadow map |Exact |Global |Canon |? |Static |Yes +|Info + +|`+EchoIndexed+` |Int |Exact |Global |Pres-dep by role |? |Static |Yes +|Info + +|`+EchoChoreo+` |Int |Exact |Local |Pres-dep |? |Dynamic |Yes |Info + +|`+EchoEpistemic+` |Int |Exact |Global |Pres-dep by agent |? |? |Yes +|Info + +|`+EchoLinear+` |Int |Exact |Global |Canon |? |Static |Yes |Info (proxy) + +|`+EchoGraded+` |Int |Exact |Global |Canon |Expected |Static |Yes |Info +(proxy) + +|`+EchoTropical+` |Int |Approx-ish |Local |Pres-dep |? |Static |Yes +|Info + +|`+EchoOrdinal+` |Int |Exact |Local |Canon |? |Static |Yes |Info +|=== + +Multiple `+?+` entries are open research: the compositional behaviour of +the choreographic, epistemic, and tropical echoes has not been +systematically checked and may turn out to differ from the clean +composition law for the base `+Echo+`. The `+Info (proxy)+` marks on +`+EchoLinear+` and `+EchoGraded+` indicate modules whose usage modes and +grade semirings _approximate_ cost-tracking at the access axis but do +not commit to an algorithmic-cost interpretation. + +''''' + +=== Open: new axes worth considering + +Axes listed here have distinguishing examples but have not been +developed far enough to promote to a numbered axis. + +* *Reversibility axis.* Does `+f+` admit a section? Partial section? No +section? The shape of `+Echo(f)+` changes sharply across these. +Evidence: `+no-section-collapse+` in `+EchoCharacteristic.agda+`. +* *Topological axis.* When `+A+` and `+B+` carry topologies, is +`+Echo(f)+` a sheaf, a cosheaf, neither? Could subsume the local/global +distinction more sharply. +* *Category-of-loss axis.* The intended morphisms between echo types may +themselves form a category with interesting properties (e.g. all +morphisms factor through a residue). Currently indirect in +`+EchoCategorical.agda+`; worth an explicit axis once developed. + +_History note._ Axis 8 (information-theoretic vs computational access) +was promoted from this list on the same commit that added it as a +numbered axis. The cryptographic-hash example in `+examples.md+` §8 was +the case that forced the promotion: no other axis could distinguish +"`preimage exists`" from "`preimage is findable`". diff --git a/docs/echo-types/taxonomy.md b/docs/echo-types/taxonomy.md deleted file mode 100644 index ed044d0..0000000 --- a/docs/echo-types/taxonomy.md +++ /dev/null @@ -1,452 +0,0 @@ - - -# Echo Types — Taxonomy - -**Status:** working taxonomy. Axes below are working distinctions, -not committed definitions. Each axis carries at least one -distinguishing example that forces the distinction to be real. - -> **Forward-link (2026-05-27).** The audit's "kinds-of-loss × -> shapes-of-residue" two-axis grid is now mechanised in -> `proofs/agda/EchoLossTaxonomy.agda` (function-side: four-axis -> EQUIV/INJ/SURJ/CONST) and `proofs/agda/EchoResidueTaxonomy.agda` -> (residue-side: `record ResidueForm` + six instances). The -> decoration recipe is mechanised in -> `proofs/agda/EchoDecorationStructure.agda` (`record -> DecorationStructure` + four instances + abstract degrade-compose). -> Together with `EchoObservationalEquivalence` (mode-indexed -> `_≡m_`), these four modules close the classification-grid as Agda -> artefacts rather than comments. Citers should reference the -> modules; this taxonomy doc remains as the longer-form narrative -> around the axes. - ---- - -## Cross-axis vocabulary — semantic fibre status - -The axes below classify shapes of echo. A separate, cross-axis -distinction is whether a target-side artefact is being used **avec -fibre** or **sans fibre**. - -- **Semantic fibre** is the possible-origin structure over an observed - artefact under a declared map. In the exact kernel this is - `Echo f y`; in finite-domain tools it may be the computed preimage - set; in approximate or residue settings it may be a bound, witness, - or lower carrier with an honest lowering map. -- **Avec fibre**: the artefact carries, or is accompanied by, enough - semantic fibre for the advertised inference. The inference must be - stated at the same strength as the fibre: non-empty, finite, - singleton, approximate, computationally searchable, proof-relevant, - residue-only, etc. -- **Sans fibre**: the artefact is only known as a valid target-side - value. No source-side origin constraint follows merely from its - validity unless a map and fibre evidence are supplied. - -This status is not a new top-level project name and not a replacement -for the axes. It is a usage discipline: a local exact echo, a global -family, an approximate echo, and a residue-lowered echo can each be -used avec fibre or misused sans fibre. - -Related terms split as follows. Provenance identifies origin or source -history; trace/lineage records the route; residue records evidence left -after a degradation; semantic fibre records the compatible-origin -structure over the observation; warrant is the inferential or -operational licence provided by that structure. Warrant is useful as an -internal design word, but the public taxonomy should keep "echo", -"residue", and "semantic fibre" as the primary terms. - -Prototype hook: -`docs/echo-types/prototypes/warrant_debugger_prototype.jsx` visualises -that usage discipline as an empty-fibre contradiction followed by -cost-disclosed repair moves. It is an explanatory interface sketch, not -a taxonomy axis and not a proof artefact. - -Terminology guardrail: where "fibre" could be confused with CS fibers -or network fibre, prefer **semantic fibre** or **preimage fibre**. - ---- - -## Axis 1 — Extensional vs intensional - -*Definition.* The **extensional shadow** of `Echo(f)` is the -set-valued indicator -`Shadow(f) = { y : B | Echo f y is inhabited } = image(f)`. -The **intensional core** is the full proof-relevant family -`{ Echo f y | y : B }`, with each fiber inspected up to its -witness structure `(x , p : f x ≡ y)`. - -*Distinguishing test.* Two maps with identical extensional shadow -may have different intensional cores. - -*Example forcing the distinction.* -- `f : ℕ → ℕ`, `f n = 0`. -- `g : ℕ × ℕ → ℕ`, `g (m, n) = 0`. - -Both have `image = {0}`, so `Shadow(f) = Shadow(g)`. But -`Echo f 0 ≃ ℕ` while `Echo g 0 ≃ ℕ × ℕ` — same extensional shadow, -distinct intensional core. - -*Agda anchor.* All modules in this repo that pin proof-relevant -witnesses live in the intensional layer. `EchoCharacteristic.collapse` -and `EchoResidue.EchoR` are examples of "projecting to the shadow" -(forgetting witness structure). - -*Stable axis for the rest of the document.* - ---- - -## Axis 2 — Exact vs approximate - -*Definition.* An echo is **exact** when `Echo f y` records the full -preimage with definitional equality at the witness. It is -**approximate** when the witness records only up to some coarser -relation `~` on `A` (e.g. approximate equality, bounded distance). - -*Distinguishing test.* Substitute `≡` by some relation `R : A → A → Set` -and ask whether the theory still names the residue coherently. - -*Example.* -- Exact: `Echo f y = Σ A (λ x → f x ≡ y)`. -- Approximate: `EchoR ε f y = Σ A (λ x → dist (f x) y ≤ ε)` for a - pseudo-metric on `B`. **Formalised** in `proofs/agda/EchoApprox.agda`, - parametric over a `Tolerance` monoid and a `PseudoMetric`. - -The approximate version appears implicitly in numerical -computation, sensor-fusion pipelines, and lossy compression. - -*Conjecture (now a theorem).* Approximate echoes compose with an -additive error under a non-expansive outer leg: -`ε₁-echo(f) + ε₂-echo(g) ⊑ (ε₁ + ε₂)-echo(g ∘ f)`. Realised in -`EchoApprox.Approx.echo-approx-compose`. The non-expansiveness -hypothesis on the outer leg is the minimal extra assumption — without -it an amplifying second leg can blow ε₁ up arbitrarily on the way -through. - ---- - -## Axis 3 — Local vs global - -*Definition.* A **local** echo describes the remainder at one -specific `y : B`. A **global** echo describes a coherent family -indexed by every `y`, with some compatibility between fibers. - -*Distinguishing test.* Does the theory care about how -`Echo f y₁` and `Echo f y₂` relate when `y₁` and `y₂` are in the -same equivalence class or on the same trajectory? - -*Example.* -- Local: `Echo f y` alone, for a specific y. -- Global: `Echo f` as a type-level function `B → Set`, with induced - structure such as `map-over : MapOver f f' → ∀ y → Echo f y → Echo f' y`. - -*Agda anchor.* `map-over` and `map-over-comp` in `Echo.agda` are -the glue that promotes local echoes to a global, functorial object. - ---- - -## Axis 4 — Canonical vs presentation-dependent - -*Definition.* A **canonical** echo is invariant under re-presentation -of `f` and its codomain. A **presentation-dependent** echo encodes -information that survives only as long as the current representation -does. - -*Distinguishing test.* Apply an isomorphism on the domain or codomain -and check whether the echo type is isomorphic. - -*Example.* -- Canonical: `Echo f y` as a dependent sum is canonical under - isomorphism of `A` and `B` up to transport. -- Presentation-dependent: parser-state echoes record the specific - token sequence that produced a parse tree; a different (but - isomorphic) tokenisation yields a different echo. - -*Open question.* Is there a systematic way to extract the -canonical-part of a presentation-dependent echo, analogous to -quotienting by a symmetry group? This could be the "canonical-form" -operator for echoes. - ---- - -## Axis 5 — Compositional vs non-compositional - -*Definition.* **Compositional** echoes satisfy a clean law relating -`Echo(g ∘ f)` to `Echo(f)` and `Echo(g)` (see `composition.md`). -**Non-compositional** echoes do not — computing `Echo(g ∘ f)` requires -global information beyond the component echoes. - -*Distinguishing test.* Factor a map through an intermediate type and -ask whether the echo factors accordingly. - -*Example.* -- Compositional (expected): fiber-based echoes, since - `Σ A (λ x → (g ∘ f) x ≡ y) ≃ Σ B (λ b → Σ A (λ x → f x ≡ b) × g b ≡ y)` - up to a canonical isomorphism. -- Non-compositional (conjectural): approximate echoes where the - tolerance on `g ∘ f` is not a function of the tolerances on `f` - and `g` alone — e.g. when the two stages amplify or cancel. - -*Open question.* Is there a class of echo types that is always -compositional, and another that provably is not? Strongest version: -are there functors `EchoC : A → B → Set` and `EchoN : A → B → Set` -exhibiting exactly the split? - ---- - -## Axis 6 — Static vs dynamic - -*Definition.* **Static** echoes are determined at compile time (or -proof construction) from the shape of `f`. **Dynamic** echoes are -determined only at runtime, from data produced during execution. - -*Distinguishing test.* Can `Echo f y` be computed from `f` and `y` -alone, or does it require observing a specific computation trace? - -*Example.* -- Static: `Echo f y` for a known pure function `f` with known `y`. -- Dynamic: the residue of a concurrent scheduler, where the same - program can produce different echoes depending on interleaving. - Formalised partially in `EchoChoreo.agda` via role-indexed - observation. - ---- - -## Axis 7 — Proof-relevant vs proof-irrelevant - -*Definition.* A **proof-relevant** echo distinguishes different -proofs that `f x = y`, treating them as different inhabitants of the -residue. A **proof-irrelevant** echo collapses all such proofs to a -single witness. - -*Distinguishing test.* In an intensional type theory, are there two -inhabitants of `Echo f y` that share the same `x` but differ in `p`? - -*Example.* -- Proof-relevant (current Agda default under `--without-K`): - different `p : f x ≡ y` can in principle be distinct. In practice - all current examples in this repo use `refl` exclusively, so the - proof-relevant-ness is latent rather than exploited. -- Proof-irrelevant: truncate `Echo f y` by a higher inductive type - `∥ Echo f y ∥`, or work in a setoid where `p` is modulo an - equivalence relation. - -*Open question.* Which theorems in the current Agda development -actually require proof-relevance, and which collapse identically if -`Echo` is propositionally truncated? A spotcheck of -`EchoCharacteristic.echo-true≢echo-false` suggests the distinction -is load-bearing there. - ---- - -## Axis 8 — Information-theoretic vs computational access - -*Definition.* An echo is **information-theoretically accessible** -when `Echo f y` is merely *inhabited* as a type — i.e. a witness -`(x , p : f x ≡ y)` exists in the metatheory. An echo is -**computationally accessible** when a concrete procedure produces -such a witness in bounded resources given `y`. Information-theoretic -accessibility is a property of the type; computational accessibility -is a property of an accompanying algorithm. - -*Distinguishing test.* Does the echo's usefulness collapse when we -restrict to witness-extraction algorithms of a fixed complexity -class? - -*Example forcing the distinction.* -- `H : {0,1}* → {0,1}ⁿ`, a cryptographically strong hash function. - `Echo H y` is information-theoretically inhabited for every `y ∈ - image(H)` (pigeonhole — there exist preimages), but computationally - inaccessible under the standard security assumption (no - polynomial-time algorithm produces a witness). See `examples.md` §8. -- `square⁻¹ : ℕ → ℕ` under the constructive square-root algorithm. - Same information content as `Echo square`, but the witness is - produced in `O(log n)` operations. Computationally accessible. - -*Why it is a separate axis.* Axes 1–7 are properties of the echo -type as a mathematical object — they do not depend on any notion of -cost, algorithm, or resource. Axis 8 does. Two echoes can be -identical on every other axis (same extensional shadow, same -intensional core, same proof relevance, etc.) and differ only in -whether a witness is reachable by a feasible algorithm. The security -of every modern cryptosystem depends on this axis being real. - -*Agda anchor.* Two artifacts now live at this axis: -- `EchoDecidable.agda` formalises refinement 3 below - (decidability-respecting echo) as the first axis-8 artifact under - `--safe --without-K` — the *qualitative* "yes / no" layer. -- `EchoFiberCount.agda` (companion) provides the *quantitative* - layer for the finite-domain regime: `FiberSize-fin f y _≟_ : ℕ` - enumerates `Fin n` and asks the decidable equality at each - index, returning the actual preimage count. Headlines: - `FiberSize-fin-id-zero` (id has fiber 1), `FiberSize-fin-const` - (constant collapse: fiber n), and the bidirectional - `FiberSize-fin ≡ 0 ⟺ ¬ Echo`. This is the count - `EchoThermodynamics.fiber-erasure-bound` runs on, replacing the - earlier `FiberSize ≡ 1` hardcode that rendered all - Landauer/Bennett claims vacuous. - -All four axis-8 refinements now have first artifacts (2026-05-20): -refinement 1 (`EchoCost.agda`, scalar ℕ ledger), refinement 2 -(`EchoAccess.agda`, two-point modal lattice), refinement 3 -(`EchoDecidable.agda`, decidability layer, earlier), refinement 4 -(`EchoSearch.agda`, bounded-enumeration extractor). The four -artifacts form a small lattice: `BoundedSearch` substantiates both -the `feasible` grade of `EchoA` and the cost ledger of `EchoCost`; -`EchoCost` projects conservatively to `EchoA` at `infeasible`; -`EchoDec` is the qualitative ceiling. Open operational upgrades: -replacing `EchoCost`'s ℕ field with a resource monad; refining -`BoundedSearch`'s unstructured bound to a step-counter over a -specific term-language. Asymptotic computational access still -cannot be named at the type level without further machinery. Adjacent stdlib pieces: -- `Data.Nat.Logarithm.⌊log₂⌋` (now imported by - `EchoThermodynamics`) and arithmetic complexity conventions admit - informal-level statements like "this function runs in `O(n log n)`", - but without a cost monad. -- `EchoLinear.agda` and `EchoGraded.agda` restrict what one can *do* - with witnesses via usage modes and grades. These are proxies for - resource control, not full computational-access tracking. - -*Candidate refinements of `Echo` that would capture this axis.* - -1. **Cost-indexed echo.** Pair `Echo f y` with a witness-extraction - bound: `CEcho f y cost = Σ (Echo f y) (λ _ → Extractor f y cost)`. - Requires a resource monad or a cost-passing semantics. **First - artifact landed 2026-05-20:** `proofs/agda/EchoCost.agda` ships - the bookkeeping shape — a record `EchoCost f y` pairing the - witness with a `ℕ` cost ledger — together with the axis-8 - lattice projections (`echo-cost-forget` to base `Echo`, - `echo-cost-to-dec` to refinement 3's `EchoDec`), - `echo-cost-intro-zero`, `echo-cost-bump` (loose upper bound), - and `echo-cost-compose` (additive cost along `g ∘ f`). The - ledger is bookkeeping, not yet operationally substantiated; - a resource-monad / cost-passing upgrade replaces the `ℕ` field - without changing the lattice shape. - -2. **Graded access modality.** `Echo^c f y` at grade `c` means - "witness is reachable with `≤ c` steps". A graded semiring on the - cost indexes gives composition. `EchoGraded.agda` is the natural - host; the grade would need a complexity-class interpretation - (e.g. polynomial vs super-polynomial). **First artifact landed - 2026-05-20:** `proofs/agda/EchoAccess.agda` ships the modal - layer at a two-point lattice `{feasible, infeasible}` ordered - `feasible ⊑a infeasible`. Headlines: `_⊑a_` order with - `⊑a-prop` (propositional), `_⊔a_` join with the categorical - left/right/univ lemmas, `EchoA f y φ` grade-indexed echo, - `echo-access-{forget, intro, relax, from-cost, compose}`. The - grade is a *label*; the lattice / composition structure carries - the modal content. Refinement 4 (witness-search abstract - machine) would operationally substantiate the `feasible` grade. - -3. **Decidability-respecting echo.** `EchoDec f y = Dec (Echo f y)` - pairs the echo with a *constructive decision procedure*. Weaker - than full cost-tracking but enough to distinguish "feasibly - decidable" from "mathematically inhabited". **Formalised** in - `proofs/agda/EchoDecidable.agda` as the first axis-8 artifact. - -*Refinement choice (chosen first formalisation target).* -Refinement 3 is the right starting point under `--safe --without-K`. -It is the only one of the four candidates that lives entirely inside -the existing type theory: no resource monad, no graded semiring with -a complexity-class interpretation, no abstract machine. `Dec` is -already in the standard library, and the gap between `Echo f y` -(inhabited) and `Dec (Echo f y)` (constructively decided) is -exactly the gap axis 8 names. Formalising 3 first lets the heavier -refinements (1, 2, 4) be added later as orthogonal layers, each -projecting to the decidability-respecting echo by forgetting cost -information. Realised in `EchoDecidable.agda` with headline lemmas -`echo-dec-intro`, `echo-dec-pull-yes`, `echo-dec-respect-≡`, -`echo-dec-fin`, `echo-dec-compose-with-search`. - -4. **Witness-search abstract machine.** Model the extractor as a - term in a bounded-step abstract machine and pair it with the - echo. Heavier; more faithful to actual cryptographic modelling. - **First artifact landed 2026-05-20:** `proofs/agda/EchoSearch.agda` - ships the lightest substantiation — a `BoundedSearch f y bound` - record packaging an explicit candidate function `Fin bound → A` - plus a hit position witnessing that some candidate maps to the - target. Headlines: `bounded-search-{to-echo, to-cost, to-dec, - to-access-feasible, introduce-1}`, providing bridges to all - three other axis-8 artifacts. The `bound` measures search-space - cardinality, not step count — a richer abstract machine with - `Step : Term → Term` and a step-counter would refine this - further; the present layer is what lands under `--safe - --without-K` without committing to a specific term-language. - -*Open question.* Is there a single refinement that subsumes all four? -My guess is no: (1) and (4) track asymptotic cost, (2) and (3) -track discrete feasibility classes. They probably live on a small -lattice of access-tracking theories. Concretely, refinement 3 (now -formalised) gives the bottom of the lattice: every other refinement -projects down to it by erasing cost data. - -*Composition conjecture.* Computational accessibility composes -**multiplicatively** along `g ∘ f` in the canonical case — the -cost of extracting a `g ∘ f` witness is bounded by the product of -component costs. This is the standard complexity composition and -should carry over; would need to be stated carefully since the -accumulation iso of `composition.md` §1 introduces an intermediate -`b : B` whose extraction cost is implicit. - -*Worked example motivating the axis.* Hash chains in a blockchain. -Each block's header is a pre-image echo over the previous block's -hash. Information-theoretically, the entire chain's residue structure -is determined by any final hash value. Computationally, reconstructing -earlier blocks from the final hash alone is infeasible — precisely -the property that makes the chain tamper-evident. The current Echo -Types framework cannot name this distinction as a type-level fact. - ---- - -## Cross-classification table - -A first cut at placing existing modules on the axes. Entries marked -`?` are not yet pinned down. Entries marked `·` are not applicable. -The access column uses `Info` for information-theoretic only (typical -for a theorem-prover module with no resource semantics) and is the -uniform default at this stage — no module currently models -computational access as a first-class property. - -| Module | Ext/Int | Exact/Approx | Local/Global | Canonical | Compositional | Static/Dynamic | Proof-rel | Access | -|---|---|---|---|---|---|---|---|---| -| `Echo` | Int | Exact | Global | Canon | Expected | Static | Yes | Info | -| `EchoCharacteristic` | Both | Exact | Local | Canon | ? | Static | Yes | Info | -| `EchoResidue` | Int→Shadow map | Exact | Global | Canon | ? | Static | Yes | Info | -| `EchoIndexed` | Int | Exact | Global | Pres-dep by role | ? | Static | Yes | Info | -| `EchoChoreo` | Int | Exact | Local | Pres-dep | ? | Dynamic | Yes | Info | -| `EchoEpistemic` | Int | Exact | Global | Pres-dep by agent | ? | ? | Yes | Info | -| `EchoLinear` | Int | Exact | Global | Canon | ? | Static | Yes | Info (proxy) | -| `EchoGraded` | Int | Exact | Global | Canon | Expected | Static | Yes | Info (proxy) | -| `EchoTropical` | Int | Approx-ish | Local | Pres-dep | ? | Static | Yes | Info | -| `EchoOrdinal` | Int | Exact | Local | Canon | ? | Static | Yes | Info | - -Multiple `?` entries are open research: the compositional behaviour -of the choreographic, epistemic, and tropical echoes has not been -systematically checked and may turn out to differ from the clean -composition law for the base `Echo`. The `Info (proxy)` marks on -`EchoLinear` and `EchoGraded` indicate modules whose usage modes and -grade semirings *approximate* cost-tracking at the access axis but -do not commit to an algorithmic-cost interpretation. - ---- - -## Open: new axes worth considering - -Axes listed here have distinguishing examples but have not been -developed far enough to promote to a numbered axis. - -- **Reversibility axis.** Does `f` admit a section? Partial section? - No section? The shape of `Echo(f)` changes sharply across these. - Evidence: `no-section-collapse` in `EchoCharacteristic.agda`. -- **Topological axis.** When `A` and `B` carry topologies, is - `Echo(f)` a sheaf, a cosheaf, neither? Could subsume the - local/global distinction more sharply. -- **Category-of-loss axis.** The intended morphisms between echo - types may themselves form a category with interesting properties - (e.g. all morphisms factor through a residue). Currently indirect - in `EchoCategorical.agda`; worth an explicit axis once developed. - -*History note.* Axis 8 (information-theoretic vs computational -access) was promoted from this list on the same commit that added -it as a numbered axis. The cryptographic-hash example in -`examples.md` §8 was the case that forced the promotion: no other -axis could distinguish "preimage exists" from "preimage is findable". diff --git a/docs/echo-types/tropical-correspondence.adoc b/docs/echo-types/tropical-correspondence.adoc new file mode 100644 index 0000000..c50112a --- /dev/null +++ b/docs/echo-types/tropical-correspondence.adoc @@ -0,0 +1,159 @@ +== Tropical Correspondence (echo-types ↔ tropical-resource-typing) + +Last updated: 2026-05-20 + +This appendix records the citation-level correspondence between +`+proofs/agda/EchoTropical.agda+` in this repo and the adjacent +`+hyperpolymath/tropical-resource-typing+` repo (Isabelle + Lean4). The +alignment is *statement-level only*: there is no FFI surface between +Agda and Isabelle/Lean, no shared definition module, and no cross-prover +extraction pipeline. Each side carries its own independent proof of the +named theorems; this document is a cross-reference that lets a reader +verify "`the same fact is established in all three systems,`" but does +not constitute a unified verification artefact. It closes the "`Adjacent +repo not recently audited`" blocker noted in +`+cross-repo-bridge-status.md+`. + +=== Source files + +* *Agda (this repo).* `+proofs/agda/EchoTropical.agda+` — the +Tropical-Echo bridge (E10): max-plus semiring on `+ℕ+` plus the +echo-retention bridge theorems. +* *Isabelle.* `+tropical-resource-typing/Tropical.thy+` — max-plus +tropical semiring over the lifted carrier `+ℕ ∪ {-∞}+`, wired into +Isabelle’s `+comm_semiring_1+` typeclass hierarchy, with idempotence +proved separately (the structure is a dioid, not a ring). +* *Lean4.* `+tropical-resource-typing/TropicalSessionTypes.lean+` — +max-plus tropical semiring on the lifted carrier `+Nat ∪ {bot}+`, used +to grade session types so that speculative parallel cost is the +bottleneck (`+max+`) rather than the sequential sum. +* *Canonical adjacent remote.* +`+hyperpolymath/tropical-resource-typing+` (active; primary language +Isabelle; the `+.thy+` files were last touched in the +`+Tropical_Semirings+` close sweep, with subsequent CI hardening commits +on top). +* *Local clone for this audit.* +`+/home/hyperpolymath/dev/repos/repos-monorepo/verification-ecosystem/tropical-resource-typing+`. + +=== Name-by-name correspondence + +[width="100%",cols="25%,25%,25%,25%",options="header",] +|=== +|Agda (`+EchoTropical.agda+`) |Isabelle (`+Tropical.thy+`) |Lean4 +(`+TropicalSessionTypes.lean+`) |Notes +|`+_⊕_+` (max-plus add on `+ℕ+`, line 23) |`+trop_add+` (function, line +41) |`+tAdd+` (function, line 96) |Same operation (max with identity +element absorbed at the left). DIVERGES (carrier): Agda’s `+_⊕_+` +operates on raw `+ℕ+` with `+zero+` acting as the additive identity by +the recursion shape; Isabelle’s `+trop_add+` and Lean’s `+tAdd+` both +operate on a _lifted_ carrier (`+tropical = Fin nat \| NegInf+` / +`+Tropical = .val Nat \| .bot+`) where the additive identity is the +bottom element `+−∞+`, not `+0+`. The `+ℕ+` quotient on the Agda side is +intentional (the bridge only needs scores in `+ℕ+`) but means Agda’s +`+_⊕_+` is the restriction of the Isabelle/Lean operation to the finite +sub-semiring; the algebraic laws below match on that restriction. + +|`+⊕-idem+` (line 30) |`+trop_add_idem [simp]+` (lemma, line 73) |— +|Match (Agda ↔ Isabelle): Agda `+⊕-idem : ∀ m → m ⊕ m ≡ m+` ↔ Isabelle +`+trop_add_idem : trop_add a a = a+`. The Isabelle file also restates +this at typeclass level as `+tropical_add_idem+` (theorem, line 266: +`+(a :: tropical) + a = a+`); the bare-function lemma is the closer +match. Lean side has NO named idempotence theorem — the file ships 13 +CommSemiring laws (commut/assoc/identity/distrib) but not +`+tAdd a a = a+`. The Lean docstring explicitly flags this gap: +`+tropical_grade_le_sequentialTotal+` is offered as the "`Lean analogue +of Isabelle `+tropical_add_idem+``" because `+max a b ≤ a + b+` is what +`+add_idem+` buys in a dioid. So the Lean cell is `+—+` for the bare law +and `+tropical_grade_le_sequentialTotal+` for the downstream consumer. + +|`+score-⊕-idem+` (line 82) |— |— |Unilateral (Agda-only). The Agda side +specialises `+⊕-idem+` to scores of the 3-candidate set; the adjacent +repo has no `+Candidate+` type and no `+score+` function, so the +specialisation has no analog. + +|`+tropical-non-injective+` (line 55) |— |— |Unilateral (Agda-only). +Headline of the echo-retention bridge: there exist distinct candidates +with the same tropical score. The adjacent repo does not type candidates +(its tropical semiring is generic), so there is nothing to be +non-injective about. + +|`+tropical-collapse-visible+` (line 121) |— |— |Unilateral (Agda-only). +`+score a ≡ score b+` for the concrete 3-candidate choice; no analog. + +|`+Echo+` / `+echo-intro+` / `+TropEcho+` / `+IsArgmin+` (lines 59–73) +|— |— |Unilateral (Agda-only). The echo type itself +(`+Echo f y := Σ A (λ x → f x ≡ y)+`) is an echo-types invention; the +adjacent repo has no fibre type and no echo bridge. + +|`+echo0-to-tropical+` (line 113) |— |— |Unilateral (Agda-only). Bridge +map echo → tropical residue; no analog (no echo on the other side). + +|`+distinct-candidates-same-visible-distinct-echo+` (line 130) |— |— +|Unilateral (Agda-only). The main bridge theorem: collapse on the +visible (tropical) side, retention on the echo side. No analog. + +|`+tropical-echo-retention-simple+` (line 135) |— |— |Unilateral +(Agda-only). Simplified restatement of the headline bridge. + +|(no Agda analog) |`+trop_mul+` (function, line 46) |`+tMul+` (function, +line 103) |DIVERGES: the adjacent repo carries a full semiring (add + +mul), the Agda side does not. The Agda bridge needs only the additive +(max) structure of the dioid; multiplicative tropical structure is out +of scope for the echo bridge as it currently stands. + +|(no Agda analog) |`+trop_add_comm+` (line 65) |`+add_comm_trop+` (line +114) |Adjacent-side commutativity. Match between Isabelle and Lean. No +Agda analog by design — `+_⊕_+` on `+ℕ+` is commutative but the lemma is +not stated because the bridge headlines do not consume it. + +|(no Agda analog) |`+trop_add_assoc+` (line 69) |`+add_assoc_trop+` +(line 117) |Adjacent-side associativity. Match between Isabelle and +Lean. No Agda analog by design (same reason as commutativity). + +|(no Agda analog) |`+trop_distrib_{left,right}+` (lines 122/126); +semiring instance |`+left_distrib_trop+` / `+right_distrib_trop+` (lines +167/173); `+CommSemiring Tropical+` instance (line 208) |Adjacent-side +distributivity + semiring typeclass wiring. Match between Isabelle and +Lean. Out of scope for the echo bridge. +|=== + +=== Alignment caveats + +* *No Agda↔Isabelle/Lean import surface.* Agda cannot `+import+` a +`+.thy+` or a `+.lean+`; Isabelle and Lean4 cannot `+import+` an +`+.agda+`. Any "`alignment`" between these files is therefore +citation-level only — a reader verifies the names and statements line +up, but each prover runs its own independent proof. None of the three is +a trusted oracle for either of the others. +* *Independent proofs, identical claims.* The first alignable theorem +pair is `+⊕-idem+` (Agda) ↔ `+trop_add_idem+` (Isabelle). Both are +proved (clean, no axioms, no `+sorry+`); the Agda side under +`+--safe --without-K+`, the Isabelle side as a `+simp+` lemma against +the algebraic kernel of `+Tropical.thy+`. The Lean side does not name +this fact directly but consumes it inside the QTT refinement theorem +`+tropical_grade_le_sequentialTotal+` (`+max a b ≤ a + b+` is the dioid +consequence of additive idempotence). +* *Carrier mismatch is intentional, not a defect.* Agda’s `+_⊕_+` lives +on `+ℕ+` (the score type); Isabelle/Lean live on the lifted carrier with +an explicit `+−∞+` bottom. The Agda side never needs `+−∞+` because +every candidate has a finite score; the bridge is consciously narrower +than the full max-plus semiring. +* *Echo-side machinery is Agda-exclusive.* The `+Echo+`/`+TropEcho+` +fibre type, `+IsArgmin+`, the candidate datatype, and all bridge +headlines (`+tropical-non-injective+`, `+echo0-to-tropical+`, +`+distinct-candidates-same-visible-distinct-echo+`) have no analog on +the Isabelle or Lean sides. The adjacent repo’s tropical semiring stands +on its own and is consumed by _session-type grading_ +(`+grade : Session → Tropical+` in Lean), which is the symmetric +Agda-exclusive direction. +* *Long-game alignment target.* When the echo-types ordinal track +reaches Bachmann–Howard (ψ₀(Ω_ω); see `+roadmap.adoc+` §Lane 3 and +`+docs/buchholz-plan.adoc+`), the adjacent repo’s +`+Tropical_Ordinal_Bridge.thy+` becomes the natural cross-repo alignment +target (Agda Buchholz BT ↔ Isabelle `+tropO+` carrier). This target is +*firewalled* until the ordinal track lands the milestone — do not pull +it forward. + +=== Revision history + +* 2026-05-20: created (initial citation-level correspondence). diff --git a/docs/echo-types/tropical-correspondence.md b/docs/echo-types/tropical-correspondence.md deleted file mode 100644 index 5e0eb0e..0000000 --- a/docs/echo-types/tropical-correspondence.md +++ /dev/null @@ -1,98 +0,0 @@ - - -# Tropical Correspondence (echo-types ↔ tropical-resource-typing) - -Last updated: 2026-05-20 - -This appendix records the citation-level correspondence between -`proofs/agda/EchoTropical.agda` in this repo and the adjacent -`hyperpolymath/tropical-resource-typing` repo (Isabelle + Lean4). The -alignment is **statement-level only**: there is no FFI surface between -Agda and Isabelle/Lean, no shared definition module, and no cross-prover -extraction pipeline. Each side carries its own independent proof of the -named theorems; this document is a cross-reference that lets a reader -verify "the same fact is established in all three systems," but does -not constitute a unified verification artefact. It closes the -"Adjacent repo not recently audited" blocker noted in -`cross-repo-bridge-status.md`. - -## Source files - -- **Agda (this repo).** `proofs/agda/EchoTropical.agda` — the - Tropical-Echo bridge (E10): max-plus semiring on `ℕ` plus the - echo-retention bridge theorems. -- **Isabelle.** - `tropical-resource-typing/Tropical.thy` — max-plus tropical semiring - over the lifted carrier `ℕ ∪ {-∞}`, wired into Isabelle's - `comm_semiring_1` typeclass hierarchy, with idempotence proved - separately (the structure is a dioid, not a ring). -- **Lean4.** - `tropical-resource-typing/TropicalSessionTypes.lean` — max-plus - tropical semiring on the lifted carrier `Nat ∪ {bot}`, used to grade - session types so that speculative parallel cost is the bottleneck - (`max`) rather than the sequential sum. -- **Canonical adjacent remote.** `hyperpolymath/tropical-resource-typing` - (active; primary language Isabelle; the `.thy` files were last - touched in the `Tropical_Semirings` close sweep, with subsequent CI - hardening commits on top). -- **Local clone for this audit.** - `/home/hyperpolymath/dev/repos/repos-monorepo/verification-ecosystem/tropical-resource-typing`. - -## Name-by-name correspondence - -| Agda (`EchoTropical.agda`) | Isabelle (`Tropical.thy`) | Lean4 (`TropicalSessionTypes.lean`) | Notes | -|---|---|---|---| -| `_⊕_` (max-plus add on `ℕ`, line 23) | `trop_add` (function, line 41) | `tAdd` (function, line 96) | Same operation (max with identity element absorbed at the left). DIVERGES (carrier): Agda's `_⊕_` operates on raw `ℕ` with `zero` acting as the additive identity by the recursion shape; Isabelle's `trop_add` and Lean's `tAdd` both operate on a *lifted* carrier (`tropical = Fin nat \| NegInf` / `Tropical = .val Nat \| .bot`) where the additive identity is the bottom element `−∞`, not `0`. The `ℕ` quotient on the Agda side is intentional (the bridge only needs scores in `ℕ`) but means Agda's `_⊕_` is the restriction of the Isabelle/Lean operation to the finite sub-semiring; the algebraic laws below match on that restriction. | -| `⊕-idem` (line 30) | `trop_add_idem [simp]` (lemma, line 73) | — | Match (Agda ↔ Isabelle): Agda `⊕-idem : ∀ m → m ⊕ m ≡ m` ↔ Isabelle `trop_add_idem : trop_add a a = a`. The Isabelle file also restates this at typeclass level as `tropical_add_idem` (theorem, line 266: `(a :: tropical) + a = a`); the bare-function lemma is the closer match. Lean side has NO named idempotence theorem — the file ships 13 CommSemiring laws (commut/assoc/identity/distrib) but not `tAdd a a = a`. The Lean docstring explicitly flags this gap: `tropical_grade_le_sequentialTotal` is offered as the "Lean analogue of Isabelle `tropical_add_idem`" because `max a b ≤ a + b` is what `add_idem` buys in a dioid. So the Lean cell is `—` for the bare law and `tropical_grade_le_sequentialTotal` for the downstream consumer. | -| `score-⊕-idem` (line 82) | — | — | Unilateral (Agda-only). The Agda side specialises `⊕-idem` to scores of the 3-candidate set; the adjacent repo has no `Candidate` type and no `score` function, so the specialisation has no analog. | -| `tropical-non-injective` (line 55) | — | — | Unilateral (Agda-only). Headline of the echo-retention bridge: there exist distinct candidates with the same tropical score. The adjacent repo does not type candidates (its tropical semiring is generic), so there is nothing to be non-injective about. | -| `tropical-collapse-visible` (line 121) | — | — | Unilateral (Agda-only). `score a ≡ score b` for the concrete 3-candidate choice; no analog. | -| `Echo` / `echo-intro` / `TropEcho` / `IsArgmin` (lines 59–73) | — | — | Unilateral (Agda-only). The echo type itself (`Echo f y := Σ A (λ x → f x ≡ y)`) is an echo-types invention; the adjacent repo has no fibre type and no echo bridge. | -| `echo0-to-tropical` (line 113) | — | — | Unilateral (Agda-only). Bridge map echo → tropical residue; no analog (no echo on the other side). | -| `distinct-candidates-same-visible-distinct-echo` (line 130) | — | — | Unilateral (Agda-only). The main bridge theorem: collapse on the visible (tropical) side, retention on the echo side. No analog. | -| `tropical-echo-retention-simple` (line 135) | — | — | Unilateral (Agda-only). Simplified restatement of the headline bridge. | -| (no Agda analog) | `trop_mul` (function, line 46) | `tMul` (function, line 103) | DIVERGES: the adjacent repo carries a full semiring (add + mul), the Agda side does not. The Agda bridge needs only the additive (max) structure of the dioid; multiplicative tropical structure is out of scope for the echo bridge as it currently stands. | -| (no Agda analog) | `trop_add_comm` (line 65) | `add_comm_trop` (line 114) | Adjacent-side commutativity. Match between Isabelle and Lean. No Agda analog by design — `_⊕_` on `ℕ` is commutative but the lemma is not stated because the bridge headlines do not consume it. | -| (no Agda analog) | `trop_add_assoc` (line 69) | `add_assoc_trop` (line 117) | Adjacent-side associativity. Match between Isabelle and Lean. No Agda analog by design (same reason as commutativity). | -| (no Agda analog) | `trop_distrib_{left,right}` (lines 122/126); semiring instance | `left_distrib_trop` / `right_distrib_trop` (lines 167/173); `CommSemiring Tropical` instance (line 208) | Adjacent-side distributivity + semiring typeclass wiring. Match between Isabelle and Lean. Out of scope for the echo bridge. | - -## Alignment caveats - -- **No Agda↔Isabelle/Lean import surface.** Agda cannot `import` a - `.thy` or a `.lean`; Isabelle and Lean4 cannot `import` an `.agda`. - Any "alignment" between these files is therefore citation-level only - — a reader verifies the names and statements line up, but each - prover runs its own independent proof. None of the three is a - trusted oracle for either of the others. -- **Independent proofs, identical claims.** The first alignable - theorem pair is `⊕-idem` (Agda) ↔ `trop_add_idem` (Isabelle). Both - are proved (clean, no axioms, no `sorry`); the Agda side under - `--safe --without-K`, the Isabelle side as a `simp` lemma against - the algebraic kernel of `Tropical.thy`. The Lean side does not name - this fact directly but consumes it inside the QTT refinement - theorem `tropical_grade_le_sequentialTotal` (`max a b ≤ a + b` is - the dioid consequence of additive idempotence). -- **Carrier mismatch is intentional, not a defect.** Agda's `_⊕_` - lives on `ℕ` (the score type); Isabelle/Lean live on the lifted - carrier with an explicit `−∞` bottom. The Agda side never needs - `−∞` because every candidate has a finite score; the bridge is - consciously narrower than the full max-plus semiring. -- **Echo-side machinery is Agda-exclusive.** The `Echo`/`TropEcho` - fibre type, `IsArgmin`, the candidate datatype, and all bridge - headlines (`tropical-non-injective`, `echo0-to-tropical`, - `distinct-candidates-same-visible-distinct-echo`) have no analog - on the Isabelle or Lean sides. The adjacent repo's tropical - semiring stands on its own and is consumed by *session-type - grading* (`grade : Session → Tropical` in Lean), which is the - symmetric Agda-exclusive direction. -- **Long-game alignment target.** When the echo-types ordinal track - reaches Bachmann–Howard (ψ₀(Ω_ω); see `roadmap.adoc` §Lane 3 and - `docs/buchholz-plan.adoc`), the adjacent repo's - `Tropical_Ordinal_Bridge.thy` becomes the natural cross-repo - alignment target (Agda Buchholz BT ↔ Isabelle `tropO` carrier). - This target is **firewalled** until the ordinal track lands the - milestone — do not pull it forward. - -## Revision history - -- 2026-05-20: created (initial citation-level correspondence). diff --git a/docs/echo-types/types-list-note.adoc b/docs/echo-types/types-list-note.adoc new file mode 100644 index 0000000..7c7e15b --- /dev/null +++ b/docs/echo-types/types-list-note.adoc @@ -0,0 +1,127 @@ +== Draft note for the TYPES mailing list + +*Status:* draft, not sent. Written to satisfy gate G2 of the +`+types-list+` readiness system (a self-contained, honestly sized +framing note linking a type-checked artifact). Reviewed against the +list’s cardinal rule: _do not present a known notion as a new one._ + +Target list: `+types-list@lists.seas.upenn.edu+` +(https://lists.seas.upenn.edu/mailman/listinfo/types-list). + +''''' + +=== Subject + +Prior art: fibers studied systematically as the _residue_ of +information-losing maps (mechanised, `+--safe --without-K+` Agda) + +=== Body + +Dear all, + +I have a small mechanised Agda development and a prior-art / +related-work question. I want to be explicit up front about what is +*not* new, because the honest framing is the question. + +==== What the object is (and is not) + +The central object is, definitionally, the fiber: + +.... +Echo : (f : A → B) → B → Set +Echo f y = Σ A (λ x → f x ≡ y) +.... + +This is `+hfiber+` / the homotopy fiber. I am *not* claiming a new type +former. The development (`+--safe --without-K+`, no postulates, no +holes, CI-checked; ~13k LOC) is an _editorial_ programme: it studies +fibers *systematically as the structured remainder of information-losing +computation*, with + +[arabic] +. an 8-axis taxonomy of how such remainders differ (extensional vs +intensional, exact vs approximate, local vs global, canonical vs +presentation-dependent, compositional vs not, static vs dynamic, +proof-relevant vs irrelevant, information-theoretic vs computational +access), each axis carrying a distinguishing formalised example; and +. a falsifiable identity claim with an explicit retraction protocol, +audited per neighbouring framework (refinement types, setoid quotients, +Galois/abstract interpretation, provenance semirings, IFC, QTT-style +modal calculi, HoTT fibers). + +==== The two structural distinctness arguments + +Against the neighbours, distinctness rests on two arguments, both with +formal exhibits: + +* *Truncation.* For non-injective `+f+`, `+Echo f y+` is _not_ a mere +proposition. General form now proved +(`+characteristic.NonTruncatable+`): a bare non-injectivity witness on +`+f+` _constructs_ an output whose echo fibre is non-propositional — the +witnessing value is produced, not assumed. (The _received-`+y+`_ form +is, honestly, just the generic Σ fact "`a Σ with two +first-component-distinct elements is not `+isProp+``"; only the +_constructed-`+y+`_ form is more than that.) +* *2-cell.* The natural 2-cell in the quotient and Galois encodings is +itself Σ-over-preimages-shaped (equalizer; lattice meet) — formal +exhibits `+EchoVsQuotient.Sophisticated+`, +`+EchoVsGalois.Sophisticated+`. + +A negative result is also recorded rather than hidden: a cross-axis +"`integration recipe`" over the five named decoration axes does *not* +produce substantive simultaneous interaction (the EI-2 investigation); +the distinctness load is carried only by the two arguments above. + +==== The questions + +[arabic] +. *Prior art for the framing.* Is the _systematic_ treatment of +fibers-as-information-residue, with an axis taxonomy of this shape, +named anywhere I should cite? I know the obvious neighbours (HoTT +fibers; container/polynomial functors; lens/optic theory; provenance +semirings; QTT). What I am asking is whether the _organising programme_ +— not the object — has a name in the literature. +. *Characteristic-theorem status.* Is the constructed-`+y+` +non-truncatability ("`ordinary non-injectivity _forces_ a +non-propositional fibre`", with the bad output produced from the +non-injectivity witness) a recognised lemma with a standard citation, or +genuinely folklore? I want to attribute it correctly rather than claim +it. + +Artifact (type-checked, gated, with the honest self-assessment): . The +relevant module is `+proofs/agda/characteristic/NonTruncatable.agda+`; +the taxonomy is `+docs/echo-types/taxonomy.md+`; the falsifiable-claim +protocol is `+roadmap-gates.adoc+`. + +Grateful for pointers, corrections, or "`this is just X under another +name`" — the latter is a useful answer, not a bad one. + +Best regards, Jonathan Jewell + +''''' + +=== Pre-send checklist (the readiness gates) + +* [x] *G2 — artifact exists.* Q2.1 proved and CI-checked; this note is +self-contained and links the repo. +* [ ] *G1 — prior-art saturation.* Before sending, do one more +literature pass on: container/polynomial functors as fiber bookkeeping; +"`fibre-wise`" / display-map framings; Spivak-style data-migration / +provenance; any "`information residue`" usage in PL. The note must +survive "`isn’t this just a polynomial functor / display map?`" — +pre-empt it in body §1 with one sentence each if a near-hit is found. +* [x] *G3 — claim correctly sized.* Body opens by conceding the object +is the fiber; asks prior-art and attribution questions, not "`I invented +a notion`". +* [ ] Replace `++` with the public URL at send time. +* [ ] Trim to ≤ ~400 words of body before sending; list readers reward +brevity. The taxonomy enumeration can become "`(8 axes; see +`+taxonomy.md+`)`". + +=== Why this is postable now (vs. earlier) + +The trigger named in the readiness system was _closing Q2.1_. It is +closed and CI-checked, so there is now a checkable result behind the +prior-art question rather than a framework pitch. The one remaining gate +is G1 (a literature pass), which is a desk task, not a formalisation +blocker. diff --git a/docs/echo-types/types-list-note.md b/docs/echo-types/types-list-note.md deleted file mode 100644 index e3e1ef0..0000000 --- a/docs/echo-types/types-list-note.md +++ /dev/null @@ -1,133 +0,0 @@ - - -# Draft note for the TYPES mailing list - -**Status:** draft, not sent. Written to satisfy gate G2 of the -`types-list` readiness system (a self-contained, honestly sized -framing note linking a type-checked artifact). Reviewed against the -list's cardinal rule: *do not present a known notion as a new one.* - -Target list: `types-list@lists.seas.upenn.edu` -(https://lists.seas.upenn.edu/mailman/listinfo/types-list). - ---- - -## Subject - -Prior art: fibers studied systematically as the *residue* of -information-losing maps (mechanised, `--safe --without-K` Agda) - -## Body - -Dear all, - -I have a small mechanised Agda development and a prior-art / -related-work question. I want to be explicit up front about what is -**not** new, because the honest framing is the question. - -### What the object is (and is not) - -The central object is, definitionally, the fiber: - -``` -Echo : (f : A → B) → B → Set -Echo f y = Σ A (λ x → f x ≡ y) -``` - -This is `hfiber` / the homotopy fiber. I am **not** claiming a new -type former. The development (`--safe --without-K`, no postulates, -no holes, CI-checked; ~13k LOC) is an *editorial* programme: it -studies fibers **systematically as the structured remainder of -information-losing computation**, with - -1. an 8-axis taxonomy of how such remainders differ (extensional vs - intensional, exact vs approximate, local vs global, canonical vs - presentation-dependent, compositional vs not, static vs dynamic, - proof-relevant vs irrelevant, information-theoretic vs - computational access), each axis carrying a distinguishing - formalised example; and -2. a falsifiable identity claim with an explicit retraction - protocol, audited per neighbouring framework (refinement types, - setoid quotients, Galois/abstract interpretation, provenance - semirings, IFC, QTT-style modal calculi, HoTT fibers). - -### The two structural distinctness arguments - -Against the neighbours, distinctness rests on two arguments, both -with formal exhibits: - -- **Truncation.** For non-injective `f`, `Echo f y` is *not* a mere - proposition. General form now proved - (`characteristic.NonTruncatable`): a bare non-injectivity witness - on `f` *constructs* an output whose echo fibre is non-propositional - — the witnessing value is produced, not assumed. (The - *received-`y`* form is, honestly, just the generic Σ fact "a Σ - with two first-component-distinct elements is not `isProp`"; only - the *constructed-`y`* form is more than that.) -- **2-cell.** The natural 2-cell in the quotient and Galois - encodings is itself Σ-over-preimages-shaped (equalizer; lattice - meet) — formal exhibits `EchoVsQuotient.Sophisticated`, - `EchoVsGalois.Sophisticated`. - -A negative result is also recorded rather than hidden: a -cross-axis "integration recipe" over the five named decoration -axes does **not** produce substantive simultaneous interaction -(the EI-2 investigation); the distinctness load is carried only by -the two arguments above. - -### The questions - -1. **Prior art for the framing.** Is the *systematic* treatment of - fibers-as-information-residue, with an axis taxonomy of this - shape, named anywhere I should cite? I know the obvious - neighbours (HoTT fibers; container/polynomial functors; - lens/optic theory; provenance semirings; QTT). What I am asking - is whether the *organising programme* — not the object — has a - name in the literature. -2. **Characteristic-theorem status.** Is the constructed-`y` - non-truncatability ("ordinary non-injectivity *forces* a - non-propositional fibre", with the bad output produced from the - non-injectivity witness) a recognised lemma with a standard - citation, or genuinely folklore? I want to attribute it - correctly rather than claim it. - -Artifact (type-checked, gated, with the honest self-assessment): -. The relevant module is -`proofs/agda/characteristic/NonTruncatable.agda`; the taxonomy is -`docs/echo-types/taxonomy.md`; the falsifiable-claim protocol is -`roadmap-gates.adoc`. - -Grateful for pointers, corrections, or "this is just X under -another name" — the latter is a useful answer, not a bad one. - -Best regards, -Jonathan Jewell - ---- - -## Pre-send checklist (the readiness gates) - -- [x] **G2 — artifact exists.** Q2.1 proved and CI-checked; this - note is self-contained and links the repo. -- [ ] **G1 — prior-art saturation.** Before sending, do one more - literature pass on: container/polynomial functors as fiber - bookkeeping; "fibre-wise" / display-map framings; Spivak-style - data-migration / provenance; any "information residue" usage in - PL. The note must survive "isn't this just a polynomial functor / - display map?" — pre-empt it in body §1 with one sentence each if a - near-hit is found. -- [x] **G3 — claim correctly sized.** Body opens by conceding the - object is the fiber; asks prior-art and attribution questions, not - "I invented a notion". -- [ ] Replace `` with the public URL at send time. -- [ ] Trim to ≤ ~400 words of body before sending; list readers - reward brevity. The taxonomy enumeration can become "(8 axes; - see `taxonomy.md`)". - -## Why this is postable now (vs. earlier) - -The trigger named in the readiness system was *closing Q2.1*. It is -closed and CI-checked, so there is now a checkable result behind the -prior-art question rather than a framework pitch. The one remaining -gate is G1 (a literature pass), which is a desk task, not a -formalisation blocker. diff --git a/docs/governance.adoc b/docs/governance.adoc new file mode 100644 index 0000000..349623c --- /dev/null +++ b/docs/governance.adoc @@ -0,0 +1,40 @@ +== Governance & Research Discipline + +This repository operates under strict stabilisation and +proof-preservation rules. It is treated as a sensitive proof artifact. + +=== Core vs. Bridge + +* *Core:* The minimal, mechanically verified theory of echo types +(`+proofs/agda/Echo/Core.agda+`, `+Characteristic.agda+`, +`+Residue.agda+`). This is the unshakeable foundation. +* *Bridge:* Speculative extensions, cross-domain mappings, and +integrations. Bridge materials are strictly labeled (e.g., PARTIAL, +EXPLORATORY, BLOCKED) and reside in `+proofs/agda/Echo/Bridges/+` and +`+docs/bridges/+`. They do _not_ affect the core identity. + +=== Retractions + +* A claim is *RETRACTED* when fundamental type-theoretic or mathematical +obstacles are encountered (e.g., Graded Comonad framing, Universal +Property without funext). +* Retracted claims are moved to `+docs/retracted/+`. They must not be +revived without explicit new, mechanically verified proofs that overcome +the documented blockers. + +=== Burden of Proof and Hidden Assumptions + +* Every substantive theorem must be mechanically checked in Agda. +* *Prohibited:* Unsafe postulates, `+TERMINATING+` pragmas, +`+NON_TERMINATING+` pragmas, `+--allow-unsolved-metas+`, and hidden +assumptions. +* If a proof cannot be completed, it must be left as a typed hole, +annotated as a `+TODO+`, and explicitly labeled as `+BLOCKED+`. +* Conjectures must be explicitly labeled as `+CONJECTURE+`. + +=== Modifications + +* Do not perform global namespace rewrites or aggressive file moves. +* Favor small, proof-preserving commits. +* Documentation must prioritize precision, restraint, and falsifiability +over hype. diff --git a/docs/governance.md b/docs/governance.md deleted file mode 100644 index df92403..0000000 --- a/docs/governance.md +++ /dev/null @@ -1,24 +0,0 @@ - - -# Governance & Research Discipline - -This repository operates under strict stabilisation and proof-preservation rules. It is treated as a sensitive proof artifact. - -## Core vs. Bridge -- **Core:** The minimal, mechanically verified theory of echo types (`proofs/agda/Echo/Core.agda`, `Characteristic.agda`, `Residue.agda`). This is the unshakeable foundation. -- **Bridge:** Speculative extensions, cross-domain mappings, and integrations. Bridge materials are strictly labeled (e.g., PARTIAL, EXPLORATORY, BLOCKED) and reside in `proofs/agda/Echo/Bridges/` and `docs/bridges/`. They do *not* affect the core identity. - -## Retractions -- A claim is **RETRACTED** when fundamental type-theoretic or mathematical obstacles are encountered (e.g., Graded Comonad framing, Universal Property without funext). -- Retracted claims are moved to `docs/retracted/`. They must not be revived without explicit new, mechanically verified proofs that overcome the documented blockers. - -## Burden of Proof and Hidden Assumptions -- Every substantive theorem must be mechanically checked in Agda. -- **Prohibited:** Unsafe postulates, `TERMINATING` pragmas, `NON_TERMINATING` pragmas, `--allow-unsolved-metas`, and hidden assumptions. -- If a proof cannot be completed, it must be left as a typed hole, annotated as a `TODO`, and explicitly labeled as `BLOCKED`. -- Conjectures must be explicitly labeled as `CONJECTURE`. - -## Modifications -- Do not perform global namespace rewrites or aggressive file moves. -- Favor small, proof-preserving commits. -- Documentation must prioritize precision, restraint, and falsifiability over hype. diff --git a/docs/paper-spine.adoc b/docs/paper-spine.adoc new file mode 100644 index 0000000..fe970f5 --- /dev/null +++ b/docs/paper-spine.adoc @@ -0,0 +1,55 @@ +== Paper Spine + +=== 1. Problem + +Standard formalisms prioritize reversible or perfectly linear systems +where no information is lost, or simply discard lost information +entirely in irreversible systems. There is no first-class treatment for +_structured_ loss where the fact of the loss and a constraint on what +was lost are retained. + +=== 2. Observation + +When a non-injective function collapses distinct inputs to the same +output, the fiber over that output contains the exact witness of the +collapse. Treating this fiber not as a topological artifact but as a +computational "`echo`" provides a formal vocabulary for partial +recovery. + +=== 3. Definition + +Given `+f : A → B+`, the echo at `+y : B+` is defined as: +`+Echo f y := Σ (x : A) , (f x ≡ y)+` + +=== 4. Why ordinary fibers are insufficient + +While structurally identical to homotopy fibers, ordinary fibers are +rarely studied as carriers of programmatic provenance or computational +residue. The "`Echo`" vocabulary shifts the focus from equivalence +proofs to epistemic constraints and non-injective bounds. + +=== 5. Characteristic theorem candidates + +* `+collapse-non-injective+`: Explicit witnesses of irreversible +collapse. +* `+no-section-visible+`: It is impossible to fully reconstruct the +input from the output alone. +* `+visible-constraint+`: Projection-style structured loss retains a +provable constraint on the original state. + +=== 6. Canonical example + +Lossy boolean classification (`+true+` and `+false+` collapsing to +`+unit+`), demonstrating distinct echoes over the same visible value. + +=== 7. Failure conditions + +If the echo type requires constant manual unwrapping to the underlying +sigma type, or if compositional complexity explodes, the abstraction +fails. + +=== 8. Bridge roadmap + +Future exploratory work includes bridging this minimal core to +thermodynamic costs, tropical semantics, and choreographic state +tracking. diff --git a/docs/paper-spine.md b/docs/paper-spine.md deleted file mode 100644 index 2d1e50d..0000000 --- a/docs/paper-spine.md +++ /dev/null @@ -1,30 +0,0 @@ - - -# Paper Spine - -## 1. Problem -Standard formalisms prioritize reversible or perfectly linear systems where no information is lost, or simply discard lost information entirely in irreversible systems. There is no first-class treatment for *structured* loss where the fact of the loss and a constraint on what was lost are retained. - -## 2. Observation -When a non-injective function collapses distinct inputs to the same output, the fiber over that output contains the exact witness of the collapse. Treating this fiber not as a topological artifact but as a computational "echo" provides a formal vocabulary for partial recovery. - -## 3. Definition -Given `f : A → B`, the echo at `y : B` is defined as: -`Echo f y := Σ (x : A) , (f x ≡ y)` - -## 4. Why ordinary fibers are insufficient -While structurally identical to homotopy fibers, ordinary fibers are rarely studied as carriers of programmatic provenance or computational residue. The "Echo" vocabulary shifts the focus from equivalence proofs to epistemic constraints and non-injective bounds. - -## 5. Characteristic theorem candidates -- `collapse-non-injective`: Explicit witnesses of irreversible collapse. -- `no-section-visible`: It is impossible to fully reconstruct the input from the output alone. -- `visible-constraint`: Projection-style structured loss retains a provable constraint on the original state. - -## 6. Canonical example -Lossy boolean classification (`true` and `false` collapsing to `unit`), demonstrating distinct echoes over the same visible value. - -## 7. Failure conditions -If the echo type requires constant manual unwrapping to the underlying sigma type, or if compositional complexity explodes, the abstraction fails. - -## 8. Bridge roadmap -Future exploratory work includes bridging this minimal core to thermodynamic costs, tropical semantics, and choreographic state tracking. diff --git a/docs/proof-debt.adoc b/docs/proof-debt.adoc new file mode 100644 index 0000000..1b01971 --- /dev/null +++ b/docs/proof-debt.adoc @@ -0,0 +1,167 @@ +== Proof debt + +Per the estate Trusted-Base Reduction Policy (hyperpolymath/standards +`+docs/TRUSTED-BASE-REDUCTION-POLICY.adoc+`), every soundness-relevant +escape hatch in this repository is enumerated below under one of (a) +discharged / (b) budgeted / (c) necessary axiom / (d) debt. + +=== (a) Discharged in this repo + +* *Propositional truncation `+∥_∥+` + the (epi, mono) image +factorisation* — discharged 2026-06-15 in the `+--cubical --safe+` lane +by `+proofs/agda/EchoImageFactorizationPropCubical.agda+` (zero +postulates). The module CONSTRUCTS `+∥_∥+` as a higher inductive type +and realises the four `+TruncInterface+` obligations as theorems +(`+is-prop-∥∥+` from the `+squash+` higher constructor transported to +the inductive `+_≡_+`; `+rec-∥∥+` via the path recursor, its boundary +closing by the cubical endpoint rule), then re-proves +`+prop-factor-right-injective+` (mono) and +`+prop-factor-left-mere-surjective+` (epi). This realises the axiom the +`+--without-K+` demo under (c) only assumes — see (c). +* *Bachmann–Howard target structure (`+BHNotation+` + its +well-foundedness)* — discharged 2026-06-15 in the `+--safe --without-K+` +kernel by `+proofs/agda/Ordinal/Buchholz/BHTarget.agda+` (zero +postulates; wired into `+All.agda+`, pinned in +`+Ordinal/Buchholz/Smoke.agda+`). The abstract `+BHNotation+` interface +and a concrete `+bh-notation-from : Ord → BHNotation+` are CONSTRUCTED +from the repo’s existing Brouwer order (`+Ord+` / `+_<′_+` / `+wf-<′+`), +so the fidelity target’s order AND its well-foundedness are now proved, +not assumed. This reduces the order-type fidelity trust boundary under +(d) from three postulates to two; the candidate BH HEIGHT (which `+Ord+` +value is ψ₀(Ω_ω)) is now an explicit module parameter +(`+Fidelity.AtHeight+`), not a postulate. Order-type fidelity ITSELF +remains OPEN — see (d). + +=== (b) Budgeted — tested with refutation budget + +* (none) + +=== (c) Necessary axiom + +* `+proofs/agda/EchoImageFactorizationPropPostulated.agda:102+` — +top-level `+postulate+` introducing four propositional-truncation +primitives (`+Trunc-pos+`, `+∣_∣-pos+`, `+is-prop-pos+`, `+rec-pos+`) +** *Justification*: propositional truncation `+∥_∥+` cannot be +constructed in plain `+--safe --without-K+` Agda without HITs / Cubical. +The four postulates encode the standard `+TruncInterface ℓ+` record +(existence + propositionality + propositional-recursion + introduction). +The construction is *exploratory* — the base module +`+EchoImageFactorizationProp.agda+` remains `+--safe --without-K+` +with zero postulates; `+…Postulated+` exists solely to demonstrate the +interface concretely. +** *Citation*: see `+docs/echo-types/echo-kernel-note.adoc+` (Tier-2 +classification — "`Exploratory / postulated`"); HoTT Book §3.7 +(propositional truncation); agda-stdlib does not currently expose this +in `+--safe --without-K+`. +** *Guardrail status*: explicitly allow-listed in +`+tools/check-guardrails.sh+` and in the inline `+hypatia: allow+` +pragma at the head of the module. +** *Realised (2026-06-15)*: the same four obligations are CONSTRUCTED +(zero postulates) in the `+--cubical+` lane by +`+EchoImageFactorizationPropCubical.agda+` — see (a). The postulates +here are therefore the `+--safe --without-K+`-profile shadow of a +now-constructed object, not an irreducible axiom; they remain only +because `+∥_∥+` cannot be built WITHIN `+--safe --without-K+` itself. + +=== (d) DEBT — actively to be closed + +* `+proofs/agda/Ordinal/Buchholz/Fidelity.agda+` — *two* top-level +`+postulate+`s (reduced from three on 2026-06-15; see (a)) forming the +trust boundary of the *order-type fidelity scaffold* (open problem +`+D-2026-06-14+`, +`+docs/echo-types/decisions/ordinal-bh-order-type-fidelity-open.adoc+`): +** `+denotation+` — assumed faithful, height-preserving order-embedding +`+⟦·⟧ : BT → 𝒪+` into the (now-real) Brouwer target (the missing object; +*not* `+rank2+`, which deliberately collapses heights and is a +termination measure only). +** `+ordinal-upper-bound+` — the `+⟦·⟧+`-level upper half of the +sandwich (downstream of `+denotation+`). +** *Discharged (2026-06-15)*: the former `+bh-notation+` postulate (an +opaque whole BH structure) is gone — the `+BHNotation+` interface and a +real `+bh-notation-from+` instance now live in the `+--safe+` kernel +module `+Ordinal.Buchholz.BHTarget+`, so the target order and its +well-foundedness (Brouwer `+_<′_+` / `+wf-<′+`) are proved, not assumed. +The candidate BH height is an explicit parameter to +`+Fidelity.AtHeight+`, not a postulate. See (a). +** *Classification*: DEBT, to be discharged when order-type fidelity is +proved — these are _not_ permanently-accepted axioms. Each is annotated +inline with an `+AXIOM:+` leading comment. +** *Justification / scope*: the module is quarantined — `+--without-K+` +only, NOT imported by `+All.agda+` / `+Smoke.agda+` — so the `+--safe+` +kernel cone depends on neither postulate. Nothing in the module asserts +that order type ψ₀(Ω_ω) is _proven_; the status surfaces (appendix, +decision log, roadmap) read "`written at WF milestone; order-type +fidelity OPEN`". +** *Citation*: `+D-2026-06-14+`; full per-postulate spec (statement / +what closes it / owner) in `+Fidelity-OPEN-postulates.md+`. +** *PARKED (2026-06-20, `+D-2026-06-20+`)*: the transfinite ladder these +postulates sit atop is now _consumer-less_ — the Groove cleave (the only +consumer of ψ₀(Ω_ω) order-type fidelity) is resolved as a finite +exact-round-trip zipper needing well-foundedness only, and RC-11 forbids +ε₀+ in cleave ranks. The debt is therefore _parked, resumable_, not +actively being closed. No postulate closed; `+D-2026-06-14+` stands. See +`+docs/echo-types/decisions/ordinal-fidelity-ladder-parked.adoc+`. +** *Guardrail status*: allow-listed in `+tools/check-guardrails.sh+` +(`+EXPLORATORY_EXEMPT+`) and the inline `+hypatia: allow+` pragma at the +module head. (`+BHTarget+` is NOT exempt — it is real kernel content and +passes the guardrail.) + +=== Notes + +The `+EchoDecorationBridge.agda+` module is tagged exploratory in the +guardrail but contains no escape hatches; it is excluded from the +guardrail’s "`no postulates`" rule for naming convenience (the +`+-Postulated+` suffix would be misleading there). The trusted-base +script does not flag this module because it scans for actual +`+^[[:space:]]*postulate+` lines. + +=== Independent ground-truth audit (2026-06-16) + +An out-of-band trust audit (cold rebuild + flag/guardrail probes, not +doc-trust) was run before an external project (the `+ephapax+` L1 +re-foundation) built on this repo. *Verdict: trustworthy — build on the +WIRED layer only.* It is consistent with, and complements, the (a)–(d) +ledger above. + +* *Wired vs orphaned.* Against the transitive closure of the 4 CI roots +(`+All+` / `+Smoke+` / `+characteristic/All+` / `+examples/All+`): +~**164 files / ~32.5k lines WIRED** (`+--safe --without-K+`, exit 0, +zero postulates/holes in the cone) vs ~**15 orphaned files** (~8%). The +often-cited "`676 files / 52k lines`" headline is inflated by +`+.claude/worktrees/+` duplicate snapshots; real source ≈ 190 `+.agda+` +files / ~36k lines. +* *The quarantined postulates are correctly _outside_ the wired cone.* +The audit independently confirms the two postulate-bearing files this +ledger already lists — `+EchoImageFactorizationPropPostulated.agda+` (c) +and `+Ordinal/Buchholz/Fidelity.agda+` (d) — are guardrail-exempt, +`+--without-K+`-only, and imported by no `+All.agda+`, so the `+--safe+` +kernel cone depends on neither. Nothing slipped into the wired layer. +* *⚠ Variance was open AT AUDIT TIME; RESOLVED 2026-06-20.* As of this +audit (2026-06-16) the only variance material on `+main+` was the +`+experimental/echo-additive/+` track (`+GradedComonad+` / +`+GradedMonad+` / `+GradedAdjunction+` / `+VarianceGate.agda+`) — +*orphaned* (in no `+All.agda+`, not CI-verified; `+VarianceGate.agda+` +self-declares "`This file contains NO proven theorems … OBLIGATION +comments`", variance *RETRACTED R-2026-05-18*), so the monad / comonad / +adjunction question was genuinely open _then_. It was *settled four days +later by the WIRED `+EchoVariance.agda+`* (#243, 2026-06-20 — in +`+All.agda+`, `+--safe --without-K+`, zero postulates, pinned in +`+Smoke.agda+`): echo is a graded *monad of accumulation* +(`+accumulate = Echo-comp-iso-from+`) with a section/retraction +*adjunction exact on the grade-0 fibre* +(`+recoverable-fibre = A↔ΣEcho+`), and is *NOT a graded comonad* +(`+no-bare-recovery+` via `+no-section-of-collapsing-map+` is the +obstruction; sharpens `+R-2026-05-18+` from "`graded comonad withdrawn`" +to "`decided against`"). Cite the WIRED `+EchoVariance+` for the +verdict; the orphaned `+experimental/echo-additive/+` track is the +retired earlier attempt. See +`+docs/echo-types/variance-resolution.adoc+`. Build on the wired +`+Echo+` / `+EchoResidue+`, `+EchoVariance+`, `+EchoGradedComonad+` +(coassoc/counit), the composition isos, and `+DyadicEchoBridge+`. +* *Env gotcha (fix before handoff).* A _dangling_ libraries config +(guix-store name mismatch + a non-existent `+…/absolute-zero+` path) +causes *false "`library name not found`" failures* under the default +config. Correct invocation points `+--library-file+` at the v2.3 stdlib +worktree +(`+/home/hyperpolymath/developer/worktrees/agda-stdlib-tweak+`). A +config artefact, NOT a proof defect. diff --git a/docs/proof-debt.md b/docs/proof-debt.md deleted file mode 100644 index c8bb0cc..0000000 --- a/docs/proof-debt.md +++ /dev/null @@ -1,168 +0,0 @@ - - - -# Proof debt - -Per the estate Trusted-Base Reduction Policy -(hyperpolymath/standards `docs/TRUSTED-BASE-REDUCTION-POLICY.adoc`), every -soundness-relevant escape hatch in this repository is enumerated below -under one of (a) discharged / (b) budgeted / (c) necessary axiom / (d) debt. - -## (a) Discharged in this repo - -- **Propositional truncation `∥_∥` + the (epi, mono) image - factorisation** — discharged 2026-06-15 in the `--cubical --safe` - lane by `proofs/agda/EchoImageFactorizationPropCubical.agda` (zero - postulates). The module CONSTRUCTS `∥_∥` as a higher inductive type - and realises the four `TruncInterface` obligations as theorems - (`is-prop-∥∥` from the `squash` higher constructor transported to - the inductive `_≡_`; `rec-∥∥` via the path recursor, its boundary - closing by the cubical endpoint rule), then re-proves - `prop-factor-right-injective` (mono) and - `prop-factor-left-mere-surjective` (epi). This realises the axiom - the `--without-K` demo under (c) only assumes — see (c). - -- **Bachmann–Howard target structure (`BHNotation` + its - well-foundedness)** — discharged 2026-06-15 in the `--safe --without-K` - kernel by `proofs/agda/Ordinal/Buchholz/BHTarget.agda` (zero - postulates; wired into `All.agda`, pinned in - `Ordinal/Buchholz/Smoke.agda`). The abstract `BHNotation` interface and - a concrete `bh-notation-from : Ord → BHNotation` are CONSTRUCTED from - the repo's existing Brouwer order (`Ord` / `_<′_` / `wf-<′`), so the - fidelity target's order AND its well-foundedness are now proved, not - assumed. This reduces the order-type fidelity trust boundary under (d) - from three postulates to two; the candidate BH HEIGHT (which `Ord` - value is ψ₀(Ω_ω)) is now an explicit module parameter - (`Fidelity.AtHeight`), not a postulate. Order-type fidelity ITSELF - remains OPEN — see (d). - -## (b) Budgeted — tested with refutation budget - -- (none) - -## (c) Necessary axiom - -- `proofs/agda/EchoImageFactorizationPropPostulated.agda:102` — top-level - `postulate` introducing four propositional-truncation primitives - (`Trunc-pos`, `∣_∣-pos`, `is-prop-pos`, `rec-pos`) - - **Justification**: propositional truncation `∥_∥` cannot be - constructed in plain `--safe --without-K` Agda without HITs / - Cubical. The four postulates encode the standard `TruncInterface ℓ` - record (existence + propositionality + propositional-recursion + - introduction). The construction is **exploratory** — the base - module `EchoImageFactorizationProp.agda` remains `--safe - --without-K` with zero postulates; `…Postulated` exists solely - to demonstrate the interface concretely. - - **Citation**: see `docs/echo-types/echo-kernel-note.adoc` (Tier-2 - classification — "Exploratory / postulated"); HoTT Book §3.7 - (propositional truncation); agda-stdlib does not currently expose - this in `--safe --without-K`. - - **Guardrail status**: explicitly allow-listed in - `tools/check-guardrails.sh` and in the inline `hypatia: allow` - pragma at the head of the module. - - **Realised (2026-06-15)**: the same four obligations are - CONSTRUCTED (zero postulates) in the `--cubical` lane by - `EchoImageFactorizationPropCubical.agda` — see (a). The postulates - here are therefore the `--safe --without-K`-profile shadow of a - now-constructed object, not an irreducible axiom; they remain only - because `∥_∥` cannot be built WITHIN `--safe --without-K` itself. - -## (d) DEBT — actively to be closed - -- `proofs/agda/Ordinal/Buchholz/Fidelity.agda` — **two** top-level - `postulate`s (reduced from three on 2026-06-15; see (a)) forming the - trust boundary of the **order-type fidelity scaffold** (open problem - `D-2026-06-14`, - `docs/echo-types/decisions/ordinal-bh-order-type-fidelity-open.adoc`): - - `denotation` — assumed faithful, height-preserving order-embedding - `⟦·⟧ : BT → 𝒪` into the (now-real) Brouwer target (the missing - object; **not** `rank2`, which deliberately collapses heights and is - a termination measure only). - - `ordinal-upper-bound` — the `⟦·⟧`-level upper half of the sandwich - (downstream of `denotation`). - - **Discharged (2026-06-15)**: the former `bh-notation` postulate (an - opaque whole BH structure) is gone — the `BHNotation` interface and a - real `bh-notation-from` instance now live in the `--safe` kernel - module `Ordinal.Buchholz.BHTarget`, so the target order and its - well-foundedness (Brouwer `_<′_` / `wf-<′`) are proved, not assumed. - The candidate BH height is an explicit parameter to - `Fidelity.AtHeight`, not a postulate. See (a). - - **Classification**: DEBT, to be discharged when order-type fidelity - is proved — these are *not* permanently-accepted axioms. Each is - annotated inline with an `AXIOM:` leading comment. - - **Justification / scope**: the module is quarantined — `--without-K` - only, NOT imported by `All.agda` / `Smoke.agda` — so the `--safe` - kernel cone depends on neither postulate. Nothing in the module - asserts that order type ψ₀(Ω_ω) is *proven*; the status surfaces - (appendix, decision log, roadmap) read "written at WF milestone; - order-type fidelity OPEN". - - **Citation**: `D-2026-06-14`; full per-postulate spec (statement / - what closes it / owner) in `Fidelity-OPEN-postulates.md`. - - **PARKED (2026-06-20, `D-2026-06-20`)**: the transfinite ladder these - postulates sit atop is now *consumer-less* — the Groove cleave (the - only consumer of ψ₀(Ω_ω) order-type fidelity) is resolved as a finite - exact-round-trip zipper needing well-foundedness only, and RC-11 - forbids ε₀+ in cleave ranks. The debt is therefore *parked, - resumable*, not actively being closed. No postulate closed; - `D-2026-06-14` stands. See - `docs/echo-types/decisions/ordinal-fidelity-ladder-parked.adoc`. - - **Guardrail status**: allow-listed in `tools/check-guardrails.sh` - (`EXPLORATORY_EXEMPT`) and the inline `hypatia: allow` pragma at the - module head. (`BHTarget` is NOT exempt — it is real kernel content - and passes the guardrail.) - -## Notes - -The `EchoDecorationBridge.agda` module is tagged exploratory in the -guardrail but contains no escape hatches; it is excluded from the -guardrail's "no postulates" rule for naming convenience (the -`-Postulated` suffix would be misleading there). The trusted-base -script does not flag this module because it scans for actual -`^[[:space:]]*postulate` lines. - -## Independent ground-truth audit (2026-06-16) - -An out-of-band trust audit (cold rebuild + flag/guardrail probes, not -doc-trust) was run before an external project (the `ephapax` L1 -re-foundation) built on this repo. **Verdict: trustworthy — build on the -WIRED layer only.** It is consistent with, and complements, the (a)–(d) -ledger above. - -- **Wired vs orphaned.** Against the transitive closure of the 4 CI roots - (`All` / `Smoke` / `characteristic/All` / `examples/All`): ~**164 files / - ~32.5k lines WIRED** (`--safe --without-K`, exit 0, zero postulates/holes - in the cone) vs ~**15 orphaned files** (~8%). The often-cited - "676 files / 52k lines" headline is inflated by `.claude/worktrees/` - duplicate snapshots; real source ≈ 190 `.agda` files / ~36k lines. -- **The quarantined postulates are correctly *outside* the wired cone.** - The audit independently confirms the two postulate-bearing files this - ledger already lists — `EchoImageFactorizationPropPostulated.agda` (c) - and `Ordinal/Buchholz/Fidelity.agda` (d) — are guardrail-exempt, - `--without-K`-only, and imported by no `All.agda`, so the `--safe` - kernel cone depends on neither. Nothing slipped into the wired layer. -- **⚠ Variance was open AT AUDIT TIME; RESOLVED 2026-06-20.** As of this - audit (2026-06-16) the only variance material on `main` was the - `experimental/echo-additive/` track (`GradedComonad` / `GradedMonad` / - `GradedAdjunction` / `VarianceGate.agda`) — **orphaned** (in no - `All.agda`, not CI-verified; `VarianceGate.agda` self-declares "This file - contains NO proven theorems … OBLIGATION comments", variance **RETRACTED - R-2026-05-18**), so the monad / comonad / adjunction question was genuinely - open *then*. It was **settled four days later by the WIRED - `EchoVariance.agda`** (#243, 2026-06-20 — in `All.agda`, `--safe - --without-K`, zero postulates, pinned in `Smoke.agda`): echo is a graded - **monad of accumulation** (`accumulate = Echo-comp-iso-from`) with a - section/retraction **adjunction exact on the grade-0 fibre** - (`recoverable-fibre = A↔ΣEcho`), and is **NOT a graded comonad** - (`no-bare-recovery` via `no-section-of-collapsing-map` is the obstruction; - sharpens `R-2026-05-18` from "graded comonad withdrawn" to "decided - against"). Cite the WIRED `EchoVariance` for the verdict; the orphaned - `experimental/echo-additive/` track is the retired earlier attempt. See - `docs/echo-types/variance-resolution.adoc`. Build on the wired `Echo` / - `EchoResidue`, `EchoVariance`, `EchoGradedComonad` (coassoc/counit), the - composition isos, and `DyadicEchoBridge`. -- **Env gotcha (fix before handoff).** A *dangling* libraries config - (guix-store name mismatch + a non-existent `…/absolute-zero` path) causes - **false "library name not found" failures** under the default config. - Correct invocation points `--library-file` at the v2.3 stdlib worktree - (`/home/hyperpolymath/developer/worktrees/agda-stdlib-tweak`). A config - artefact, NOT a proof defect. diff --git a/docs/proof-log/2026-04-28.adoc b/docs/proof-log/2026-04-28.adoc new file mode 100644 index 0000000..ebe2c58 --- /dev/null +++ b/docs/proof-log/2026-04-28.adoc @@ -0,0 +1,201 @@ +== Proof-direction log — 2026-04-28 + +=== Session shape + +Recovery from 2026-04-28 morning XFS-induced crash, then a chain of four +landed proof rungs: + +[arabic] +. *C1* — redeem Landauer/Bennett bounds (PR #23, merged). +. *A2* — `+EchoChoreo+` per-decoration composition rung (PR #24, +merged). +. *A1* — equivalence-record packaging for cancel-iso (PR #25, merged). +. *B3* — extended order `+_<ᵇ⁺_+` with shared-binder lex constructors +(this PR, in flight). + +Plus extensive cross-repo and cross-doc updates (CLAUDE.md, roadmap.md, +overview.md, composition.md, taxonomy.md, ECHO-CNO-BRIDGE.adoc). + +The user requested all four in sequence ("`do c1 then a2 then a1`" +followed by "`yes`" for B3) with the documentation pass at the end. + +=== Decisions made and why + +==== C1 — `+FiberSize-fin+` definition + +*Decision.* Pure recursive enumeration over `+Fin n+`, asking the +decidable equality at each index. No `+count+` from stdlib (which isn’t +directly available at the right shape under the version we have). + +*Why.* Keeps the definition transparent, lets us prove the extremal +lemmas (`+-id-zero+`, `+-const+`, `+-no-hit+`, `+-all-hit+`, +`+≡0⟺¬Echo+`) by structural recursion on the same `+Fin+`-shape, no +external dependencies. + +*Trade-off.* Quadratic-style proofs in some cases (e.g. +`+FiberSize-fin-id-zero+` needs `+fs-no-hit+` for the `+suc+`-shifted +tail). Acceptable at this scale. + +==== C1 — `+bennett-reversible+` parameterised, not `+Bijection+`-typed + +*Decision.* `+bennett-reversible+` takes a `+FiberSize-fin f y _≟_ ≡ 1+` +hypothesis directly, rather than a `+Bijection f+` typeclass-style +input. The `+bennett-reversible-id-zero+` instance discharges the +hypothesis for the canonical `+id : Fin (suc m) → Fin (suc m)+` at zero. + +*Why.* The user’s spec mentioned "`Bijection f`" but the spec also +explicitly noted "`(a corollary of `+FiberSize-fin id ≡ 1+` and +`+⌊log₂ 1⌋ ≡ 0+`)`" — the corollary form IS the cleanest statement. +Bringing in a real `+Bijection+` type would require either depending on +stdlib’s `+Function.Bundles.Bijection+` or rolling our own; both add +ceremony for what’s a one-line corollary. + +*Trade-off.* Callers wanting "`if it’s a bijection, the bound is zero`" +need to derive the FiberSize=1 fact themselves. Acceptable because the +`+id+` instance is provided ready-made. + +==== C1 — infinite-domain ProgramState explicitly out of scope + +*Decision.* Strip the `+ProgramState = ℕ → ℕ+` carrier and the trivial +`+cno-zero-energy-at-zero T=0+` corollary from the new +`+EchoThermodynamics+`. Document infinite-domain as out of reach in both +the module preamble and `+docs/ECHO-CNO-BRIDGE.adoc+`. + +*Why.* Keeping the old infinite-domain machinery would invite future +readers to mistake the trivial T=0 corollary for the full "`CNOs +dissipate zero energy`" claim — exactly the original sin that made the +deleted `+ECHO-CNO-BRIDGE-SUMMARY.md+` wrong. + +==== A2 — `+_⊑c_+` as a one-way order, not an equivalence + +*Decision.* Restrict the choreographic-reachability order to +`+Client ⊑c Server+` (one-way) plus reflexive self-loops. Three +constructors (`+c⊑c+`, `+c⊑s+`, `+s⊑s+`). + +*Why.* The reverse `+Server → Client+` move via the same swap exists +(swap is involutive), but including it would make `+_⊑c_+` an +equivalence and collapse the join structure (every two roles would be +mutually upper-bound). The whole point of the per-decoration composition +rung is to test the recipe on a non-trivial order. + +*Trade-off.* Choreography in real life isn’t directional this way. The +order here is a pedagogical artefact, not a model of choreography. +Documented as such in the module preamble. + +==== A1 — packaging via `+Function.Bundles._↔_+` and `+mk↔ₛ′+` + +*Decision.* Use stdlib’s `+mk↔ₛ′+` which takes `+to+`, `+from+`, and +both `+StrictlyInverse{ˡ,ʳ}+` proofs. Both round-trips of the existing +cancel-iso quartet feed in directly. + +*Why.* Keeps the package minimal — no need to define our own equivalence +record. `+mk↔ₛ′+` builds the full `+Inverse+` (with `+to-cong+` / +`+from-cong+` filled in via `+≡.cong+`). Downstream consumers can use +any of the standard projections. + +*Trade-off.* Per-fiber `+(y : C) → ↔+` rather than a single global +equivalence object. That’s a consequence of the codomain `+s y+` varying +with `+y+`; a global object would require a Σ-type or a reformulation. +Per-fiber is the cleanest match for how `+Echo (g ∘ f) y+` is used +downstream. + +==== B3 — separate relation `+_<ᵇ⁺_+` rather than extending `+_<ᵇ_+` + +*Decision.* Define a new module `+Ordinal.Buchholz.OrderExtended+` with +`+_<ᵇ⁺_+` (which lifts `+_<ᵇ_+` and adds `+<ᵇ⁺-ψα+`, `+<ᵇ⁺-+2+`), rather +than adding the constructors directly to `+_<ᵇ_+`. + +*Why.* Adding the constructors to `+_<ᵇ_+` breaks the existing `+wf-<ᵇ+` +proof’s bundle structure. A single-mutual restructure that threads +`+Acc _<ᵇ_ α+` and `+Acc _<ᵇ_ β+` through the bundle *and* uses +`+wf-<ᵇ+` mutually was attempted twice today (once by this session, once +by a parallel session) — both attempts produce code that scope-checks +but fails Agda’s termination checker on the +`+pred-bpsi-from → wf-<ᵇ → ...+` cycle. + +*Trade-off.* Two relations now live side-by-side: the K-free core +`+_<ᵇ_+` (with proven WF) and the extended `+_<ᵇ⁺_+` (with proven irrefl ++ trans, WF still open). Downstream consumers need to pick which one +they need. Documented in `+docs/echo-types/buchholz-extended-wf.md+`; +the next attempt should be Route B (rank-embedding into Brouwer). + +==== B3 — explicit equality witness on `+<ᵇ⁺-ψα+` and `+<ᵇ⁺-+2+` + +*Decision.* Each constructor has the shape +`+∀ {ν₁ ν₂ α β} → ν₁ ≡ ν₂ → α <ᵇ β → bpsi ν₁ α <ᵇ⁺ bpsi ν₂ β+` +(equivalent for `++2+`). The equality is an explicit argument, not an +implicit binder identification. + +*Why.* The natural shape `+bpsi ν α <ᵇ⁺ bpsi ν β+` (sharing `+ν+` across +both sides of `+<ᵇ⁺+`) triggers a reflexive `+ν = ν+` equation in +irrefl’s pattern unification, which `+--without-K+` rejects. Carrying +the equality explicitly keeps all four constructor implicits as pattern +variables, sidestepping the K-restriction. The equality is then NOT +pattern-matched on `+refl+` in irrefl (matching `+refl : x ≡ x+` ALSO +triggers K-restriction once the LHS/RHS of `+<ᵇ⁺+` have been unified to +a common carrier); it is only matched in `+<ᵇ⁺-trans+` where the +equality is on FRESH pattern variables, satisfying the Cockx–Sjöberg +criterion. + +*Trade-off.* Callers must provide a `+refl+` argument explicitly +(`+<ᵇ⁺-ψα refl p+`). Convenience wrappers `+<ᵇ⁺-ψα-refl+` and +`+<ᵇ⁺-+2-refl+` paper over this for the common case. + +==== B3 — four `+extend-{lhs,rhs}+` helpers in `+<ᵇ⁺-trans+` + +*Decision.* The mixed-shape transitivity cases +(`+base × shared-binder+`) factor through four helper lemmas that walk +the base witness’s structure to swap the shared binder freely. + +*Why.* The base constructors that put `+bpsi+` (or `+bplus+`) on either +side of `+<ᵇ+` (`+<ᵇ-0-ψ+`, `+<ᵇ-Ωψ+`, `+<ᵇ-ψΩ+`, `+<ᵇ-+ψ+`, `+<ᵇ-ψ++`, +etc.) do not constrain the relevant binder, so we can re-apply the +constructor at a different binder value. The helpers make this explicit +and bundle the case analysis once. + +*Trade-off.* Adds ~30 lines of explicit case work. Could be collapsed by +using `+cong+` on a constructor parameter, but the explicit form is more +readable. + +=== Open at end of session + +* `+_<ᵇ⁺_+` well-foundedness — Route A failed twice, Route B is the +recommended next attempt. See +`+docs/echo-types/buchholz-extended-wf.md+`. +* Brouwer Phase 1.3 limit case of `+≤′-refl+` — drafted by the parallel +session, reverted pending discharge. +* Unbudgeted `+_<ᵇʳᶠ_+` global WF (pre-existing, not touched this +session). +* C2 (Shannon-entropy formalisation), C3 (infinite-domain Landauer), C4 +(physical heat dissipation) — all noted in roadmap.md as gated on +prerequisites we don’t have. + +=== Files touched (this session, in order) + +* `+proofs/agda/EchoFiberCount.agda+` (new) +* `+proofs/agda/EchoThermodynamics.agda+` (rewritten) +* `+proofs/agda/EchoStabilityTests.agda+` (Section 2 rewritten) +* `+proofs/agda/All.agda+` (wire EchoFiberCount + OrderExtended) +* `+proofs/agda/Smoke.agda+` (pin all new headlines) +* `+proofs/agda/EchoChoreo.agda+` (added _⊑c_ rung) +* `+proofs/agda/Echo.agda+` (added Echo-comp-iso + cancel-iso packagers) +* `+proofs/agda/Ordinal/Buchholz/OrderExtended.agda+` (new) +* `+docs/echo-types/composition.md+` (rung sweep + cancel-iso closed) +* `+docs/echo-types/taxonomy.md+` (§8 EchoFiberCount reference) +* `+docs/echo-types/roadmap.md+` (rung-state refresh) +* `+docs/echo-types/overview.md+` (Buchholz state refresh) +* `+docs/echo-types/buchholz-extended-wf.md+` (new design note) +* `+docs/proof-log/2026-04-28.md+` (this file) +* `+docs/ECHO-CNO-BRIDGE.adoc+` (four overclaim sites swept) +* `+CLAUDE.md+` (current rung state refresh) + +=== What I’d do differently + +* *Try Route B first for `+_<ᵇ⁺_+` WF.* Two sessions burned on Route A’s +termination problem; the rank-embedding route is algebraic rather than +proof-engineering and has a clearer failure mode (a missing +strict-monotonicity lemma is easier to debug than Agda’s +structural-decrease checker). +* *Verify build with `+find -name '*.agdai' -delete+` before each task +switch.* Cached `+.agdai+` files masked a broken `+WellFounded.agda+` +for several tool-invocations until I forced a clean rebuild. diff --git a/docs/proof-log/2026-04-28.md b/docs/proof-log/2026-04-28.md deleted file mode 100644 index 989d804..0000000 --- a/docs/proof-log/2026-04-28.md +++ /dev/null @@ -1,207 +0,0 @@ - - -# Proof-direction log — 2026-04-28 - -## Session shape - -Recovery from 2026-04-28 morning XFS-induced crash, then a chain -of four landed proof rungs: - -1. **C1** — redeem Landauer/Bennett bounds (PR #23, merged). -2. **A2** — `EchoChoreo` per-decoration composition rung (PR #24, merged). -3. **A1** — equivalence-record packaging for cancel-iso (PR #25, merged). -4. **B3** — extended order `_<ᵇ⁺_` with shared-binder lex - constructors (this PR, in flight). - -Plus extensive cross-repo and cross-doc updates (CLAUDE.md, roadmap.md, -overview.md, composition.md, taxonomy.md, ECHO-CNO-BRIDGE.adoc). - -The user requested all four in sequence ("do c1 then a2 then a1" -followed by "yes" for B3) with the documentation pass at the end. - -## Decisions made and why - -### C1 — `FiberSize-fin` definition - -**Decision.** Pure recursive enumeration over `Fin n`, asking the -decidable equality at each index. No `count` from stdlib (which -isn't directly available at the right shape under the version we -have). - -**Why.** Keeps the definition transparent, lets us prove the -extremal lemmas (`-id-zero`, `-const`, `-no-hit`, `-all-hit`, -`≡0⟺¬Echo`) by structural recursion on the same `Fin`-shape, -no external dependencies. - -**Trade-off.** Quadratic-style proofs in some cases (e.g. -`FiberSize-fin-id-zero` needs `fs-no-hit` for the `suc`-shifted -tail). Acceptable at this scale. - -### C1 — `bennett-reversible` parameterised, not `Bijection`-typed - -**Decision.** `bennett-reversible` takes a `FiberSize-fin f y _≟_ ≡ 1` -hypothesis directly, rather than a `Bijection f` typeclass-style -input. The `bennett-reversible-id-zero` instance discharges the -hypothesis for the canonical `id : Fin (suc m) → Fin (suc m)` at -zero. - -**Why.** The user's spec mentioned "Bijection f" but the spec also -explicitly noted "(a corollary of `FiberSize-fin id ≡ 1` and -`⌊log₂ 1⌋ ≡ 0`)" — the corollary form IS the cleanest statement. -Bringing in a real `Bijection` type would require either depending -on stdlib's `Function.Bundles.Bijection` or rolling our own; both -add ceremony for what's a one-line corollary. - -**Trade-off.** Callers wanting "if it's a bijection, the bound is -zero" need to derive the FiberSize=1 fact themselves. Acceptable -because the `id` instance is provided ready-made. - -### C1 — infinite-domain ProgramState explicitly out of scope - -**Decision.** Strip the `ProgramState = ℕ → ℕ` carrier and the -trivial `cno-zero-energy-at-zero T=0` corollary from the new -`EchoThermodynamics`. Document infinite-domain as out of reach -in both the module preamble and `docs/ECHO-CNO-BRIDGE.adoc`. - -**Why.** Keeping the old infinite-domain machinery would invite -future readers to mistake the trivial T=0 corollary for the full -"CNOs dissipate zero energy" claim — exactly the original sin -that made the deleted `ECHO-CNO-BRIDGE-SUMMARY.md` wrong. - -### A2 — `_⊑c_` as a one-way order, not an equivalence - -**Decision.** Restrict the choreographic-reachability order to -`Client ⊑c Server` (one-way) plus reflexive self-loops. Three -constructors (`c⊑c`, `c⊑s`, `s⊑s`). - -**Why.** The reverse `Server → Client` move via the same swap -exists (swap is involutive), but including it would make `_⊑c_` -an equivalence and collapse the join structure (every two roles -would be mutually upper-bound). The whole point of the -per-decoration composition rung is to test the recipe on a -non-trivial order. - -**Trade-off.** Choreography in real life isn't directional this -way. The order here is a pedagogical artefact, not a model of -choreography. Documented as such in the module preamble. - -### A1 — packaging via `Function.Bundles._↔_` and `mk↔ₛ′` - -**Decision.** Use stdlib's `mk↔ₛ′` which takes `to`, `from`, and -both `StrictlyInverse{ˡ,ʳ}` proofs. Both round-trips of the -existing cancel-iso quartet feed in directly. - -**Why.** Keeps the package minimal — no need to define our own -equivalence record. `mk↔ₛ′` builds the full `Inverse` (with -`to-cong` / `from-cong` filled in via `≡.cong`). Downstream -consumers can use any of the standard projections. - -**Trade-off.** Per-fiber `(y : C) → ↔` rather than a single global -equivalence object. That's a consequence of the codomain `s y` -varying with `y`; a global object would require a Σ-type or a -reformulation. Per-fiber is the cleanest match for how -`Echo (g ∘ f) y` is used downstream. - -### B3 — separate relation `_<ᵇ⁺_` rather than extending `_<ᵇ_` - -**Decision.** Define a new module `Ordinal.Buchholz.OrderExtended` -with `_<ᵇ⁺_` (which lifts `_<ᵇ_` and adds `<ᵇ⁺-ψα`, `<ᵇ⁺-+2`), -rather than adding the constructors directly to `_<ᵇ_`. - -**Why.** Adding the constructors to `_<ᵇ_` breaks the existing -`wf-<ᵇ` proof's bundle structure. A single-mutual restructure -that threads `Acc _<ᵇ_ α` and `Acc _<ᵇ_ β` through the bundle -**and** uses `wf-<ᵇ` mutually was attempted twice today (once -by this session, once by a parallel session) — both attempts -produce code that scope-checks but fails Agda's termination -checker on the `pred-bpsi-from → wf-<ᵇ → ...` cycle. - -**Trade-off.** Two relations now live side-by-side: the K-free -core `_<ᵇ_` (with proven WF) and the extended `_<ᵇ⁺_` (with -proven irrefl + trans, WF still open). Downstream consumers -need to pick which one they need. Documented in -`docs/echo-types/buchholz-extended-wf.md`; the next attempt -should be Route B (rank-embedding into Brouwer). - -### B3 — explicit equality witness on `<ᵇ⁺-ψα` and `<ᵇ⁺-+2` - -**Decision.** Each constructor has the shape -`∀ {ν₁ ν₂ α β} → ν₁ ≡ ν₂ → α <ᵇ β → bpsi ν₁ α <ᵇ⁺ bpsi ν₂ β` -(equivalent for `+2`). The equality is an explicit argument, not -an implicit binder identification. - -**Why.** The natural shape `bpsi ν α <ᵇ⁺ bpsi ν β` (sharing `ν` -across both sides of `<ᵇ⁺`) triggers a reflexive `ν = ν` equation -in irrefl's pattern unification, which `--without-K` rejects. -Carrying the equality explicitly keeps all four constructor -implicits as pattern variables, sidestepping the K-restriction. -The equality is then NOT pattern-matched on `refl` in irrefl -(matching `refl : x ≡ x` ALSO triggers K-restriction once the -LHS/RHS of `<ᵇ⁺` have been unified to a common carrier); it is -only matched in `<ᵇ⁺-trans` where the equality is on FRESH -pattern variables, satisfying the Cockx–Sjöberg criterion. - -**Trade-off.** Callers must provide a `refl` argument explicitly -(`<ᵇ⁺-ψα refl p`). Convenience wrappers `<ᵇ⁺-ψα-refl` and -`<ᵇ⁺-+2-refl` paper over this for the common case. - -### B3 — four `extend-{lhs,rhs}` helpers in `<ᵇ⁺-trans` - -**Decision.** The mixed-shape transitivity cases -(`base × shared-binder`) factor through four helper lemmas that -walk the base witness's structure to swap the shared binder -freely. - -**Why.** The base constructors that put `bpsi` (or `bplus`) on -either side of `<ᵇ` (`<ᵇ-0-ψ`, `<ᵇ-Ωψ`, `<ᵇ-ψΩ`, `<ᵇ-+ψ`, -`<ᵇ-ψ+`, etc.) do not constrain the relevant binder, so we can -re-apply the constructor at a different binder value. The -helpers make this explicit and bundle the case analysis once. - -**Trade-off.** Adds ~30 lines of explicit case work. Could be -collapsed by using `cong` on a constructor parameter, but the -explicit form is more readable. - -## Open at end of session - -* `_<ᵇ⁺_` well-foundedness — Route A failed twice, Route B is - the recommended next attempt. See - `docs/echo-types/buchholz-extended-wf.md`. -* Brouwer Phase 1.3 limit case of `≤′-refl` — drafted by the - parallel session, reverted pending discharge. -* Unbudgeted `_<ᵇʳᶠ_` global WF (pre-existing, not touched this - session). -* C2 (Shannon-entropy formalisation), C3 (infinite-domain - Landauer), C4 (physical heat dissipation) — all noted in - roadmap.md as gated on prerequisites we don't have. - -## Files touched (this session, in order) - -* `proofs/agda/EchoFiberCount.agda` (new) -* `proofs/agda/EchoThermodynamics.agda` (rewritten) -* `proofs/agda/EchoStabilityTests.agda` (Section 2 rewritten) -* `proofs/agda/All.agda` (wire EchoFiberCount + OrderExtended) -* `proofs/agda/Smoke.agda` (pin all new headlines) -* `proofs/agda/EchoChoreo.agda` (added _⊑c_ rung) -* `proofs/agda/Echo.agda` (added Echo-comp-iso + cancel-iso packagers) -* `proofs/agda/Ordinal/Buchholz/OrderExtended.agda` (new) -* `docs/echo-types/composition.md` (rung sweep + cancel-iso closed) -* `docs/echo-types/taxonomy.md` (§8 EchoFiberCount reference) -* `docs/echo-types/roadmap.md` (rung-state refresh) -* `docs/echo-types/overview.md` (Buchholz state refresh) -* `docs/echo-types/buchholz-extended-wf.md` (new design note) -* `docs/proof-log/2026-04-28.md` (this file) -* `docs/ECHO-CNO-BRIDGE.adoc` (four overclaim sites swept) -* `CLAUDE.md` (current rung state refresh) - -## What I'd do differently - -* **Try Route B first for `_<ᵇ⁺_` WF.** Two sessions burned on - Route A's termination problem; the rank-embedding route is - algebraic rather than proof-engineering and has a clearer - failure mode (a missing strict-monotonicity lemma is easier - to debug than Agda's structural-decrease checker). -* **Verify build with `find -name '*.agdai' -delete` before each - task switch.** Cached `.agdai` files masked a broken - `WellFounded.agda` for several tool-invocations until I forced - a clean rebuild. diff --git a/docs/proof-obligations.adoc b/docs/proof-obligations.adoc new file mode 100644 index 0000000..fb33f81 --- /dev/null +++ b/docs/proof-obligations.adoc @@ -0,0 +1,30 @@ +== Proof Obligation Ledger + +=== Foundational Core + +* *Echo Introduction:* PROVED (`+echo-intro+`) +* *Map Over:* PROVED (`+map-over+`) +* *Composition Law:* PROVED (`+map-over-comp+`) +* *Identity Law:* PROVED (`+map-over-id+`) + +=== Characteristic Theorems + +* *Non-injectivity of collapse:* PROVED (`+collapse-non-injective+`) +* *No-section for visible output:* PROVED (`+no-section-visible+`) +* *No-section for weakened residue:* PROVED (`+no-section-weaken+`) +* *Distinct echoes over same base:* PROVED (`+echo-true≢echo-false+`) +* *Retained constraint for projection:* PROVED (`+visible-constraint+`) + +=== Bridges & Extensions (Speculative / Exploratory) + +* *Graded Comonad Framing:* RETRACTED (This is a thin-poset action, not +a comonad. See `+docs/retracted/retractions.adoc+`) +* *Universal Property / Terminal Cone:* RETRACTED (Requires funext, not +natively constructible. See `+docs/retracted/retractions.adoc+`) +* *Conservativity Claims:* RETRACTED +* *Two-Models Framing:* RETRACTED +* *CNO Bridge (Absolute Zero):* PARTIAL +* *JanusKey Integration:* PARTIAL +* *Tropical Semantics (Argmin residues):* PARTIAL +* *Buchholz/Veblen Ordinal Representation:* BLOCKED (Well-foundedness of +shared-binder cases blocked on self-lift) diff --git a/docs/proof-obligations.md b/docs/proof-obligations.md deleted file mode 100644 index 30e7a32..0000000 --- a/docs/proof-obligations.md +++ /dev/null @@ -1,26 +0,0 @@ - - -# Proof Obligation Ledger - -## Foundational Core -- **Echo Introduction:** PROVED (`echo-intro`) -- **Map Over:** PROVED (`map-over`) -- **Composition Law:** PROVED (`map-over-comp`) -- **Identity Law:** PROVED (`map-over-id`) - -## Characteristic Theorems -- **Non-injectivity of collapse:** PROVED (`collapse-non-injective`) -- **No-section for visible output:** PROVED (`no-section-visible`) -- **No-section for weakened residue:** PROVED (`no-section-weaken`) -- **Distinct echoes over same base:** PROVED (`echo-true≢echo-false`) -- **Retained constraint for projection:** PROVED (`visible-constraint`) - -## Bridges & Extensions (Speculative / Exploratory) -- **Graded Comonad Framing:** RETRACTED (This is a thin-poset action, not a comonad. See `docs/retracted/retractions.adoc`) -- **Universal Property / Terminal Cone:** RETRACTED (Requires funext, not natively constructible. See `docs/retracted/retractions.adoc`) -- **Conservativity Claims:** RETRACTED -- **Two-Models Framing:** RETRACTED -- **CNO Bridge (Absolute Zero):** PARTIAL -- **JanusKey Integration:** PARTIAL -- **Tropical Semantics (Argmin residues):** PARTIAL -- **Buchholz/Veblen Ordinal Representation:** BLOCKED (Well-foundedness of shared-binder cases blocked on self-lift) diff --git a/docs/research-boundaries.adoc b/docs/research-boundaries.adoc new file mode 100644 index 0000000..55c4316 --- /dev/null +++ b/docs/research-boundaries.adoc @@ -0,0 +1,32 @@ +== Research Boundaries + +The goal of this project is to maintain a minimal, defensible core for +Echo Types. + +=== What is In-Scope + +* *Proof-preserving cleanup:* Refactoring that maintains exact semantics +and improves readability. +* *Documentation precision:* Clarifying exact proof obligations, adding +theorem indexes, and noting limitations. +* *Compatibility hardening:* Using wrappers to ensure stable imports for +dependent projects. +* *Auditing:* Verification scripts that reject unsafe assumptions or +pragmas. +* *Minimal Canonical Examples:* Small, self-contained illustrations of +structured loss (e.g., lossy boolean classification, provenance). + +=== What is Strictly Out-of-Scope + +* *Abstraction expansion:* Inventing new mathematical terminology or +introducing large categorical frameworks unless strictly required by a +specific, mechanically verified theorem. +* *Theory growth:* Attempting to "`complete`" the theory beyond the +established minimal core. +* *Revisiting Retractions:* Revisiting graded-comonad framing, universal +property framing, or thermodynamics without substantial new mechanical +breakthroughs. +* *Unsafe assumptions:* Introducing `+postulate+`, `+TERMINATING+`, or +`+--allow-unsolved-metas+` to force a proof to pass. +* *Overclaiming:* Using hype-driven terminology like "`revolutionary`" +or "`universal`" in place of "`mechanically checked`" or "`candidate.`" diff --git a/docs/research-boundaries.md b/docs/research-boundaries.md deleted file mode 100644 index 5b7e697..0000000 --- a/docs/research-boundaries.md +++ /dev/null @@ -1,19 +0,0 @@ - - -# Research Boundaries - -The goal of this project is to maintain a minimal, defensible core for Echo Types. - -## What is In-Scope -- **Proof-preserving cleanup:** Refactoring that maintains exact semantics and improves readability. -- **Documentation precision:** Clarifying exact proof obligations, adding theorem indexes, and noting limitations. -- **Compatibility hardening:** Using wrappers to ensure stable imports for dependent projects. -- **Auditing:** Verification scripts that reject unsafe assumptions or pragmas. -- **Minimal Canonical Examples:** Small, self-contained illustrations of structured loss (e.g., lossy boolean classification, provenance). - -## What is Strictly Out-of-Scope -- **Abstraction expansion:** Inventing new mathematical terminology or introducing large categorical frameworks unless strictly required by a specific, mechanically verified theorem. -- **Theory growth:** Attempting to "complete" the theory beyond the established minimal core. -- **Revisiting Retractions:** Revisiting graded-comonad framing, universal property framing, or thermodynamics without substantial new mechanical breakthroughs. -- **Unsafe assumptions:** Introducing `postulate`, `TERMINATING`, or `--allow-unsolved-metas` to force a proof to pass. -- **Overclaiming:** Using hype-driven terminology like "revolutionary" or "universal" in place of "mechanically checked" or "candidate." diff --git a/docs/retracted/legacy-retractions.adoc b/docs/retracted/legacy-retractions.adoc new file mode 100644 index 0000000..116e319 --- /dev/null +++ b/docs/retracted/legacy-retractions.adoc @@ -0,0 +1,21 @@ +== Legacy Retractions and Spikes + +This document records exploratory branches that were discarded or +retracted as part of the refactoring into a minimal defensible core. +These branches exist on GitHub for historical reference but have been +removed from the local workspace to maintain structural integrity. + +=== Retracted Theory Branches + +* `+f1-spike/graded-comonad-checkpoint+`: Exploratory work on the +"`Graded Comonad`" framing. Retracted on 2026-05-18 after finding the +structure is a thin-poset action, not a true graded comonad. +* `+reframe/retraction-2026-05-18+`: Initial draft of the 2026-05-18 +reframing and retraction logic. + +=== Abandoned Spikes + +* `+f3-interface-phase1+`: Superseded by the Axis 8 (Access Modality) +and established core interfaces. +* `+roadmap/proof-debt-ledger-2026-05-18+`: Superseded by the +`+docs/proof-obligations.md+` ledger. diff --git a/docs/retracted/legacy-retractions.md b/docs/retracted/legacy-retractions.md deleted file mode 100644 index 4239580..0000000 --- a/docs/retracted/legacy-retractions.md +++ /dev/null @@ -1,15 +0,0 @@ - -# Legacy Retractions and Spikes - -This document records exploratory branches that were discarded or retracted as part of the refactoring into a minimal defensible core. These branches exist on GitHub for historical reference but have been removed from the local workspace to maintain structural integrity. - -## Retracted Theory Branches -- `f1-spike/graded-comonad-checkpoint`: Exploratory work on the "Graded Comonad" framing. Retracted on 2026-05-18 after finding the structure is a thin-poset action, not a true graded comonad. -- `reframe/retraction-2026-05-18`: Initial draft of the 2026-05-18 reframing and retraction logic. - -## Abandoned Spikes -- `f3-interface-phase1`: Superseded by the Axis 8 (Access Modality) and established core interfaces. -- `roadmap/proof-debt-ledger-2026-05-18`: Superseded by the `docs/proof-obligations.md` ledger. diff --git a/docs/tech-debt-2026-05-26.adoc b/docs/tech-debt-2026-05-26.adoc new file mode 100644 index 0000000..e216f54 --- /dev/null +++ b/docs/tech-debt-2026-05-26.adoc @@ -0,0 +1,66 @@ +== Tech-Debt Audit — echo-types — 2026-05-26 + +*Source:* estate-wide automated scan 2026-05-26. *Companion:* +https://github.com/hyperpolymath/standards/tree/main/docs/audits[`+hyperpolymath/standards+` +2026-05-26-estate-*-debt audits]. *Combined severity:* `+2026-05-23+`. + +This file records the _raw findings_ — it does not by itself fix the +debt. Each section ends with a '`Recommended next move`' line; closing +the debt is follow-up work. + +=== 1. Proof debt + +Scanner counted the following markers in proof-bearing files of this +repo: + +.... +files= 609 | Coq-Axm/Adm= 0 | Lean-srry/ax= 0 | Agda-pst= 0 | Idr-blv= 0 | Idr-prtl= 0 | Fstr-asm= 0 | TODO= 0 | Unsafe= 0 +.... + +*Total markers:* 0. *Severity:* `+>00+`. + +*Recommended next move:* none — no proof-debt markers detected. + +=== 2. Licence debt + +[cols=",",options="header",] +|=== +|Field |Value +|LICENSE file |`+LICENSE+` +|SPDX header |`+NONE+` +|Manifest licence |`+NONE+` +|Body classifier |`+MPL-2.0-pure+` +|Severity |`+ok+` +|=== + +*Recommended next move:* none for licence. + +=== 3. Documentation debt + +[cols=",",options="header",] +|=== +|Field |Value +|README lines |205 +|`+docs/+` files |76 +|`+docs/+` LoC |18112 +|CHANGELOG.md |Y +|CONTRIBUTING.md |Y +|CODE_OF_CONDUCT.md |Y +|SECURITY.md |Y +|Severity |`+readme=205 docs=76/18112+` +|=== + +=== Cross-references + +* Estate proof-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md+` +* Estate licence-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md+` +* Estate documentation-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md+` + +''''' + +🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). +This file is informational — closing the debt is follow-up work owned by +the maintainer. diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md deleted file mode 100644 index 434b75f..0000000 --- a/docs/tech-debt-2026-05-26.md +++ /dev/null @@ -1,59 +0,0 @@ - -# Tech-Debt Audit — echo-types — 2026-05-26 - -**Source:** estate-wide automated scan 2026-05-26. -**Companion:** [`hyperpolymath/standards` 2026-05-26-estate-*-debt audits](https://github.com/hyperpolymath/standards/tree/main/docs/audits). -**Combined severity:** `2026-05-23`. - -This file records the *raw findings* — it does not by itself fix the debt. Each section ends with a 'Recommended next move' line; closing the debt is follow-up work. - -## 1. Proof debt - -Scanner counted the following markers in proof-bearing files of this repo: - -``` -files= 609 | Coq-Axm/Adm= 0 | Lean-srry/ax= 0 | Agda-pst= 0 | Idr-blv= 0 | Idr-prtl= 0 | Fstr-asm= 0 | TODO= 0 | Unsafe= 0 -``` - -**Total markers:** 0. **Severity:** `>00`. - -**Recommended next move:** none — no proof-debt markers detected. - -## 2. Licence debt - -| Field | Value | -|---|---| -| LICENSE file | `LICENSE` | -| SPDX header | `NONE` | -| Manifest licence | `NONE` | -| Body classifier | `MPL-2.0-pure` | -| Severity | `ok` | - -**Recommended next move:** none for licence. - -## 3. Documentation debt - -| Field | Value | -|---|---| -| README lines | 205 | -| `docs/` files | 76 | -| `docs/` LoC | 18112 | -| CHANGELOG.md | Y | -| CONTRIBUTING.md | Y | -| CODE_OF_CONDUCT.md | Y | -| SECURITY.md | Y | -| Severity | `readme=205 docs=76/18112` | - - -## Cross-references - -- Estate proof-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md` -- Estate licence-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md` -- Estate documentation-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md` - ---- - -🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). This file is informational — closing the debt is follow-up work owned by the maintainer. diff --git a/docs/theorem-index.adoc b/docs/theorem-index.adoc new file mode 100644 index 0000000..d934c11 --- /dev/null +++ b/docs/theorem-index.adoc @@ -0,0 +1,274 @@ +== Theorem Index + +This document maps foundational theorems and characteristic results to +their exact locations in the `+proofs/agda/+` tree. + +*Authoritative sources.* `+proofs/agda/Smoke.agda+` is the +machine-checked headline manifest (every name below is pinned there +under a `+using+` block); `+docs/echo-types/MAP.adoc+` is the +content/architecture map. This file is the human-readable index; when in +doubt, prefer Smoke.agda + MAP.adoc. + +=== Foundational Core + +[width="100%",cols="24%,20%,33%,23%",options="header",] +|=== +|Theorem |Status |Module Path |Meaning +|`+echo-intro+` |PROVED |`+proofs/agda/Echo.agda+` |Introduction of an +echo from the base point. + +|`+map-over+` |PROVED |`+proofs/agda/Echo.agda+` |Action on fibers for +morphisms over a fixed base. + +|`+map-over-comp+` |PROVED |`+proofs/agda/Echo.agda+` |Composition law +for fiber morphisms. + +|`+map-over-id+` |PROVED |`+proofs/agda/Echo.agda+` |Identity law for +fiber morphisms. + +|`+map-square+` |PROVED |`+proofs/agda/Echo.agda+` |Action along a +commuting square. + +|`+Echo-comp-iso+` |PROVED |`+proofs/agda/Echo.agda+` +|Composition-accumulation iso (packaged `+↔+`). + +|`+cancel-iso+` |PROVED |`+proofs/agda/Echo.agda+` |Cancellation iso +through a section (with explicit triangle identities). +|=== + +=== Characteristic Results + +[width="100%",cols="24%,20%,33%,23%",options="header",] +|=== +|Theorem |Status |Module Path |Meaning +|`+collapse-non-injective+` |PROVED +|`+proofs/agda/EchoCharacteristic.agda+` |Explicit witness of +irreversible collapse. + +|`+no-section-collapse+` |PROVED +|`+proofs/agda/EchoCharacteristic.agda+` |Impossibility of inverting the +collapse map. + +|`+no-section-visible+` |PROVED |`+proofs/agda/EchoCharacteristic.agda+` +|Impossibility of full reconstruction from visible output alone. + +|`+echo-true≢echo-false+` |PROVED +|`+proofs/agda/EchoCharacteristic.agda+` |Distinct echoes exist over the +same visible output. + +|`+visible-constraint+` |PROVED |`+proofs/agda/EchoCharacteristic.agda+` +|Projection-style loss retains a provable constraint on the source. + +|`+no-section-collapse-to-residue+` |PROVED +|`+proofs/agda/EchoResidue.agda+` |Weakening an echo to a residue +discards irrecoverable information. +|=== + +=== Canonical identity layer (2026-05-27) + +Tier 1 — the canonical-identity-layer named theorems: + +[width="100%",cols="24%,20%,33%,23%",options="header",] +|=== +|Theorem |Status |Module Path |Meaning +|`+A↔ΣEcho+` |PROVED |`+proofs/agda/EchoTotalCompletion.agda+` |The +slogan-unlock: `+A ≃ Σ B (Echo f)+`. + +|`+ofs-witness+` |PROVED +|`+proofs/agda/EchoOrthogonalFactorizationSystem.agda+` |The +(equivalence, projection) OFS witness at the K-free level. + +|`+Image+` / `+image-factor-{left,right,commutes}+` |PROVED +|`+proofs/agda/EchoImageFactorization.agda+` |Image factorisation in +Echo language. + +|`+no-section-of-collapsing-map+` |PROVED +|`+proofs/agda/EchoNoSectionGeneric.agda+` |Structural lift: any +collapsing map with distinguishable collapsing pair admits no section. +|=== + +Tier 2 — the classification grid (kinds-of-loss × shapes-of-residue): + +[width="100%",cols="24%,20%,33%,23%",options="header",] +|=== +|Theorem / Record |Status |Module Path |Meaning +|`+HasInverse+` + EQUIV/INJ/SURJ/CONST theorems |PROVED +|`+proofs/agda/EchoLossTaxonomy.agda+` |Function-side four-axis +classification. + +|`+ResidueForm+` + four instances |PROVED +|`+proofs/agda/EchoResidueTaxonomy.agda+` |Per-output residue carrier + +lowering shape. + +|`+DecorationStructure+` + four instances + `+DegradeAbstract+` |PROVED +|`+proofs/agda/EchoDecorationStructure.agda+` |Seven-field decoration +recipe + abstract degrade-compose. + +|`+_≡m_+` + `+mode-equality-strictly-finer-at-linear+` |PROVED +|`+proofs/agda/EchoObservationalEquivalence.agda+` |Mode-indexed +observational equality on `+LEcho+`. +|=== + +Tier 3 / Pillar F Gate F5 FULL PASS (qualified OFS earn-back, +funext-qualified, never postulated): + +[width="100%",cols="24%,20%,33%,23%",options="header",] +|=== +|Theorem |Status |Module Path |Meaning +|`+echo-factorisation-strict+` |PROVED (funext) +|`+proofs/agda/EchoOFSUnivF5.agda+` |F5-1: function-level factorisation +triangle. + +|Diagonal lifting (`+module Pointwise+` + `+module Strict+`) |PROVED +|`+proofs/agda/EchoOFSUnivF5Diag.agda+` |F5-2: diagonal lifting +property. + +|Factorisation uniqueness up to iso (`+module Pointwise+` + +`+module Strict+`) |PROVED |`+proofs/agda/EchoOFSUnivF5Iso.agda+` |F5-3: +factorisation uniqueness via composition design. +|=== + +Audience-facing modules (Tier 3 audience moves; each ships record + +parametric headline theorems + worked instance + honest-bound +matched-negatives): + +[width="100%",cols="24%,28%,48%",options="header",] +|=== +|Module |Audience |Worked Instance +|`+EchoProvenance.agda+` |Database / lineage / K-provenance +|`+bool-over-nat-provenance+` + +|`+EchoSecurity.agda+` |Region-exit / capability-flow (generalises +`+tutorial/region_exit_audit/+`) |`+region-exit-audit-instance+` + +|`+EchoProbabilisticSupport.agda+` |Sampling / draw-id (NOT +measure-theoretic probability) |`+bool-indexed-nat-sampling+` + +|`+EchoDifferential.agda+` |Sensitivity / perturbation tracking (NOT +ε-DP) |`+bool-perturbed-nat-sensitivity+` +|=== + +Cementing matched-negatives: + +[width="100%",cols="30%,41%,29%",options="header",] +|=== +|Theorem |Module Path |Meaning +|`+entropy-shadow-blind+` + +`+witness-distinguishes-where-entropy-cannot+` +|`+proofs/agda/EchoEntropy.agda+` |Shannon-entropy shadow is blind where +Echo distinguishes. + +|`+gap-paired+` (`+ll-encoding-gap+` + `+source-no-section+`) +|`+proofs/agda/EchoLLEncoding.agda+` |LL `+!A := 1+` shadow has a +section that Echo provably lacks. +|=== + +Curated single-file entry point: +`+proofs/agda/EchoCanonicalIdentitySuite.agda+` re-exports every +load-bearing headline above under the suite-side index. + +=== Degrade-law family (aggregate) + +The "`degrade`" results are the per-decoration composition + join laws +demonstrating that loss has _direction_ (down-step admissible, up-step +not — the no-section family below is the matching diagonal). All sites +PROVED and pinned in `+proofs/agda/Smoke.agda+`. + +[width="100%",cols="32%,68%",options="header",] +|=== +|Site |Module Path +|`+degrade-comp+`, `+degrade-compose+`, `+degrade-via-join+` +|`+proofs/agda/EchoGraded.agda+` + +|`+degradeMode-comp+`, `+degradeMode-compose+`, `+degradeMode-via-join+` +|`+proofs/agda/EchoLinear.agda+` + +|`+applyChoreo-compose+` |`+proofs/agda/EchoChoreo.agda+` + +|`+degrade-access-comp+`, `+degrade-access-compose+`, +`+degrade-access-via-join+` |`+proofs/agda/EchoAccess.agda+` + +|`+degrade-cost-compose+` (and family) |`+proofs/agda/EchoCost.agda+` + +|`+degrade-search-compose+` (and family) +|`+proofs/agda/EchoSearch.agda+` + +|*`+DegradeAbstract.degrade-compose-abstract+`* (carrier-side abstract; +closes the per-module recipes once over the `+DecorationStructure+` +record) |`+proofs/agda/EchoDecorationStructure.agda+` +|=== + +Separating model (locates the reduction): +`+EchoSeparating.sep-degrade-compose-fails+` exhibits a checked +`+true ≢ false+` failure when the single load-bearing hypothesis +`+≤g-prop+` is removed. + +See `+core/skepticisms/is-this-just-sigma-types.md+` §2 and +`+docs/echo-types/sigma-distinctness-map.adoc+` §"`Demand 2`" for the +sceptic-facing framing. Honest framing per `+docs/retractions.adoc+` +R-2026-05-18: this is a _thin-poset reindexing modality_, not a graded +comonad. + +=== No-section family (aggregate) + +The "`no-section`" results land at multiple sites across the decoration +layers and are collectively the answer to "`raw `+Σ+` would give +`+proj₁+` for free`". All are pinned in `+proofs/agda/Smoke.agda+`. + +[width="100%",cols="32%,68%",options="header",] +|=== +|Site |Module Path +|`+no-section-collapse+` |`+proofs/agda/EchoCharacteristic.agda+` + +|`+no-section-visible+` |`+proofs/agda/EchoCharacteristic.agda+` + +|`+no-section-collapse-to-residue+` |`+proofs/agda/EchoResidue.agda+` + +|`+no-section-weaken+` |`+proofs/agda/EchoLinear.agda+` + +|`+no-section-ordinal-collapse+` |`+proofs/agda/EchoOrdinal.agda+` + +|`+no-section-to-epistemic+` |`+proofs/agda/EchoEpistemicResidue.agda+` + +|*`+no-section-of-collapsing-map+`* (structural lift covering all of the +above) |`+proofs/agda/EchoNoSectionGeneric.agda+` + +|*`+no-section-when-non-injective-at-y+`* (Echo-specific corollary) +|`+proofs/agda/EchoNoSectionGeneric.agda+` + +|*`+audit-no-recovery-at+`* (per-region instance, factored through +`+no-section-of-collapsing-map+`) |`+proofs/agda/EchoSecurity.agda+` +|=== + +See `+core/skepticisms/is-this-just-sigma-types.md+` §1 and +`+docs/echo-types/sigma-distinctness-map.adoc+` §"`Demand 1`" for the +sceptic-facing framing. + +=== Pillar F gate ledger + +[width="100%",cols="19%,24%,39%,18%",options="header",] +|=== +|Gate |Status |Module Path |Date +|F1 — Graded-comonad witness (make-or-break) |PASSED +|`+proofs/agda/EchoGradedComonadF1.agda+` |2026-05-20 + +|F2 — Echo functor second model |PASSED +|`+proofs/agda/EchoStepNDModelF2.agda+` |2026-05-18 + +|F3 — Independent second graded-comonad model |PASSED +|`+proofs/agda/EchoGradedComonadInstance{1,2}.agda+` |2026-05-20 + +|F4 — Funext-qualified pullback universal property |PASSED +|`+proofs/agda/EchoPullbackUnivF4.agda+` |2026-05-18 + +|F5 — Funext-qualified full OFS (three slices) |PASSED +|`+proofs/agda/EchoOFSUnivF5{,Diag,Iso}.agda+` |2026-05-27 +|=== + +Gate ledger: `+docs/echo-types/earn-back-plan.adoc+`. Retraction +follow-ups: `+docs/retractions.adoc+` (R-2026-05-18 + F-2026-05-18a + +F-2026-05-20a/b + F-2026-05-27a). + +_Note: For experimental bridges or retracted claims, refer to the +link:proof-obligations.md[Proof Obligation Ledger] and +link:bridge-status.md[Bridge Status]._ diff --git a/docs/theorem-index.md b/docs/theorem-index.md deleted file mode 100644 index 9122cb4..0000000 --- a/docs/theorem-index.md +++ /dev/null @@ -1,149 +0,0 @@ - - - -# Theorem Index - -This document maps foundational theorems and characteristic results -to their exact locations in the `proofs/agda/` tree. - -**Authoritative sources.** `proofs/agda/Smoke.agda` is the -machine-checked headline manifest (every name below is pinned there -under a `using` block); `docs/echo-types/MAP.adoc` is the -content/architecture map. This file is the human-readable index; -when in doubt, prefer Smoke.agda + MAP.adoc. - -## Foundational Core - -| Theorem | Status | Module Path | Meaning | -|---------|--------|-------------|---------| -| `echo-intro` | PROVED | `proofs/agda/Echo.agda` | Introduction of an echo from the base point. | -| `map-over` | PROVED | `proofs/agda/Echo.agda` | Action on fibers for morphisms over a fixed base. | -| `map-over-comp` | PROVED | `proofs/agda/Echo.agda` | Composition law for fiber morphisms. | -| `map-over-id` | PROVED | `proofs/agda/Echo.agda` | Identity law for fiber morphisms. | -| `map-square` | PROVED | `proofs/agda/Echo.agda` | Action along a commuting square. | -| `Echo-comp-iso` | PROVED | `proofs/agda/Echo.agda` | Composition-accumulation iso (packaged `↔`). | -| `cancel-iso` | PROVED | `proofs/agda/Echo.agda` | Cancellation iso through a section (with explicit triangle identities). | - -## Characteristic Results - -| Theorem | Status | Module Path | Meaning | -|---------|--------|-------------|---------| -| `collapse-non-injective` | PROVED | `proofs/agda/EchoCharacteristic.agda` | Explicit witness of irreversible collapse. | -| `no-section-collapse` | PROVED | `proofs/agda/EchoCharacteristic.agda` | Impossibility of inverting the collapse map. | -| `no-section-visible` | PROVED | `proofs/agda/EchoCharacteristic.agda` | Impossibility of full reconstruction from visible output alone. | -| `echo-true≢echo-false` | PROVED | `proofs/agda/EchoCharacteristic.agda` | Distinct echoes exist over the same visible output. | -| `visible-constraint` | PROVED | `proofs/agda/EchoCharacteristic.agda` | Projection-style loss retains a provable constraint on the source. | -| `no-section-collapse-to-residue` | PROVED | `proofs/agda/EchoResidue.agda` | Weakening an echo to a residue discards irrecoverable information. | - -## Canonical identity layer (2026-05-27) - -Tier 1 — the canonical-identity-layer named theorems: - -| Theorem | Status | Module Path | Meaning | -|---------|--------|-------------|---------| -| `A↔ΣEcho` | PROVED | `proofs/agda/EchoTotalCompletion.agda` | The slogan-unlock: `A ≃ Σ B (Echo f)`. | -| `ofs-witness` | PROVED | `proofs/agda/EchoOrthogonalFactorizationSystem.agda` | The (equivalence, projection) OFS witness at the K-free level. | -| `Image` / `image-factor-{left,right,commutes}` | PROVED | `proofs/agda/EchoImageFactorization.agda` | Image factorisation in Echo language. | -| `no-section-of-collapsing-map` | PROVED | `proofs/agda/EchoNoSectionGeneric.agda` | Structural lift: any collapsing map with distinguishable collapsing pair admits no section. | - -Tier 2 — the classification grid (kinds-of-loss × shapes-of-residue): - -| Theorem / Record | Status | Module Path | Meaning | -|---------|--------|-------------|---------| -| `HasInverse` + EQUIV/INJ/SURJ/CONST theorems | PROVED | `proofs/agda/EchoLossTaxonomy.agda` | Function-side four-axis classification. | -| `ResidueForm` + four instances | PROVED | `proofs/agda/EchoResidueTaxonomy.agda` | Per-output residue carrier + lowering shape. | -| `DecorationStructure` + four instances + `DegradeAbstract` | PROVED | `proofs/agda/EchoDecorationStructure.agda` | Seven-field decoration recipe + abstract degrade-compose. | -| `_≡m_` + `mode-equality-strictly-finer-at-linear` | PROVED | `proofs/agda/EchoObservationalEquivalence.agda` | Mode-indexed observational equality on `LEcho`. | - -Tier 3 / Pillar F Gate F5 FULL PASS (qualified OFS earn-back, funext-qualified, never postulated): - -| Theorem | Status | Module Path | Meaning | -|---------|--------|-------------|---------| -| `echo-factorisation-strict` | PROVED (funext) | `proofs/agda/EchoOFSUnivF5.agda` | F5-1: function-level factorisation triangle. | -| Diagonal lifting (`module Pointwise` + `module Strict`) | PROVED | `proofs/agda/EchoOFSUnivF5Diag.agda` | F5-2: diagonal lifting property. | -| Factorisation uniqueness up to iso (`module Pointwise` + `module Strict`) | PROVED | `proofs/agda/EchoOFSUnivF5Iso.agda` | F5-3: factorisation uniqueness via composition design. | - -Audience-facing modules (Tier 3 audience moves; each ships record + parametric headline theorems + worked instance + honest-bound matched-negatives): - -| Module | Audience | Worked Instance | -|--------|----------|-----------------| -| `EchoProvenance.agda` | Database / lineage / K-provenance | `bool-over-nat-provenance` | -| `EchoSecurity.agda` | Region-exit / capability-flow (generalises `tutorial/region_exit_audit/`) | `region-exit-audit-instance` | -| `EchoProbabilisticSupport.agda` | Sampling / draw-id (NOT measure-theoretic probability) | `bool-indexed-nat-sampling` | -| `EchoDifferential.agda` | Sensitivity / perturbation tracking (NOT ε-DP) | `bool-perturbed-nat-sensitivity` | - -Cementing matched-negatives: - -| Theorem | Module Path | Meaning | -|---------|-------------|---------| -| `entropy-shadow-blind` + `witness-distinguishes-where-entropy-cannot` | `proofs/agda/EchoEntropy.agda` | Shannon-entropy shadow is blind where Echo distinguishes. | -| `gap-paired` (`ll-encoding-gap` + `source-no-section`) | `proofs/agda/EchoLLEncoding.agda` | LL `!A := 1` shadow has a section that Echo provably lacks. | - -Curated single-file entry point: `proofs/agda/EchoCanonicalIdentitySuite.agda` re-exports every load-bearing headline above under the suite-side index. - -## Degrade-law family (aggregate) - -The "degrade" results are the per-decoration composition + join laws -demonstrating that loss has *direction* (down-step admissible, up-step -not — the no-section family below is the matching diagonal). All sites -PROVED and pinned in `proofs/agda/Smoke.agda`. - -| Site | Module Path | -|------|-------------| -| `degrade-comp`, `degrade-compose`, `degrade-via-join` | `proofs/agda/EchoGraded.agda` | -| `degradeMode-comp`, `degradeMode-compose`, `degradeMode-via-join` | `proofs/agda/EchoLinear.agda` | -| `applyChoreo-compose` | `proofs/agda/EchoChoreo.agda` | -| `degrade-access-comp`, `degrade-access-compose`, `degrade-access-via-join` | `proofs/agda/EchoAccess.agda` | -| `degrade-cost-compose` (and family) | `proofs/agda/EchoCost.agda` | -| `degrade-search-compose` (and family) | `proofs/agda/EchoSearch.agda` | -| **`DegradeAbstract.degrade-compose-abstract`** (carrier-side abstract; closes the per-module recipes once over the `DecorationStructure` record) | `proofs/agda/EchoDecorationStructure.agda` | - -Separating model (locates the reduction): `EchoSeparating.sep-degrade-compose-fails` -exhibits a checked `true ≢ false` failure when the single load-bearing -hypothesis `≤g-prop` is removed. - -See `core/skepticisms/is-this-just-sigma-types.md` §2 and -`docs/echo-types/sigma-distinctness-map.adoc` §"Demand 2" for the -sceptic-facing framing. Honest framing per -`docs/retractions.adoc` R-2026-05-18: this is a *thin-poset reindexing -modality*, not a graded comonad. - -## No-section family (aggregate) - -The "no-section" results land at multiple sites across the decoration -layers and are collectively the answer to "raw `Σ` would give `proj₁` -for free". All are pinned in `proofs/agda/Smoke.agda`. - -| Site | Module Path | -|------|-------------| -| `no-section-collapse` | `proofs/agda/EchoCharacteristic.agda` | -| `no-section-visible` | `proofs/agda/EchoCharacteristic.agda` | -| `no-section-collapse-to-residue` | `proofs/agda/EchoResidue.agda` | -| `no-section-weaken` | `proofs/agda/EchoLinear.agda` | -| `no-section-ordinal-collapse` | `proofs/agda/EchoOrdinal.agda` | -| `no-section-to-epistemic` | `proofs/agda/EchoEpistemicResidue.agda` | -| **`no-section-of-collapsing-map`** (structural lift covering all of the above) | `proofs/agda/EchoNoSectionGeneric.agda` | -| **`no-section-when-non-injective-at-y`** (Echo-specific corollary) | `proofs/agda/EchoNoSectionGeneric.agda` | -| **`audit-no-recovery-at`** (per-region instance, factored through `no-section-of-collapsing-map`) | `proofs/agda/EchoSecurity.agda` | - -See `core/skepticisms/is-this-just-sigma-types.md` §1 and -`docs/echo-types/sigma-distinctness-map.adoc` §"Demand 1" for the -sceptic-facing framing. - -## Pillar F gate ledger - -| Gate | Status | Module Path | Date | -|------|--------|-------------|------| -| F1 — Graded-comonad witness (make-or-break) | PASSED | `proofs/agda/EchoGradedComonadF1.agda` | 2026-05-20 | -| F2 — Echo functor second model | PASSED | `proofs/agda/EchoStepNDModelF2.agda` | 2026-05-18 | -| F3 — Independent second graded-comonad model | PASSED | `proofs/agda/EchoGradedComonadInstance{1,2}.agda` | 2026-05-20 | -| F4 — Funext-qualified pullback universal property | PASSED | `proofs/agda/EchoPullbackUnivF4.agda` | 2026-05-18 | -| F5 — Funext-qualified full OFS (three slices) | PASSED | `proofs/agda/EchoOFSUnivF5{,Diag,Iso}.agda` | 2026-05-27 | - -Gate ledger: `docs/echo-types/earn-back-plan.adoc`. -Retraction follow-ups: `docs/retractions.adoc` (R-2026-05-18 + F-2026-05-18a + F-2026-05-20a/b + F-2026-05-27a). - -*Note: For experimental bridges or retracted claims, refer to the [Proof Obligation Ledger](proof-obligations.md) and [Bridge Status](bridge-status.md).*